Privacy Policy

Last updated: 6 June 2026

Last updated: 2 June 2026

This Privacy Policy explains how ICICOSMETIC LTD ("we", "us", "our"), trading as M6 Drone, collects, uses, and protects your personal data when you visit m6drone.com (the "Site") or place an order with us. It applies to customers and visitors in the United Kingdom, France, and Germany. We are committed to protecting your privacy and handling your data in line with the UK GDPR, the EU General Data Protection Regulation (GDPR), and the UK Data Protection Act 2018.

Data Controller

The data controller responsible for your personal data is ICICOSMETIC LTD, a company registered in England and Wales (Companies House No. 12145692), registered address: Office 6623, 58 Peregrine Road, Hainault, Ilford, Essex, IG6 3SZ, United Kingdom. For any privacy question, contact us at support@m6drone.com.

What personal data we collect

  • Identity & contact data: name, email address, telephone number, billing and shipping address.
  • Order data: products ordered, order history, and payment information. Payments are handled by our payment providers; we do not store your full card details.
  • Account data (if you create an account): a hashed password and your saved preferences.
  • Communications: emails you send us and your customer-support history.
  • Technical data: IP address, browser type, device information, pages visited, and referring URL.
  • Marketing preferences: your consent to receive our newsletter.

How we collect your data

We collect data directly from you (when you fill in forms, place an order, or contact us), automatically (through cookies and analytics as you use the Site), and from third parties (such as payment processors confirming a transaction).

Legal basis for processing

Under Article 6 of the GDPR, we rely on the following legal bases:

  • Performance of a contract — to process and deliver your order.
  • Legitimate interests — fraud prevention, security, and improving our service.
  • Consent — marketing emails and non-essential cookies.
  • Legal obligation — keeping tax records and meeting anti-money-laundering duties.

How we use your data

We use your personal data to:

  • process, fulfil, and deliver your orders;
  • provide customer support and respond to your enquiries;
  • send you transactional messages such as order confirmations and shipping updates;
  • send marketing communications where you have given consent (you can opt out at any time);
  • detect, prevent, and investigate fraud and misuse;
  • comply with our legal and regulatory obligations.

Who we share your data with

We share your data only with parties that help us run our business, and only as needed:

  • Payment processors (e.g. Stripe, Shopify Payments) — to process payments securely.
  • Shipping carriers (e.g. Royal Mail, DPD, DHL, La Poste, GLS) — to deliver your order.
  • Email service providers — to send transactional emails.
  • Analytics providers (e.g. Google Analytics, where used, with IP anonymisation).
  • Shopify — our e-commerce platform host.
  • Legal authorities — where required by law.

We do not sell your personal data.

International data transfers

Some of our processors (such as Stripe, Google, and Shopify) are based in or transfer data to the United States. Where data leaves the UK or the European Economic Area, the transfer is protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) or an applicable adequacy decision.

How long we keep your data

  • Order records: 7 years, to meet UK tax law.
  • Marketing data: until you withdraw your consent.
  • Account data: until you delete your account.
  • Customer-support records: 3 years.

Your rights

Under the GDPR you have the right to:

  • access a copy of your personal data;
  • have inaccurate data corrected (rectification);
  • have your data erased (the "right to be forgotten");
  • restrict how we process your data;
  • data portability;
  • object to processing, including direct marketing;
  • withdraw consent at any time;
  • not be subject to solely automated decision-making.

How to exercise your rights

Email us at support@m6drone.com. We respond to all requests within 30 days.

Right to complain

If you have a concern, please contact us first. You also have the right to complain to your data-protection authority:

  • United Kingdom: Information Commissioner's Office (ICO) — ico.org.uk
  • France: CNIL — cnil.fr
  • Germany: the Federal Commissioner (BfDI) or your state authority — bfdi.bund.de

Cookies

We use cookies and similar technologies. For details, please see our Cookie Policy.

Children's data

Our Site is not directed at children, and we do not knowingly collect personal data from anyone under 16.

Security

We protect your data using SSL/TLS encryption, and our payment providers are PCI-DSS compliant. We follow recognised industry standards to keep your information safe, although no method of transmission over the internet is completely secure.

Changes to this policy

We may update this Privacy Policy from time to time. Any changes take effect when published here, so please check the "Last updated" date at the top.

Contact us

For any question about this policy or your personal data, email support@m6drone.com.

United States — Your State Privacy Rights (CCPA/CPRA & other states)

If you are a resident of California or another U.S. state with a comprehensive privacy law, you have additional rights regarding your personal information.

California residents have the right to know, access, correct, and delete personal information; the right to opt out of the “sale” or “sharing” of personal information; the right to limit the use of sensitive personal information; and the right to non-discrimination for exercising these rights. We do not sell your personal information for money.

To submit a request, email support@m6drone.com or use our Do Not Sell or Share My Personal Information page. You may use an authorized agent. We respond within 45 days as required by the CCPA.

Residents of Colorado, Connecticut, Utah, Virginia, Texas, Oregon, Montana, Florida, Tennessee, Iowa, Indiana, Kentucky, New Hampshire, New Jersey, Delaware, Nebraska, Minnesota, Maryland, and Rhode Island have additional rights under their respective state privacy laws, including the rights to access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising and the sale of personal data. To exercise any of these rights, contact support@m6drone.com.

Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of sale/sharing request for the browser on which it is enabled.

Children’s privacy (COPPA)

We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, contact support@m6drone.com and we will delete it.

How we use cookies and tracking technologies

We use cookies, pixels, and similar technologies to measure website performance and traffic, improve our website and your experience, show you relevant advertising on other websites, measure the effectiveness of our advertising, and send personalised marketing emails (if you subscribe).

You have full control over which cookies you accept. You can change your preferences at any time via the “Manage Preferences” link in our cookie banner or in the footer.

EU & UK customers: we only set marketing and analytics cookies after you give explicit consent. Strictly necessary cookies (cart, checkout, security) are always active.

US customers: we honor the Global Privacy Control (GPC) signal as a valid opt-out, and you can opt out via the “Do Not Sell or Share My Personal Information” link in our footer.

Third-party tracking tools we use

1. Google Analytics 4 (GA4)

  • Provider: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
  • Purpose: website analytics — measuring how visitors use our site.
  • Data: anonymised IP, browsing behaviour, device, browser, referrer, session duration, pages viewed, conversion events.
  • Legal basis (UK/EU): your consent (Art. 6(1)(a) UK GDPR).
  • Cookies: _ga (13 months), _ga_* (13 months), _gid (24 hours).
  • Transfers: USA under the EU-US Data Privacy Framework.
  • Privacy policy: policies.google.com/privacy.
  • Opt-out: the Google Analytics Opt-out Add-on (tools.google.com/dlpage/gaoptout) or “Reject All” in our banner.

2. Google Ads (Conversion Tracking + Remarketing)

  • Provider: Google Ireland Limited (Dublin) for EU/UK; Google LLC (USA) for US.
  • Purpose: measure ad effectiveness and serve remarketing ads on other websites.
  • Data: click identifiers, conversion events, audience segments, device IDs, IP address.
  • Legal basis (UK/EU): your consent (Art. 6(1)(a) UK GDPR).
  • Cookies: _gcl_au (90 days), _gcl_aw (90 days), IDE (13 months), DSID (13 months).
  • Transfers: USA under the EU-US Data Privacy Framework.
  • Privacy policy: business.safety.google.
  • Opt-out: adssettings.google.com or “Reject All” in our banner.

3. Meta Pixel (Facebook + Instagram)

  • Provider: Meta Platforms Ireland Ltd (Dublin) for EU/UK; Meta Platforms Inc. (Menlo Park, CA, USA) for US.
  • Purpose: measure ad effectiveness on Facebook/Instagram, build custom audiences, serve remarketing.
  • Data: page views, purchase and add-to-cart events, IP address, device IDs, hashed email (if submitted), browser type.
  • Legal basis (UK/EU): your consent (Art. 6(1)(a) UK GDPR).
  • Cookies: _fbp (90 days), _fbc (90 days).
  • Transfers: USA under Standard Contractual Clauses.
  • Privacy policy: facebook.com/privacy/policy.
  • Opt-out: facebook.com/adpreferences or “Reject All” in our banner.

4. TikTok Pixel

  • Provider: TikTok UK Ltd (London); TikTok Technology Ltd (Dublin); TikTok Inc. (USA). Parent: ByteDance Ltd.
  • Purpose: measure TikTok ad performance, build audiences, serve remarketing.
  • Data: page views, purchase/add-to-cart events, IP, device IDs, on-site behaviour.
  • Legal basis (UK/EU): your consent (Art. 6(1)(a) UK GDPR).
  • Cookies: _ttp (13 months), ttwid (1 year), _tt_enable_cookie (session).
  • Transfers: USA, Singapore, Ireland, UK under SCCs. ByteDance is a Chinese parent and TikTok faces ongoing EU/UK scrutiny on transfers.
  • Privacy policy: tiktok.com privacy.
  • Opt-out: TikTok app ad settings or “Reject All”.

5. Klaviyo (email marketing)

  • Provider: Klaviyo Inc., 125 Summer Street, Boston, MA 02110, USA.
  • Purpose: send marketing emails (if you subscribe), track opens/clicks, run automations (welcome, abandoned cart).
  • Data: email (if provided), purchase history, on-site behaviour, email engagement.
  • Legal basis (UK/EU): your consent at signup (Art. 6(1)(a) UK GDPR).
  • Cookies: __kla_id (2 years). Transfers: USA under the EU-US DPF + SCCs.
  • Privacy policy: klaviyo.com privacy. Opt-out: unsubscribe link in any email or email us.

6. Shopify (platform & native analytics)

  • Provider: Shopify International Ltd, 1-2 Haddington Road, Dublin 4, Ireland.
  • Purpose: power the store — process orders, manage the cart, provide built-in analytics.
  • Data: cart and order data, payment data (via Shopify Payments/Stripe), session info.
  • Legal basis: contract performance (Art. 6(1)(b) UK GDPR) — necessary to provide the service.
  • Cookies: _shopify_y (1 year), _shopify_s (session), cart (2 weeks).
  • Privacy policy: shopify.com/legal/privacy.

Sharing for advertising, “sale/share”, and Global Privacy Control

Under the California Consumer Privacy Act (CCPA/CPRA), “sale” and “sharing” are defined broadly and include sharing personal information with advertising partners for cross-context behavioural advertising. We share data for advertising purposes with Google LLC, Meta Platforms Inc., and TikTok Inc.

You can opt out at any time via the “Do Not Sell or Share My Personal Information” link in our footer, or by enabling the Global Privacy Control (GPC) signal in your browser. We honor GPC as a valid opt-out under the CCPA, the Colorado Privacy Act, the Connecticut Data Privacy Act, and other state laws that recognise universal opt-out mechanisms.