privacy policy

here's the plain-language summary. the rest of this page is the detail, but this is the gist:

• we collect what we need to take your order, deliver it, run your account, and keep the shop working. nothing more for the sake of it.
• we don't sell your personal data. we never have.
• payment card details go straight to our payment processor. we never see or store your full card number.
• you can see, correct, download, or delete your data, and switch off marketing, any time. email [email protected] and we'll sort it.

mr. dupe runs mrdupe.com, an online perfumery selling inspired-by fragrances and decants, shipping across the european union. when you shop with us, mr. dupe is the controller of your personal data, which means we decide what is collected and why.

mr. dupe is the trading name of the company that operates mrdupe.com. for our full registered company details, or for anything in this policy, write to [email protected].

we collect four kinds of information.

• account details. your name, email address, and either a password or the sign-in identity from google, facebook, or a passkey, if you choose one of those.
• order and delivery details. your shipping address, phone number for the courier, what you bought, and your order history.
• payment details. handled by our payment processor. we receive a confirmation that a payment succeeded and the last few digits of the card, never the full number.
• things you tell us and things we notice. reviews, support messages, scent-finder answers, and what your device and browser report as you use the site, such as pages viewed and rough location from your ip address.

we use your information to:

• take payment for your order, pack it, and ship it to you;
• run your account and your mr. dupe club membership;
• send the messages that come with shopping, like order confirmations, dispatch notices, and replies from support;
• keep the shop secure and catch fraud;
• understand what works and make the shop better, using aggregated analytics;
• send you marketing about new fragrances, but only if you've asked for it;
• meet our legal duties, such as keeping tax and accounting records.

under the gdpr we need a lawful reason to use your data. ours are:

• performing our contract with you, to process and deliver the orders you place;
• your consent, for marketing emails and for non-essential cookies, which you can withdraw whenever you like;
• our legitimate interests, to keep the shop secure, prevent fraud, and improve what we offer, balanced against your rights;
• our legal obligations, such as tax, accounting, and consumer-law record-keeping.

we share data only with the partners that help us run the shop, and only with what they need:

• our payment processor, to take payment securely;
• delivery carriers, to get your order to your door;
• our email provider, to send order and account messages;
• hosting and infrastructure providers, who run the servers and databases behind the shop;
• analytics and advertising partners, where you've allowed the matching cookies, as set out below.

we may also share data if the law requires it, or if mr. dupe is ever sold or reorganised. we don't sell your personal data, and we don't let our partners use it for their own purposes.

cookies are small files your browser stores. we use a few kinds:

• essential cookies keep you signed in and hold your bag together. the site can't work without them, so they don't need consent.
• analytics cookies tell us, in aggregate, which pages and products people use, so we can improve them.
• marketing cookies let us measure and tailor ads on platforms like google, meta, and tiktok.

analytics and marketing cookies run only with your consent. you can change your choice at any time, and your browser settings let you block or clear cookies whenever you want.

mr. dupe is based in the european union and most of your data stays here. some of our partners process data in other countries. when that happens, we rely on the safeguards the gdpr allows, such as the european commission's standard contractual clauses or an adequacy decision, so your data keeps the same protection wherever it travels.

we don't keep data longer than we need it.

• order records are kept for as long as tax and accounting law requires, which is several years after the purchase.
• account data is kept while your account is open. if you close it, we delete or anonymise your data after a short grace period, apart from anything we're legally required to keep.
• marketing data is kept until you opt out, and then we stop.

the gdpr gives you real control. you can ask us to:

• show you the personal data we hold about you;
• correct anything that's wrong;
• delete your data, where there's no legal reason to keep it;
• send you a copy in a portable format, or pass it to someone else;
• pause or limit how we use it, or object to a particular use;
• withdraw any consent you've given.

email [email protected] and we'll handle it, free of charge, within the time the law allows. if you think we've got something wrong, you can also complain to the data protection authority in the eu country where you live.

we encrypt data in transit, limit who on the team can reach it, and work only with processors that hold themselves to a high security standard. no system online is perfectly secure, but we treat your data as carefully as we'd want ours treated, and if a breach ever affects you, we'll tell you and the relevant authority as the law requires.

mr. dupe is a shop for adults. it isn't aimed at children, and we don't knowingly collect data from anyone under 18. if you believe a child has given us their data, email [email protected] and we'll remove it.

if we update this policy, we'll change the date at the top of the page, and for anything significant we'll give you a clear heads-up before it takes effect.

questions about your privacy, or want to exercise a right? write to [email protected], or reach the team at [email protected]. we'd genuinely rather you ask than wonder.