Privacy policy

Last updated: 4 November 2025

We are Koala UK Operations Ltd (Company Number 15967017), but you can call us Koala. In our Privacy Policy, we also call ourselves “we”, “us” and “our” and we refer to you as… you guessed it, “you” or “your”.  Our Registered Office Address is C/o CSC CLS (UK) Ltd 5 Churchill Place, 10th Floor, London, United Kingdom E14 5HU. 

Does this Privacy Policy apply to you?

This Privacy Policy applies to our handling of your personal information if you access our UK website, uk.koala.com, and/or purchase our products via our UK website, if you are a supplier or business partner engaging with us, or if you are applying to come and work with us

What does our Privacy Policy cover?

Our Privacy Policy sets out the basis on which we use, store and process your personal information when you access our websites, purchase our products or contact us. It explains:

  • what personal information we collect about you;

  • how we collect, store and use your personal information; 

  • who we disclose your personal information to;

  • how you may access and correct your personal information;

  • your legal rights in relation to our processing of your personal information and how you can lodge a complaint regarding the handling of your personal information; and

  • how we will handle any complaint. 

Question or concerns? 

At Koala, we value your trust when sharing your personal information with us and recognise that you may have concerns about the information provided to us and about how we handle that information. We are committed to protecting your privacy in accordance with the Data Protection Act 2018 and UK General Data Protection Regulation (“UK GDPR”). You can find out more about the UK GDPR and your rights by visiting the Information Commissioner's Office (ICO), the UK regulator for data protection issues, at https://ico.org.uk/. 

If you have any questions, concerns or complaints about our handling of your personal information, or if you wish to exercise your privacy rights, please do not hesitate to contact our Privacy Compliance Officer at privacy@koala.com. 

You also have the right to make a complaint at any time to the ICO. We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please do contact us in the first instance so that we can help to address your concerns. 

We only use your personal information when the law allows us

The law requires us to have a legal basis for collecting and using your personal information. We rely on one or more of the following legal bases:

  • Performance of a contract with you: Where we need to carry out the contract we are about to enter into, or have entered into, with you, or where we need to otherwise provide you with a service, offer, promotion or product that you have ordered or requested. This may include where we need to take certain steps, at your request, before we enter into a contract.

  • Legitimate interests: Where it is necessary to conduct our business and pursue our legitimate interests, which is generally where we use your personal information in ways you would reasonably expect us to. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal information for our legitimate interests. We do not use your personal information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). 

  • Legal obligation: Where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis. For example, keeping recordings and providing information to tax authorities.

  • Consent: We rely on consent only where we have obtained your active agreement to use your personal information for a specified purpose, for example, if you subscribe to an email newsletter. Where we rely on your consent to process your personal information, we will make this clear to you at the time of collection, and you will have the right to withdraw your consent at any time. Withdrawing consent will not affect the lawfulness of processing based on consent before its withdrawal, or if we have another lawful basis to continue processing your personal information..

You are under no obligation to provide any personal information to us, however, if you restrict us from collecting any of this information, we may not be able to do things such as:

  • do business with you, supply our products to you or assist you with any enquiries, complaints, refunds, repairs or replacement products; or

  • allow you to participate in our promotions, competitions and rewards.

Our website and products are not intended for children

By using our website (uk.koala.com), you confirm that you are at least 18 years of age. 

Our website and products are not intended for children and we do not knowingly advertise to, or collect personal information from, any individual under the age of 18. 

We may change our Privacy Policy from time to time

We may change our Privacy Policy from time to time to reflect changes to privacy laws, changes in the way we do business, technology changes and customer feedback. We will let you know about these changes by ensuring the most recent version of our Privacy Policy is on our website (uk.koala.com). We encourage you to check our website from time to time to ensure that you are aware of our current Privacy Policy.  

What types of personal information do we collect?

Your ‘Personal information’ is any information or opinion that identifies you or from which you might reasonably be identified. The information can be in any form and does not have to be true, it just matters that you can be identified by it. For example, your name, age and email address or photos of you.

If you are a candidate applying to come and work with us, we may collect information about criminal convictions and offences as part of our background checks, including the outcome of any Disclosure and Barring Service (‘DBS’) checks. Additional protections apply to this data (so-called ‘special categories of personal data’) under the law.

Other than if you are a candidate, we do not collect 'special categories of personal data’ about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

The types of information we collect that may be personal information include:

  • contact details, such as name, role or position, mailing or street address, email address, mobile number or landline number;

  • information relating to your age, gender, occupation or date of birth;

  • information collected automatically when you interact with our website (including your device ID, device type, geo-location information, computer and connection information, statistics on page views, traffic to and from the sites, ad data, IP address and standard web log information);

  • any additional information relating to you that you provide to us directly through our website or indirectly through your use of our website or online presence or through other websites or accounts from which you permit us to collect information, which may include personal preference and activity information, feedback, replies and requests;

  • account login information (including any information that is required for you to establish a user account, which may include a user name, password and security questions and answers); 

  • if you are a supplier or business partner, or prospective supplier or business partner, information about your business skills, services, products and prices; orif you are a candidate applying to come and work with us, copies of right to work documentation, references, results of any background checks and other information included in a CV or cover letter or as part of the application process; or

  • any other personal information that may be required in order to facilitate your dealings with us. 

The above information is only personal information if it identifies you or is information from which you might reasonably be identified. It may be the combination of information that we collect that identifies you rather than a single piece of information on its own.

How do we collect your personal information?

We collect personal information about you when you visit our website, communicate with us through our live chat function, sell or offer to sell goods and services to us, purchase or offer to purchase products from us, participate in one of our promotions, apply to come and work with us, you contact us by email, telephone or letter or connect with us from other social media applications, services or websites.

Sometimes you may give us personal information about other people, such as a family member or friend, (such as for delivery purposes). If you provide us with the personal information of another person, we rely on you to provide them with a copy of (or link to) our Privacy Policy and ensure they are happy for you to provide us their personal information on that basis.  You must have the authority (such as their explicit consent) to disclose the personal information of another person to us and to authorise us to process such information in accordance with this Privacy Policy. You are responsible for ensuring they are aware that their information is being shared with us and for directing them to this Privacy Policy.

We may also collect personal information about individuals from other sources, including social media platforms, digital platforms and publishers, retailers that sell our products, commercially available sources (such as data aggregators), recruitment agencies and background check service providers supporting a recruitment process we are running and public sources and databases. This information may include name, demographic information, interests and publicly-observed data (such as from social media and shopping behaviour). We may combine or supplement personal information using data from different sources.

Cookies

Like many companies, we use ‘cookie’ technology on our website. Cookies are small files that store information on your computer, mobile phone or other device. The information they collect includes information about your equipment, browsing actions and patterns. Amongst other things, they enable us to recognise you across different websites, services, devices and/or browsing sessions. 

We may also use cookies to record certain information about your use of our website, such as which pages you visit, the time and date of your visit and the internet protocol address assigned to your computer. This helps us remember your preferences so that next time you visit our website we can make your experience more personal.

You can disable some cookies or be warned when cookies are being used by adjusting your internet browser settings. However, disabling cookies may mean that you are not able to access parts of our website or to take advantage of the improved user experience that cookies can help provide. For more information about the cookies we use, please see our Cookie Policy.

Payments

Our online store is hosted on a third party online e-commerce platform and when you make a payment you connect directly to a third party payment gateway. 

We do not collect, store or have any access to your credit card or other payment details. 

The gateway that we use collects those details directly from you and encrypts them in compliance with the Payment Card Industry Data Security Standard (PCI-DSS). The payment gateway provider’s terms and conditions and privacy policy govern the collection, use and disclosure of your payment information. Those should be provided to you when you access the gateway.  We use Shopify Payments as our primary payment processor(s). You can review their privacy policy at https://www.shopify.com/legal/terms-payments/gb. 

Why do we collect, use and disclose your personal information?

We collect, use and disclose your personal information so that we can:

  • answer your enquiries about our products or our business and help you submit orders for our products;

  • process your orders, accept payment, and communicate with you about delivery and other matters relating to your order;

  • process any claim you make for repair, replacement or refund of a product you have bought from us;

  • handle any contacts or complaints relating to our products or our website;

  • facilitate your participation in offers and promotions; 

  • send you our newsletter or information about new products, sales, competitions, promotions, rewards and events and other information that may be of interest to you, including information sent by or on behalf of our business partners (see section on marketing below); 

  • receive your feedback and invite you to participate in market research to improve our products and customer experience;

  • where you are a supplier or prospective supplier of goods and services, understand what you offer and evaluate whether we want to purchase from you, to purchase from you and to interact with in connection with any purchases we make; and

  • run a recruitment process for to fill job vacancies that we have, including to make a decision about whom to recruit and to comply with our legal obligations in connection with such recruitment, for example, right to work checks.

We also collect your personal information to run our website, analyse and improve our products and services, and customer experience, support advertising activity and to assist us in securing our website and minimising fraudulent transactions. Where possible, we do this by collecting anonymous data, but sometimes the data we collect, on its own or when combined with other data (such as an IP address) may identify you.

Our processing of your personal information will be limited to what is necessary in relation to the purposes described in our Privacy Policy. 

Links to third party websites and tools

Our website may contain links to websites and tools supplied, hosted and/or operated by other people or organisations (we refer to these as “third party websites and tools”). We provide access to third party links and tools because they may be useful to you, but we do not accept liability for any loss or damage you suffer as a result of using any of these websites or tools. 

We do not control and are not responsible for the privacy practices of the people and organisations who provide third party websites and tools. The privacy policies that apply to third party websites and tools may differ substantially from our Privacy Policy, so we encourage you to read them before using those websites or tools.

Does Koala use your personal information to send you marketing? 

Yes, we do. But, we will only send you direct marketing communications (e.g., newsletters, special offers) by email or SMS if you have explicitly consented to receive them, or if you are an existing customer, for similar products or services, and you have been given a clear opportunity to opt-out at the time of data collection and in every subsequent communication. You can opt-out of receiving marketing communications from us at any time by using the unsubscribe link provided in our emails/messages, or by contacting us directly.

Please rest assured that we will get your express opt-in consent before we share your personal information with any third party for their own direct marketing purposes. 

Where you opt out of receiving these direct marketing messages, you will still receive service-related communications that are essential for administrative or customer service purposes, for example, relating to products and services that you have purchased,  updates to our terms and conditions, checking that your contact details are correct.

Who might we disclose your personal information to?

We may disclose your personal information for the purposes described in the Why do we collect, use and disclose your personal information? section above to the following people and organisations:

  • our staff (including staff of our group companies); 

  • our third party suppliers and service providers (including logistics, transport, IT services, website, communication, payment system providers, market research providers and business partners); 

  • our sponsors and promoters of any competition that we conduct via our services;

  • third party marketing collaborators so that they can provide you with information about products, services and offers that may be of interest to you (please see the section on marketing above);

  • our professional advisers and agents;

  • anyone to whom our assets or businesses (or any part of them) are transferred;

  • specific third parties authorised by you to receive information held by us; and/or

  • government agencies, regulatory bodies and law enforcement agencies, or as otherwise required, authorised or permitted by law.

We do not share your information with third parties unless we are satisfied that such parties  properly look after it by holding, handling and using it in accordance with the UK GDPR. Any sharing of your personal information for marketing purposes shall be subject to the section on marketing above. 

Do you transfer my personal information outside of the UK?

We may disclose and store your personal information outside of the United Kingdom in connection with the purposes for which we collect it, including to third party service providers, such as cloud hosting providers, backup and storage providers, market research and e-commerce providers and other providers acting on our behalf who work with us so we can provide you with a top class experience. 

Where we transfer your personal information outside the UK, we ensure a similar degree of protection is provided, by making sure that at least one of the following safeguards are in place to protect your personal information:

  • We will only transfer your personal information to countries that have been deemed to provide an adequate level of protection for personal information; or 

  • Where the country to which your personal information is deemed not to provide an adequate level of protection, then  we will use specific contracts approved for use in the UK which give personal information the same protection it has in the UK. 

Please contact us if you want further information on the specific mechanism used by us when transferring your personal information out of the UK.

How long do we retain your personal information? 

We will only retain your personal information for as long as is necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. 

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. For example, personal information related to customer orders (including contact and transaction details) may be kept for up to 6 years after the transaction for tax and legal purposes. Personal information collected for marketing purposes will be retained as long as you wish to receive marketing from us, and for a short period thereafter to allow us to process your opt-out. 

In certain cases, we may have legal or regulatory obligations that require us to retain specific records for a set period of time.

How we ensure the security of your personal information

We use a variety of physical, technical and administrative security standards, technologies and procedures to help protect your personal information (whether in physical or electronic form) from loss, misuse, alteration, destruction or damage to an appropriate level depending on the sensitivity of the information. 

We take steps to limit access to your personal information to those persons who need to have access to it for one of the purposes listed in our Privacy Policy. We also use reasonable efforts to ensure that any third party processing your personal information also provides for confidentiality and integrity of your information in a secure way.

Under certain circumstances, you have the following rights under data protection laws in relation to your personal information:

Right to request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. Sometimes, we may not be able to provide you with access to all of your personal information and, where this is the case, we will tell you why. 

Right to request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Right to request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with the law. Please note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Right to object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Right to request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios:

  • If you want us to establish the information's accuracy.

  • Where our use of the information is unlawful, but you do not want us to erase it.

  • Where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims.

  • You have objected to our use of your information, but we need to verify whether we have overriding legitimate grounds to use it.

Right to request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Please note that this right only applies to personal information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Right to withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Contact us

For further information about our Privacy Policy or privacy practices, or to access or correct your personal information or exercise your other privacy rights, or make a complaint, please contact our Privacy Compliance Officer at privacy@koala.com or by mail to:

Privacy Compliance Officer
Koala UK Operations Ltd
C/o CSC CLS (UK) Ltd, 5 Churchill Place, 10th Floor
London, UK E14 5HU