Privacy policy

Privacy Policy

Effective Date: September 28, 2026
Last Updated: September 28, 2026

1. Introduction & Scope

Woolf Helmets (“we,” “us,” or “our”) is a trading name of Vigil Helmets Ltd. We design, manufacture, and sell folding smart helmets and related connected products and services, including our companion mobile application (the “App”), our website at woolfhelmets.com (the “Site”), our crowdfunding campaigns (including on Kickstarter), and our e-commerce store (collectively, the “Services”).

This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights and choices available to you.

It applies globally to visitors, customers, backers, and App and helmet users and is designed to address the principal data protection laws in the regions where we operate or have users, including:

  • United Kingdom: UK GDPR and the Data Protection Act 2018

  • European Economic Area: EU General Data Protection Regulation (GDPR) 2016/679

  • United States: State privacy laws including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and comparable laws in Virginia, Colorado, Connecticut, Utah, and other states

  • Australia: The Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs)

  • Asia-Pacific: Including Singapore’s Personal Data Protection Act (PDPA), Japan’s Act on the Protection of Personal Information (APPI), and, where applicable to Woolf Helmet’s manufacturing, supply chain, or customer relationships, China’s Personal Information Protection Law (PIPL)

Where local law provides greater protection or additional rights than described generally in this Policy, the Regional Supplements in Section 13 apply and take precedence for individuals in that region.

2. Who We Are — Data Controller

For the purposes of the UK GDPR and EU GDPR, the data controller for personal data collected through the Services is:

Vigil Helmets Ltd.
1 Old Court Mews
311 Chase Road
London N14 6JS
United Kingdom

Email: privacy@woolfhelmets.com

If Woolf Helmet appoints an EU representative under Article 27 GDPR, that representative’s contact details will be added to this Privacy Policy.

3. Personal Data We Collect

We collect personal data directly from you, automatically through your use of the Services, and from third parties, as follows.

3.1 Contact & Marketing Data

  • Name, email address, and other details you provide through our website contact forms, newsletter sign-up, or marketing opt-ins

  • Your communications with us, including customer support enquiries and survey responses

3.2 Order & Customer Data

  • Billing and shipping name, address, phone number, and email address

  • Order history and product preferences, such as helmet size and colour

  • Payment information. Our payment processors handle and store full card details. We retain only limited transaction metadata, such as order ID, amount, last four digits, and payment status, and do not store full card numbers.

3.3 Kickstarter & Crowdfunding Backer Data

  • Backer name, shipping address, email address, pledge amount, and reward tier, as provided to us by Kickstarter or another crowdfunding platform when you back a Woolf Helmet campaign

  • Crowdfunding platforms act as independent data controllers for the data they collect at the point of pledging. Please also review the relevant platform’s own privacy policy.

3.4 Companion App & Bluetooth Helmet Data

When you pair your Woolf Helmet with our companion App via Bluetooth, we and/or your device may collect:

  • Device information: Mobile device type, operating system, unique device and Bluetooth identifiers, and App version

  • Helmet usage and sensor data: Fold/unfold status, ride sessions and duration, impact/crash-detection sensor readings, battery and firmware status, and diagnostic/error logs

  • Location data: If you enable location permissions, such as for ride tracking, crash-alert location sharing, or “find my helmet” features, we collect precise or approximate GPS location. Location features are opt-in and can be disabled in your device or App settings at any time.

  • Bluetooth pairing data: Information needed to establish and maintain the connection between your device and helmet

  • Emergency contact information: Contact details you choose to provide for Crash Detection notifications

3.5 Emergency Contact SMS Notifications

If you enable Crash Detection and add an emergency contact, we text that person an invitation. They are only enrolled if they reply YES, and they can reply STOP at any time to be removed. Once enrolled, we use their mobile number only to send SMS notifications about a detected crash, which may include your location.

Emergency contact information is used only for safety-related communications and is never used for marketing.

SMS opt-in data and consent will not be sold, shared, or disclosed to third parties for marketing or promotional purposes.

We may provide information necessary to deliver an emergency SMS notification to service providers that facilitate SMS or communications services on our behalf. Those providers receive the information only as necessary to provide the applicable communication service.

Message frequency varies: emergency contacts receive one invitation, one confirmation if they reply YES, and crash alerts only if a crash is detected. Mobile numbers and SMS opt-in data are never shared with third parties or affiliates for marketing or promotional purposes.

3.6 Automatically Collected Website Data

We may collect:

  • IP address

  • Browser type

  • Device identifiers

  • Pages viewed

  • Referring URLs

  • Timestamps

This information may be collected through cookies and similar technologies as described in Section 6.

3.7 Data From Third Parties

Analytics providers, advertising partners, payment processors, shipping carriers, and crowdfunding platforms may provide us with data about your interactions with our advertisements, orders, or deliveries.

4. How We Use Personal Data

We use personal data for the following purposes:

  • To process and fulfil orders and Kickstarter or other crowdfunding pledges, including manufacturing, shipping, and customs clearance

  • To provide, maintain, and improve the App and helmet functionality, including firmware updates, crash-detection alerts, and customer support

  • To provide emergency and safety-related communications, including Crash Detection SMS notifications to emergency contacts you designate

  • To communicate with you about orders, shipping updates, product safety notices, and, where you have consented or as otherwise permitted by law, marketing communications

  • To administer the Crash Helmet Replacement program

  • To operate and improve our website and Services, including analytics and troubleshooting

  • To run and measure advertising campaigns, including retargeting

  • To detect, investigate, and prevent fraud, abuse, and security incidents

  • To comply with legal obligations, including product safety, consumer protection, tax, and customs requirements, and to establish, exercise, or defend legal claims

5. Legal Bases for Processing (UK/EU GDPR)

Where the UK GDPR or EU GDPR applies, we rely on the following legal bases:

Order fulfilment, shipping, and customer support: Performance of a contract

Product safety recalls, tax, customs, and other legal compliance: Legal obligation

Marketing communications, including email/newsletter: Consent, which may be withdrawn at any time

Crash-detection alerts and location-based features such as “find my helmet”: Consent

Website analytics, App diagnostics, fraud prevention, and security: Legitimate interests, balanced against your rights

Advertising cookies, pixels, and tracking: Consent obtained through our cookie banner where required by law

6. Cookies & Similar Technologies

We and our partners use cookies, SDKs, and similar technologies on the Site and in the App for the following categories of purposes:

  • Strictly necessary: Required for the Site, Store, or App to function, such as shopping cart, login, and security functionality

  • Analytics: To understand how visitors use the Site, using tools such as Google Analytics

  • Advertising: To deliver and measure advertising and retargeting campaigns, using tools such as Meta (Facebook/Instagram) Pixel and TikTok Pixel

Where required by UK or EU law, we obtain your consent through a cookie banner before setting non-essential cookies. You can withdraw consent at any time through our cookie settings tool or your browser settings.

US visitors in states with opt-out rights, and visitors elsewhere where applicable, can exercise equivalent choices as described in Sections 8 and 13.

We also honor recognized opt-out signals such as the Global Privacy Control (GPC) where legally required to do so.

7. How We Share Personal Data

We do not sell personal data for monetary compensation.

We may share personal data with the following categories of recipients:

  • Manufacturing and fulfilment partners: Contract manufacturers, freight forwarders, and shipping carriers involved in producing and delivering your helmet

  • Payment processors: Payment providers used to process payments securely

  • Crowdfunding platforms: Kickstarter and similar platforms in connection with backer rewards

  • Cloud hosting and IT service providers: Providers used to host our website, App backend, databases, and related technology

  • SMS and communications service providers: Providers that facilitate emergency, safety, transactional, or other service-related communications on our behalf. SMS opt-in data and consent are not shared with third parties for marketing or promotional purposes.

  • Analytics and advertising partners: As described in Section 6

  • Certification, testing, and compliance bodies: Where required for product safety certification or regulatory reporting

  • Professional advisers and insurers: Lawyers, accountants, insurers, and other professional advisers where necessary for their services to us

  • Government and regulatory authorities: Where required by law, including for product safety, customs, or law enforcement purposes

  • Business transferees: In connection with a merger, financing, acquisition, reorganization, or sale of assets

Under CCPA/CPRA, sharing personal data with advertising partners for cross-context behavioural advertising through cookies or pixels may be considered a “sale” or “sharing” of personal data as those terms are defined under California law. See Section 13.2 for applicable opt-out rights.

For clarity, SMS opt-in data and consent are not sold, shared, or disclosed to third parties for marketing or promotional purposes, including to analytics or advertising partners.

8. Your Choices: Opt-In and Opt-Out Rights

We want your data choices to be clear and easy to act on.

8.1 Opt-In

Certain features remain off until you choose to activate them:

  • Marketing emails: We send marketing communications where you affirmatively sign up or where otherwise permitted by applicable law.

  • Location data: GPS-based features, including ride tracking, crash-alert location sharing, and “find my helmet,” are disabled by default and activate only once you grant the relevant location permissions.

  • Bluetooth/sensor data collection: Helmet usage, crash-detection, and diagnostic data is collected in connection with pairing and using your helmet with the App in accordance with applicable permissions and App terms.

  • Non-essential cookies: Where consent is required, analytics and advertising cookies are set only after you actively consent through our cookie banner. Strictly necessary cookies do not require consent.

8.2 Opt-Out

You may exercise applicable opt-out rights as follows:

  • Unsubscribe from marketing: Every marketing email includes an unsubscribe link. You may also contact privacy@woolfhelmets.com.

  • Advertising cookies/pixels: Use our cookie preference tool or your browser settings to manage analytics and advertising cookies.

  • Sale/sharing of personal data: Where applicable under California or other US state law, you may opt out of the “sale” or “sharing” of personal data for cross-context behavioural advertising through our cookie preference tool or by contacting privacy@woolfhelmets.com.

  • Global Privacy Control (GPC): Where legally required, we treat a detected GPC browser signal as a valid opt-out-of-sale/sharing request.

  • Push notifications: Push notifications can be disabled through your device’s notification settings.

  • Withdrawing GDPR/UK GDPR consent: Where our processing relies on consent, you may withdraw that consent at any time by contacting us. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Turning off an opt-in feature or exercising an opt-out may disable certain functionality. For example, disabling location permissions will prevent location-dependent features from working.

9. International Data Transfers

Woolf Helmet is based in the United Kingdom, and personal data may be transferred to and processed in the UK, the EU, the United States, and other countries where our service providers, manufacturing partners, or group entities operate, including countries that may not have data protection laws equivalent to those in your home jurisdiction.

Where we transfer personal data out of the UK or EEA, we use appropriate safeguards as required by applicable law, which may include:

  • The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses

  • The European Commission’s Standard Contractual Clauses (SCCs)

  • Reliance on an applicable adequacy decision

You may request further information about these safeguards by contacting us using the details in Section 14.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to satisfy applicable legal, accounting, tax, product-safety, and reporting requirements.

Retention periods may vary depending on the nature of the information and the reason it was collected.

When personal data is no longer required, we take reasonable steps to securely delete, anonymize, or aggregate it, subject to applicable legal and regulatory requirements.

11. Data Security

We implement technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. These measures may include encryption in transit, access controls, and vendor due diligence.

No system is completely secure, and we cannot guarantee absolute security.

In the event of a personal data breach, we will notify affected individuals and relevant supervisory or regulatory authorities where required by applicable law.

12. Children’s Privacy

Our Services are intended for adults and are not directed to children.

We do not knowingly collect personal data from children in violation of applicable data protection laws. Where parental or guardian consent is required by applicable law, we will seek appropriate consent before knowingly processing a child’s personal data.

If we learn that we have collected personal data from a child without legally required consent, we will take appropriate steps to delete it.

Parents or guardians who believe their child has provided personal data to us should contact us at privacy@woolfhelmets.com.

13. Regional Supplements & Your Rights

13.1 United Kingdom & European Economic Area

If you are located in the UK or EEA, you may have the right to:

  • Access your personal data

  • Request correction of inaccurate data

  • Request erasure of your personal data

  • Restrict or object to certain processing

  • Object to direct marketing

  • Request data portability

  • Withdraw consent where processing is based on consent

You also have the right to lodge a complaint with your applicable data protection authority. In the UK, this is the Information Commissioner’s Office (ICO).

13.2 United States, Including California

Depending on your state of residence and applicable law, you may have the right to:

  • Know what personal data we collect and how it is used and shared

  • Access and obtain a copy of your personal data

  • Request deletion of personal data

  • Correct inaccurate personal data

  • Opt out of certain “sales” or “sharing” of personal data, including certain cross-context behavioural advertising

  • Opt out of certain profiling where applicable

  • Exercise applicable privacy rights without unlawful discrimination

To exercise applicable sale/sharing opt-out rights, use our cookie preference tool or contact privacy@woolfhelmets.com.

We will not unlawfully discriminate against you for exercising your privacy rights.

13.3 Australia

If you are located in Australia, we handle personal data in accordance with applicable requirements of the Australian Privacy Principles under the Privacy Act 1988 (Cth).

You may request access to and correction of your personal data and may lodge a complaint with us or, where applicable, with the Office of the Australian Information Commissioner (OAIC) if you believe we have mishandled your personal data.

13.4 Asia-Pacific

Depending on your location, additional rights may apply, including:

  • Singapore (PDPA): Rights to access and correct personal data and to withdraw consent for collection, use, or disclosure, subject to applicable legal and contractual restrictions

  • Japan (APPI): Rights to request disclosure, correction, suspension of use, or deletion of retained personal data

  • Mainland China: Where PIPL applies, additional requirements relating to consent, cross-border transfers, and other processing may apply

To exercise any of the rights described in this Section 13, contact us at privacy@woolfhelmets.com.

We will respond within the timeframe required by applicable law and may need to verify your identity before fulfilling a request.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal data, please contact:

Vigil Helmets Ltd.
1 Old Court Mews
311 Chase Road
London N14 6JS
United Kingdom

Email: privacy@woolfhelmets.com

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

When we update this Privacy Policy, we will post the revised version with an updated “Last Updated” date. Where changes are material, we may provide additional notice, such as by email or through an in-App notice, where required by applicable law.