Privacy & Cookie Policy

Last updated: 10 August 2026

At Boha Living, we respect your privacy and are committed to protecting your personal information.

This Privacy & Cookie Policy explains how we collect, use, store and share personal information when you visit our website, purchase from us, contact us or otherwise interact with Boha Living. It also explains how we use cookies and similar technologies and the rights available to you under data protection law.

1. Who we are

Boha Living is a trading name of AP Imports Limited.

AP Imports Limited
Company number: 09750466
Registered in England and Wales

Registered office:

145a Pera Business Park
Nottingham Road
Melton Mowbray
Leicestershire
LE13 0PB
United Kingdom

AP Imports Limited is the data controller responsible for the personal information described in this policy.

References to “Boha Living”, “Boha”, “we”, “us” or “our” mean AP Imports Limited trading as Boha Living.

Our website is www.bohaliving.co.uk.

You can contact us about privacy or data protection using the Contact Us page on our website, by telephone on 0330 133 8385, or by writing to us at the registered office address above.

2. Information covered by this policy

This policy applies to personal information we collect when you:

visit or browse our website;
create or use a customer account;
place or attempt to place an order;
make a payment;
contact us about a product or service;
contact us about an existing order;
request a return, refund, replacement or warranty service;
subscribe to marketing communications;
interact with our advertisements;
submit a review or other content;
communicate with us through social media; or
otherwise interact with Boha Living.

Personal information means information relating to an identified or identifiable individual.

3. Personal information we collect

The information we collect depends on how you interact with us.

Identity and contact information

This may include:

your name;
billing address;
delivery address;
email address;
telephone number; and
customer account information.

Order and transaction information

This may include:

products ordered;
products viewed or placed in your basket;
order number;
order value;
payment status;
delivery information;
discounts;
returns;
refunds;
replacements;
warranty information; and
previous transaction history.

Payment information

Payments through our website are processed using specialist payment providers.

Our principal payment processing service is Shopify Payments. We also offer PayPal as an additional payment option.

Depending on the options available at checkout, payment methods may include:

Shop Pay;
Visa;
Mastercard;
American Express;
Apple Pay;
Google Pay;
Klarna; and
PayPal.

The payment methods available may change from time to time.

Payment providers may collect information including payment card details, billing information, transaction details, authentication information and information required to prevent fraud.

Boha Living does not normally receive or store your complete payment card number. Payment information is processed securely by the relevant payment provider.

Customer account information

If you create or use a customer account, we may process information including:

your name;
contact information;
saved addresses;
order history;
account preferences; and
account login or authentication information.

Communications and enquiry information

We may keep records of communications you send to us, including:

emails;
contact form submissions;
telephone enquiries;
customer service communications;
product enquiries;
complaints;
delivery enquiries;
return and refund requests; and
warranty or after-sales enquiries.

Technical and website usage information

When you use our website, we and our technology providers may receive information including:

IP address;
device type;
browser type and version;
operating system;
approximate geographical location;
referring website or advertisement;
pages viewed;
products viewed;
links clicked;
shopping basket activity;
checkout activity;
dates and times of visits;
session information; and
information about how you interact with our website.

Some of this information is collected through cookies, pixels, tags and similar technologies.

Marketing and advertising information

We may process information about:

whether you have agreed to receive marketing;
your marketing preferences;
when and how consent was provided;
whether you interact with marketing communications;
whether you have unsubscribed;
advertising interactions;
advertising attribution; and
whether a visit or purchase may have resulted from an advertisement.

Review information

If you submit a review, rating, photograph, video, question or other content, we may process the information you provide.

We may also process order information to verify that a review relates to a genuine purchase.

4. Where we obtain personal information

Most of the information we process is provided directly by you.

For example, you provide information when you:

place an order;
create an account;
make a payment;
contact us;
request customer support;
submit a review; or
subscribe to marketing.

We may also collect information automatically when you use our website through cookies, pixels and similar technologies.

We may receive personal information from third parties where necessary, including:

Shopify;
payment providers;
delivery companies;
product suppliers and fulfilment partners;
Judge.me;
advertising platforms;
analytics providers;
fraud prevention services; and
social media platforms.

If somebody places an order to be delivered to you, we may receive your name, address and contact information from that person so that we can complete the delivery.

5. How and why we use your information

We must have a lawful basis for using personal information.

Depending on the circumstances, we generally rely on one or more of the following:

Contract – where processing is necessary to enter into or perform a contract with you.

Legal obligation – where processing is necessary to comply with the law.

Legitimate interests – where processing is reasonably necessary for our legitimate business interests or those of another person and those interests are not overridden by your rights.

Consent – where you have been given a genuine choice and have agreed to the processing.

Orders and fulfilment

We use personal information to:

process orders;
take or arrange payment;
confirm purchases;
arrange delivery;
provide order updates;
process cancellations;
process returns;
issue refunds;
provide replacements; and
administer warranties and after-sales support.

Lawful basis: Contract.

Customer service and enquiries

We use information to:

respond to questions;
provide product information;
assist with purchasing decisions;
respond to customer service enquiries;
deal with complaints; and
provide after-sales support.

Lawful basis: Contract, taking steps before entering into a contract and/or our legitimate interests in providing effective customer service.

Customer accounts

We may process information to create, maintain and secure customer accounts.

Lawful basis: Contract and legitimate interests in administering our website and customer relationships.

Payment processing

We use or disclose information where necessary to:

process payments;
authenticate transactions;
process refunds;
deal with chargebacks;
detect suspicious activity; and
prevent payment fraud.

Lawful basis: Contract and legitimate interests in protecting our business and customers against fraud.

Delivery and fulfilment

We may provide necessary personal information to couriers, logistics providers, suppliers, manufacturers or fulfilment partners where required to deliver or service your order.

This may include your:

name;
delivery address;
telephone number;
email address; and
relevant order information.

Lawful basis: Contract.

Accounting, tax and legal records

We keep appropriate transaction and business records for accounting, tax, regulatory and legal purposes.

Lawful basis: Legal obligation and legitimate interests in maintaining appropriate business records.

Website operation and security

We may process technical information to:

operate our website;
maintain website security;
prevent misuse;
protect customer accounts;
identify technical problems;
maintain backups;
prevent fraud; and
improve website performance.

Lawful basis: Legitimate interests and, where applicable, legal obligation.

Analytics and performance measurement

We may use analytics and attribution services to understand:

how visitors find our website;
which pages and products are viewed;
how people navigate the website;
website performance;
shopping and checkout behaviour;
marketing performance; and
which advertising channels contribute to sales.

Where consent is required for the technology involved, it will be used in accordance with your privacy and cookie choices.

Lawful basis: Consent where required and/or legitimate interests where applicable law permits the particular processing without consent.

Advertising and remarketing

Where legally permitted and subject to your privacy choices, we may use advertising technologies to:

measure advertising performance;
measure conversions;
understand whether an advertisement contributed to a purchase;
create advertising audiences;
personalise advertising;
remarket our products to previous visitors; and
improve advertising effectiveness.

Lawful basis: Consent where required.

Reviews and customer feedback

We may use information to:

request customer reviews;
verify reviews;
publish reviews;
respond to reviews;
administer ratings; and
obtain feedback about our products and service.

Lawful basis: Legitimate interests in obtaining customer feedback and maintaining accurate customer reviews, together with consent or other legal requirements where applicable to electronic communications.

Legal claims and protection of our business

We may process information where reasonably necessary to:

establish, exercise or defend legal claims;
enforce our terms;
recover money owed;
obtain professional advice;
deal with insurance matters; and
protect our customers, staff and business.

Lawful basis: Legitimate interests and/or legal obligation.

6. Marketing communications

We may send marketing communications about Boha Living products, offers, promotions and news where:

you have specifically agreed to receive them; or
applicable electronic marketing rules allow us to contact existing customers about similar products or services.

Where we rely on the existing-customer or soft opt-in provisions, you will have been given an opportunity to opt out when your details were collected and will continue to be given an easy way to opt out.

You can stop receiving marketing communications at any time using the unsubscribe option contained in the communication or by contacting us.

Stopping marketing communications does not stop us contacting you where necessary about:

an order;
payment;
delivery;
return;
refund;
replacement;
warranty;
customer service matter; or
other non-marketing communication.

If you unsubscribe, we may retain limited information on a suppression list so that we can continue to respect your request.

We do not sell your email address or telephone number to unrelated third parties for their own direct marketing.

7. Cookies and similar technologies

Our website uses cookies and similar technologies.

These may include:

cookies;
pixels;
tags;
scripts;
local storage;
browser identifiers; and
server-side conversion measurement.

Strictly necessary technologies

Some technologies are required for our website and online store to function correctly.

These may be used for:

shopping basket functionality;
checkout;
customer login;
payment processing;
authentication;
security;
fraud prevention;
network management;
session management; and
remembering your privacy choices.

Where these technologies fall within a legal exemption, they may operate without consent.

Functional technologies

Functional technologies may remember preferences or provide additional website features.

Where consent is legally required, these technologies will be used in accordance with your choices.

Analytics technologies

We may use analytics services to understand website traffic, customer journeys and website performance.

These may include services provided through Shopify, Google and TrueROAS.

Where consent is legally required, analytics technologies will be used in accordance with your privacy choices.

Advertising technologies

We use advertising and conversion-measurement services which may include:

Meta/Facebook and Instagram;
Google and YouTube;
Pinterest;
Shopify advertising and Network Intelligence services; and
TrueROAS.

These technologies may collect information about visits, product views, basket activity, checkout activity and purchases for purposes including:

advertising measurement;
conversion attribution;
campaign optimisation;
audience creation;
remarketing; and
advertising personalisation.

Some advertising measurement may be carried out through both browser-based technologies and server-to-server connections.

Where consent is required, these technologies will be used in accordance with your privacy choices.

Managing your cookie preferences

When you visit our website, you may be shown a privacy or cookie banner allowing you to control non-essential technologies.

You can change your choices later using the Cookie Preferences or privacy controls available on our website.

You can also control cookies using your browser settings, although blocking all cookies may affect the operation of functions such as shopping baskets, customer accounts and checkout.

Withdrawing consent does not affect processing that was lawful before consent was withdrawn.

8. Analytics, advertising and customer-event providers

The following services are currently integrated with our online store.

Meta – Facebook and Instagram

We use Meta technologies for advertising, conversion measurement and campaign optimisation.

These may include the Meta Pixel and Conversions API, which can allow relevant website events to be communicated through browser and server-side connections.

Information may be used to:

measure advertising conversions;
attribute purchases to advertisements;
optimise advertising campaigns;
create audiences; and
provide relevant advertising.

Where required, this processing is subject to your privacy choices.

Google and YouTube

We use Google and YouTube services for advertising, conversion measurement and, where enabled, analytics.

These services may process information about website interactions and purchases to measure advertising performance and improve campaign effectiveness.

Where enabled, enhanced conversion measurement may use securely transformed customer information to improve conversion matching.

Where required, this processing is subject to your privacy choices.

We use Pinterest technologies for advertising and conversion measurement.

Pinterest may receive website or conversion events through browser-based and server-side technologies for:

campaign reporting;
advertising attribution;
campaign optimisation; and
audience creation.

Where required, this processing is subject to your privacy choices.

TrueROAS

We use TrueROAS as a marketing attribution and analytics service.

TrueROAS may process information relating to website visits, orders and advertising sources to help us understand which marketing and advertising channels contribute to purchases.

Where required, this processing is subject to your privacy choices.

9. Reviews – Judge.me

We use Judge.me to provide product and store review functionality.

Where necessary, Judge.me may receive information including:

customer name;
email address;
order details;
products purchased; and
information submitted as part of a review.

This enables us to:

request reviews;
confirm whether a reviewer purchased a product;
display verified purchase information;
publish customer reviews;
display ratings; and
administer customer feedback.

Reviews that you choose to submit may be displayed publicly on our website and, depending on the features in use, through other review or shopping services.

Please avoid including unnecessary personal information in the text, photographs or videos you submit for publication.

10. Shopify

Our online store is powered by Shopify.

Shopify provides technology and services including:

website and ecommerce infrastructure;
shopping basket functionality;
checkout;
customer accounts;
payment processing;
order management;
website security;
analytics; and
privacy tools.

Shopify may process personal information on our behalf in providing these services.

In some circumstances described below, Shopify may also process certain information for its own purposes.

11. Shopify Network Intelligence

We currently use Shopify Network Intelligence.

This allows Shopify to use certain information relating to interactions with our store together with information from Shopify and other participating merchants to provide enhanced Shopify services.

These services may include:

analytics;
ecommerce insights;
product and service improvements;
personalisation;
advertising measurement; and
advertising services.

For some of these activities, Shopify may process personal information as an independent data controller rather than solely as a processor acting on behalf of Boha Living.

Where consent is legally required, relevant activities are subject to your choices through the privacy and cookie controls available on our website.

You can change or withdraw relevant consent using the privacy controls available on our website.

You can find further information about Shopify's processing in the Shopify Consumer Privacy Policy.

Shopify also provides a Shopify Privacy Portal, through which individuals can exercise certain choices and rights relating to information processed by Shopify for Shopify's own purposes.

12. Who we share personal information with

We only disclose personal information where reasonably necessary for the purposes described in this policy or where required by law.

Shopify

Information is processed through Shopify as our ecommerce platform and, where applicable, through Shopify Payments and Shopify Network Intelligence.

Payment providers

Depending on your chosen payment method, information may be processed by organisations including:

Shopify Payments;
PayPal;
Klarna;
card networks;
digital wallet providers;
banks;
payment acquirers; and
organisations involved in payment authentication and fraud prevention.

Payment providers may act as processors, independent controllers or both depending on the services they provide.

Delivery providers

We provide delivery information to couriers, carriers and logistics businesses where necessary to deliver an order.

Suppliers and fulfilment partners

Some products may be dispatched, installed, serviced or otherwise fulfilled by approved suppliers, manufacturers or fulfilment partners.

Where necessary, we may provide relevant:

contact information;
delivery information;
order information; and
customer service information.

Judge.me

We may provide relevant customer and order information to Judge.me for customer review and feedback services.

Analytics and advertising providers

Subject to applicable privacy choices, information may be processed by providers including:

Meta;
Google;
Pinterest;
TrueROAS; and
Shopify.

IT and website service providers

We may use service providers for:

website support;
hosting;
cloud services;
customer service;
email;
data storage;
security;
backups;
fraud prevention; and
technical support.

Professional advisers

Information may be disclosed where reasonably necessary to:

accountants;
solicitors;
insurers;
auditors;
tax advisers; and
other professional advisers.

Public authorities

We may disclose information where required or permitted by law, including to:

HM Revenue & Customs;
courts;
law enforcement bodies;
regulatory authorities; and
the Information Commissioner's Office.

Business transfers

If all or part of our business is sold, transferred, merged or reorganised, relevant personal information may be disclosed to potential purchasers, advisers and new owners where reasonably necessary and lawful.

13. International transfers

Our Shopify data storage hosting location is currently configured as the European Union.

However, Shopify and some other organisations that provide services to us operate internationally.

Personal information may therefore sometimes be processed, accessed or transferred outside the United Kingdom or European Economic Area.

Where UK data protection rules on restricted international transfers apply, appropriate legal mechanisms and safeguards are used.

These may include:

UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to approved European Commission Standard Contractual Clauses;
another legally recognised safeguard; or
an applicable legal exception.

Where appropriate, relevant assessments are carried out in relation to international transfers.

14. How long we keep personal information

We do not retain personal information for longer than reasonably necessary.

The appropriate period depends on:

the reason the information was collected;
the nature of the information;
our relationship with you;
accounting and tax obligations;
contractual obligations;
warranty periods;
fraud prevention requirements;
legal claims; and
regulatory requirements.

Orders and transaction records

Order, invoice, payment and accounting information will normally be retained for at least six years where necessary for accounting, tax, contractual or legal purposes.

Customer accounts

Customer account information may be retained while the account remains active and afterwards where necessary for order history, accounting, customer service, security or legal purposes.

Customer service and enquiries

General enquiries that do not lead to a purchase will normally be retained only for as long as reasonably necessary to deal with the enquiry and related follow-up.

Communications connected with an order, warranty, dispute or potential legal claim may be retained for longer.

Marketing

Marketing information may be kept while you remain subscribed.

If you unsubscribe, limited information may be retained on a suppression list so that we can continue to respect your preference.

Reviews

Review information may be retained while the review remains published or where reasonably required to maintain an accurate review record.

Analytics and advertising

Retention periods vary depending on the provider, technology, account configuration and applicable privacy choices.

Fraud and security

Information relating to suspected fraud, attempted fraud or security incidents may be kept where necessary to protect us and our customers or establish or defend legal claims.

When personal information is no longer required, it will be deleted, anonymised or securely disposed of where reasonably practicable.

15. Security

We take reasonable technical and organisational measures designed to protect personal information against:

unauthorised access;
accidental loss;
misuse;
disclosure;
alteration; and
destruction.

We use reputable ecommerce, payment and technology providers and appropriate access and security controls.

No online service or electronic storage system can, however, be guaranteed to be completely secure.

You are responsible for keeping customer account passwords and authentication information confidential.

If you believe your account or personal information may have been compromised, please contact us as soon as possible.

16. Your data protection rights

Depending on the circumstances, you may have the following rights in relation to your personal information.

Right of access

You can ask whether we hold personal information about you and request a copy of relevant information.

Right to rectification

You can ask us to correct inaccurate information or complete incomplete information.

Right to erasure

In certain circumstances, you can ask us to delete your personal information.

This right is not absolute. We may need to retain information where required for tax, accounting, contractual, fraud prevention or legal purposes.

Right to restrict processing

In certain circumstances, you can ask us to restrict how information is used.

Right to object

Where we rely on legitimate interests, you may have the right to object to the processing based on your particular circumstances.

If you object, we will stop the processing unless we have compelling legitimate reasons to continue or the information is necessary for legal claims.

Right to object to direct marketing

You have the right to object to the use of your personal information for direct marketing at any time.

If you object, we will stop using the relevant information for that purpose.

Right to data portability

Where processing is based on consent or contract and is carried out by automated means, you may have the right to receive relevant information in a structured, commonly used and machine-readable format.

Right to withdraw consent

Where processing is based on consent, you can withdraw that consent at any time.

Withdrawal does not affect processing that was lawful before consent was withdrawn.

Exercising your rights

You can exercise your rights by contacting us through our Contact Us page or by writing to:

Data Protection Contact
AP Imports Limited trading as Boha Living
145a Pera Business Park
Nottingham Road
Melton Mowbray
Leicestershire
LE13 0PB

We may ask for information reasonably necessary to confirm your identity.

We will respond within the period required by applicable data protection law.

There is normally no fee for exercising your rights, although data protection law allows fees or refusal in certain limited circumstances.

17. Data protection complaints

If you are unhappy with how we have collected, used, stored or shared your personal information, you can make a data protection complaint directly to us.

You can submit a complaint through the Contact Us page on our website or write to:

Data Protection Contact
AP Imports Limited trading as Boha Living
145a Pera Business Park
Nottingham Road
Melton Mowbray
Leicestershire
LE13 0PB

We will:

acknowledge receipt of a data protection complaint within 30 days;
take appropriate steps to investigate it;
make appropriate enquiries where necessary;
keep you informed as appropriate; and
communicate the outcome without undue delay.

We may request additional information where reasonably necessary to investigate a complaint or confirm your identity.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

The ICO will generally expect you to have raised your concerns with us first.

18. Automated decision-making and profiling

Boha Living does not generally make decisions about customers that have legal or similarly significant effects solely through automated processing.

We may use technology for:

advertising profiling;
website personalisation;
analytics;
fraud detection; and
payment security.

Payment providers may also use automated systems when deciding whether to authorise payments, prevent fraud or provide payment or credit services.

For example, where you select Klarna or another third-party payment service, that provider may carry out its own eligibility, fraud or credit assessment under its own terms and privacy information.

Those decisions are made by the relevant payment provider rather than Boha Living.

If we begin using solely automated decision-making that produces legal or similarly significant effects for customers, we will update this policy as required.

19. Information required to fulfil an order

Certain personal information is necessary for us to enter into and perform a contract with you.

For example, we normally need enough information to:

identify you;
process your order;
process or arrange payment;
deliver your goods; and
communicate with you about your purchase.

If you do not provide information that is necessary to complete an order, we may be unable to provide the relevant product or service.

Providing information for general marketing is optional.

20. Children

Our website and products are intended primarily for adults and are not specifically directed at children.

We do not knowingly seek to collect children's personal information for marketing purposes.

If you believe that a child has provided personal information to us inappropriately, please contact us so that we can investigate.

21. Third-party websites

Our website may contain links to websites or services operated by other organisations.

Those organisations control their own websites and privacy practices.

We are not responsible for the privacy practices of third-party websites simply because a link appears on our website.

We recommend reviewing the privacy information provided by any third-party service you choose to use.

22. Changes to this policy

We may update this Privacy & Cookie Policy from time to time to reflect:

changes to our website;
changes to technology or service providers;
new payment methods;
new products or services;
changes to how we use personal information; or
changes to legal or regulatory requirements.

The latest version will be published on our website and the Last updated date at the top of the policy will be changed.

Where a change materially affects how we use personal information, we will take appropriate steps to bring the change to the attention of affected individuals where required.

23. Contact us

If you have questions about this policy, wish to exercise a data protection right or wish to make a data protection complaint, please contact us through our website.

You can also contact us by telephone on:

0330 133 8385

or write to:

Data Protection Contact
AP Imports Limited trading as Boha Living
145a Pera Business Park
Nottingham Road
Melton Mowbray
Leicestershire
LE13 0PB