Privacy Policy

Last updated: 24 February 2026

1. Information on the Collection of Personal Data and Contact Details of the Controller

1.1

We are pleased that you are visiting our website and thank you for your interest in our products. Below, we inform you about how we handle your personal data when you use our website. Personal data means any information that can be used to identify you personally.

In addition to processing data for order fulfilment and customer service, we may also process personal data for fraud prevention, payment security, risk management and the defence of legal claims, including chargeback proceedings and transaction disputes.

1.2

The controller for data processing on this website within the meaning of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is:

Ella & Olivia London
Munthof 7, 5551 XG Valkenswaard
The Netherlands
Email: info@ellaolivialondon.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

1.3

This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content, such as orders or inquiries. You can recognise an encrypted connection by the “https://” prefix and the lock symbol in your browser.

We also implement appropriate technical and organisational security measures to protect personal data against unauthorised access, misuse, loss or unlawful disclosure.

2. Data Collection When Visiting Our Website

When you use our website for informational purposes only, meaning you do not register or otherwise provide information to us, we collect only the data that your browser automatically transmits to our server.

This includes pages visited, date and time of access, amount of data transferred, referring website, browser type and version, operating system and IP address.

This data is processed in accordance with Article 6(1)(f) UK GDPR based on our legitimate interest in ensuring the stability, security, fraud prevention and proper functionality of our website.

Server log data may also be analysed where necessary to detect suspicious activity, prevent abuse or secure evidence in the event of fraudulent transactions or cyberattacks. The data is not used to directly identify you and is deleted after a limited retention period unless specific indications of unlawful use require further retention.

3) Hosting and E-Commerce Platform

Our online store is operated using Shopify Inc., which provides the e-commerce platform that enables us to sell our products to you. Shopify processes personal data on our behalf as a data processor in accordance with Article 28 UK GDPR.

When you place an order, Shopify processes information such as your name, billing and shipping address, email address, telephone number, payment details, IP address, device information and order history. This processing is necessary for the performance of the contract pursuant to Article 6(1)(b) UK GDPR.

To protect against unauthorised transactions and fraud, Shopify and integrated payment providers may automatically assess transaction risk. Orders may be flagged as medium or high risk based on objective risk indicators such as IP inconsistencies, unusual purchasing behaviour or payment verification results.

Where necessary to protect our legitimate business interests, we reserve the right to request additional verification, delay shipment, cancel orders or refuse future transactions. This processing is based on Article 6(1)(f) UK GDPR (legitimate interest in fraud prevention and business protection).

In the event of a payment dispute or chargeback, relevant transaction data, including order details, IP address, delivery confirmation, tracking data and communication history, may be retained and shared with payment providers, banks or financial institutions for the purpose of defending the transaction. Such processing is necessary for the establishment, exercise or defence of legal claims.

Shopify may store data on servers located outside the United Kingdom. In such cases, appropriate safeguards such as Standard Contractual Clauses are implemented to ensure an adequate level of data protection.

4. Cookies and Similar Technologies

We use cookies to ensure the functionality, security and performance of our website.

Technically necessary cookies are processed pursuant to Article 6(1)(f) UK GDPR to enable secure checkout, session management, shopping cart functionality and fraud detection.

Marketing and tracking cookies, including those related to Meta advertising services, are only set with your explicit consent in accordance with Article 6(1)(a) UK GDPR.

You may manage or withdraw your consent at any time via our cookie consent tool. Disabling certain cookies may limit website functionality or affect transaction security features.

5. Data Processing for Contract Execution

When you place an order with us, we process your personal data to confirm your order, process payment, arrange shipment, provide customer support and manage any post-purchase inquiries.

The legal basis for this processing is Article 6(1)(b) UK GDPR.

Your data may be shared with shipping providers, payment service providers and fraud detection services to the extent necessary to fulfil your order and protect against unauthorised transactions.

We do not store complete credit card details ourselves. Payment processing is carried out via secure third-party payment providers integrated within Shopify.

Data required for accounting, tax compliance and financial regulations will be retained in accordance with statutory retention periods under applicable law.

6. Contacting Us

If you contact us via email or contact form, the data you provide will be processed for the purpose of responding to your inquiry.

The legal basis for processing is Article 6(1)(f) UK GDPR based on our legitimate interest in responding to customer inquiries. If your inquiry relates to a potential or existing contract, the legal basis is Article 6(1)(b) UK GDPR.

Communication records may be retained where necessary to resolve disputes, investigate complaints or defend against payment claims or chargebacks.

7. Email Marketing

If you subscribe to our newsletter, we process your email address for the purpose of sending promotional communications. Subscription is based on your explicit consent pursuant to Article 6(1)(a) UK GDPR. We use a double opt-in procedure to verify your consent.

You may withdraw your consent at any time by clicking the unsubscribe link included in each email.

If you have previously purchased goods from us, we may send you marketing communications relating to similar products based on our legitimate interest pursuant to Article 6(1)(f) UK GDPR, provided you have not opted out.

8. Online Marketing and Meta Pixel

We use Meta advertising services, including the Meta Pixel, to measure the effectiveness of advertisements on Facebook and Instagram and to show advertisements to users who have previously visited our website.

When you visit our website and consent to marketing cookies, the Meta Pixel may collect information such as your IP address, browser information, device data and interactions with our website.

Processing takes place solely on the basis of your explicit consent pursuant to Article 6(1)(a) UK GDPR.

Data collected via the Meta Pixel may be transmitted to Meta servers, including servers outside the UK. Appropriate safeguards such as Standard Contractual Clauses are implemented to ensure adequate data protection.

You can withdraw your consent at any time via our cookie settings.

9. Social Media Presence

We maintain business profiles on Facebook and Instagram to communicate with customers and promote our products. When you interact with our social media pages, personal data may be processed by the respective platform operator in accordance with their own privacy policies.

We may receive aggregated statistical insights from these platforms but do not control independent data processing carried out by the platform providers.

10. Rights of the Data Subject

Under UK data protection law, you have the following rights:

  • You have the right of access to your personal data pursuant to Article 15 UK GDPR.
  • You have the right to rectification pursuant to Article 16 UK GDPR.
  • You have the right to erasure pursuant to Article 17 UK GDPR, unless processing is necessary for compliance with legal obligations or the defence of legal claims.
  • You have the right to restriction of processing pursuant to Article 18 UK GDPR.
  • You have the right to data portability pursuant to Article 20 UK GDPR.
  • You have the right to object to processing pursuant to Article 21 UK GDPR.
  • You have the right to withdraw consent at any time pursuant to Article 7(3) UK GDPR.

You have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office.

11. Retention Period

Personal data is stored only for as long as necessary to fulfil the purposes described in this policy, to comply with statutory retention obligations, or to protect our legitimate business interests, including fraud prevention and the defence of legal claims.

Transaction-related data may be retained for the duration of applicable limitation periods under UK law. Once the relevant retention period has expired, the data will be securely deleted or anonymised unless further storage is legally required.