Who we are
Lola Yum sells home gym equipment — free weights, racks, benches and accessories — to private customers through lolayum.uk. The data controller responsible for your personal data is LOLA YUM LIMITED, a company registered in England and Wales.
- Company
- LOLA YUM LIMITED
- Company number
- 17110341
- Registered office
- 292862, Office Suite 29a, 3/F 23 Wharf Street, London, England, SE8 3GG
- ceo@lolayum.uk
- Phone
- +44 7418 263095
- Website
- lolayum.uk
This policy explains what we collect, why, and what you can do about it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy question, email us at the address above.
The data we collect
When you place an order
- Contact details: your full name, email address and phone number.
- Delivery details: delivery address, town or city and postcode.
- Order comment: anything you choose to add, such as access notes for heavy deliveries (steps, a steep drive, garage-only delivery).
- Order details: the items you buy, quantities, prices, delivery method and order number.
Payments
Card and other payment details are entered with and processed by our payment provider. We never see or store your full card number or security code; we receive only confirmation that the payment went through, a transaction reference and the amount.
When you contact us
If you email or call us, we keep your name, contact details and what you tell us — for example room measurements, ceiling height or floor type — so we can answer and follow up.
When you visit the site
Our hosting provider records standard server logs: IP address, browser type, the pages requested and the time of the request. The site loads its fonts from Google Fonts, so your browser sends your IP address to Google when a page opens.
What we do not collect
We do not ask for or collect information about your health, training, body measurements or fitness. If you volunteer it in a message, we use it only to answer that message and do not add it to your customer record.
How we use it and why
We only use your data where UK GDPR gives us a lawful basis:
| Purpose | Lawful basis |
|---|---|
| Processing your order, taking payment and sending order confirmations | Contract |
| Delivering your order, including passing your details to couriers and pallet carriers for heavy and bulky items, and contacting you to arrange a slot | Contract |
| Handling cancellations, returns, refunds and warranty claims | Contract; legal obligation under consumer law |
| Answering questions before you buy | Steps taken at your request before a contract; legitimate interests |
| Keeping accounting and tax records | Legal obligation |
| Keeping the site secure and preventing fraud | Legitimate interests |
| Sending news and offers by email, only if you ask us to | Consent |
Where we rely on legitimate interests, we have weighed them against your rights and kept the processing to what a customer would reasonably expect. We do not make automated decisions that have legal or similarly significant effects on you.
Who we share it with
We never sell your personal data. We share it only with the following, and only as much as each one needs:
- Couriers and freight carriers: your name, delivery address, phone number, email and any access notes. Heavy and bulky items — racks, stands, benches, bars, plate sets and flooring — go by pallet or two-person delivery, and the carrier uses your phone number to book a delivery slot.
- Our payment provider: to take and refund payments and to prevent fraud.
- Manufacturers: your order reference, the product and photos of the fault when we raise a warranty claim for you — only your name if the manufacturer needs it.
- IT, hosting and email providers: who run the website, our email and our order records on our instructions.
- Professional advisers and authorities: our accountants, HMRC, and courts or police where the law requires it.
Every provider acting on our behalf is bound by a written contract that requires them to keep your data secure and use it only for our instructions.
International transfers
We keep order data in the UK where we can. Some of our providers — for example email, hosting and font delivery — may process data in the European Economic Area or the United States. When data leaves the UK, we make sure it is protected by one of the following: UK adequacy regulations (which cover the EEA), the UK Extension to the EU–US Data Privacy Framework, or the ICO’s International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Orders, invoices and payment records: six years from the end of the financial year they relate to, to meet tax and company law requirements.
- Warranty claims: until the manufacturer’s warranty on the item ends, plus 12 months.
- Enquiries that do not lead to an order: 24 months from our last contact.
- Marketing consent: until you withdraw it, and a record of the opt-out afterwards so we don’t contact you again.
- Server logs: up to 30 days.
After these periods we delete the data or anonymise it so it can no longer identify you.
Security
The site is served over an encrypted HTTPS connection. Access to order records is limited to staff who need it, protected by strong passwords and two-factor authentication. Card data is handled only by our payment provider. If a personal data breach puts your rights at risk, we will report it to the ICO within 72 hours and tell you without undue delay.
Cookies
This website does not set cookies and does not use analytics, advertising or tracking pixels. Your cart is held only in the memory of the open page: it is not saved on your device and disappears when you close or reload the page. If we ever add cookies that are not strictly necessary, we will update this policy and ask for your consent first, as the Privacy and Electronic Communications Regulations require.
Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data where there is no good reason to keep it.
- Restriction — ask us to pause using your data, for example while we check its accuracy.
- Portability — receive data you gave us under a contract or consent in a common, machine-readable format, or have it sent to another company.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on your consent.
To use any of these rights, email ceo@lolayum.uk or write to our registered office. It is free, and we will reply within one month; we may ask for proof of identity first. Some rights have limits — for example, we must keep order records for tax purposes even if you ask us to delete them.
Withdrawing consent
Where we rely on your consent, such as for marketing emails, you can withdraw it at any time by using the unsubscribe link in any email or by writing to ceo@lolayum.uk. Withdrawing consent does not affect processing we carried out before, or processing we do on another lawful basis, such as delivering an order you have already placed.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office:
- Website
- ico.org.uk
- Helpline
- 0303 123 1113
- Post
- Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Age restriction
Our site and products are for adults. You must be 18 or over to place an order. We do not knowingly collect personal data from anyone under 18; if you believe a child has sent us their details, contact us and we will delete them.
Changes to this policy
We review this policy when our services, providers or the law change. The date at the top shows when it was last updated. If a change affects how we use data you have already given us, we will email you before it takes effect.
Last updated: 11 September 2026.