Legal
Privacy Policy
This policy explains what personal data we collect when you visit lilavryn.shop, buy from us or contact us, why we use it and what rights you have. We collect only what we need to run the shop.
Who is responsible
The controller of your personal data is EMMA VOWLES LIMITED, trading as LILAVRYN, High Cross House, Dartington Hall, Totnes, Devon, TQ9 6ED, United Kingdom (company number 07236800). For any privacy question or request, email support@lilavryn.shop or call +44 7375 913840.
What we collect
- Order data: name, billing and delivery address, email address, phone number (if given), the pieces you order, order notes, and your chosen language and currency.
- Payment data: payments are handled by our payment service providers. We receive confirmation of payment, the payment method type and, for cards, the last four digits and expiry date. We never receive or store full card numbers.
- Account data: if you create an account, your login details and order history.
- Messages: what you send us through the contact form, the withdrawal form, email or phone.
- Technical data: IP address, browser type and the pages requested, recorded in server logs by our hosting provider for security, and the essential cookies described in our Cookie Policy.
We do not use advertising or analytics cookies, and we do not sell your personal data.
Why we use it and our legal bases
| Purpose | Legal basis (UK GDPR / EU GDPR) |
|---|---|
| Taking and delivering your order, processing payments, returns and refunds, and customer service | Performance of a contract (Art. 6(1)(b)) |
| Keeping accounting and tax records | Legal obligation (Art. 6(1)(c)) |
| Preventing fraud and keeping the website secure | Legitimate interests (Art. 6(1)(f)) |
| Answering messages that are not about an order | Legitimate interests (Art. 6(1)(f)) |
| Remembering your bag, language and currency | Legitimate interests and strictly necessary storage |
Who we share it with
We share personal data only with service providers who help us run the shop, and only as far as they need it:
- Payment service providers offered at checkout (for example Stripe or PayPal) to process your payment and prevent fraud. They act as independent controllers for some processing under their own privacy policies.
- Delivery carriers, who receive your name, delivery address and, where needed for delivery, your email or phone number.
- Our hosting and email provider (Hostinger), which stores the website, order data and emails on our behalf.
- Professional advisers and authorities where required by law, for example our accountants or tax authorities.
International transfers
We are based in the United Kingdom, and some of our providers operate in the European Union, the United States or elsewhere. Transfers between the UK and the EU are covered by adequacy decisions. Where data is transferred to other countries, our providers use recognised safeguards such as standard contractual clauses or the UK International Data Transfer Addendum.
How long we keep it
- Order and invoice records: 6 years from the end of the financial year, as required for UK tax purposes.
- Customer accounts: until you ask us to delete your account; orders within it are kept as above.
- Messages and withdrawal notices: up to 3 years after the matter is closed.
- Server logs: kept by our hosting provider for a limited period, normally no more than 30 days.
Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. To use any of these rights, email support@lilavryn.shop; we reply within one month.
You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the data protection authority of the country where you live or work, for example Datatilsynet in Denmark or the data protection authority of your German federal state.
Automated decisions
We do not make decisions about you based solely on automated processing. Our payment providers may use automated fraud screening when you pay; if a payment is declined, contact us and we will help.
Security
The whole website uses an encrypted HTTPS connection. Access to order data is limited to the people who need it to serve you.
Children
Our shop is intended for adults. We do not knowingly collect personal data from children.
Changes
We will update this policy if the way we use personal data changes. The date of the latest version is shown below.
Last updated: 27 September 2026