Privacy Policy

We collect only the personal data that is necessary to fulfil your order, provide customer support, and operate our store lawfully. We do not collect data we do not need, and we do not retain data beyond the periods described in this Policy.

What we do not collect: We do not collect sensitive personal data such as health information, racial or ethnic origin, religious beliefs, or biometric data. We do not knowingly collect personal information from children. If you believe a minor has provided us with personal data, please contact us at info@lyvella-shop.com and we will delete it promptly.

We use your personal data only for the purposes listed below. Under the GDPR, we process your data on the basis of contractual necessity (to fulfil your order), legitimate interest (fraud prevention, site improvements), legal obligation (tax compliance), and consent (marketing emails).

We share your personal data only with the service providers that are essential to operating our store and fulfilling your order. All third-party providers are bound by confidentiality and data processing obligations. We never sell your personal data to anyone, for any purpose, ever.

International data transfers: Shopify may process data using infrastructure located outside the European Economic Area (EEA). Where this occurs, such transfers are protected by Standard Contractual Clauses (SCCs) approved by the European Commission or another legally approved transfer mechanism, ensuring your data continues to receive a level of protection equivalent to that guaranteed under the GDPR. Shopify's privacy policy is available at shopify.com/legal/privacy.

We use cookies and similar tracking technologies on lyvellashop.com to enable essential site functions, analyse traffic, and (where you have consented) deliver personalised advertising. In accordance with the EU ePrivacy Directive and the GDPR, non-essential cookies are only placed with your consent. You can control cookie use through our cookie banner or your browser settings at any time.

As a resident of the European Union, the General Data Protection Regulation (GDPR) provides you with specific rights regarding your personal information. This section describes those rights and how to exercise them.

Right of Access: You have the right to request confirmation of whether we process your personal data, and to obtain a copy of that data along with information about how and why it is processed.

Right to Rectification: You have the right to request that we correct inaccurate or incomplete personal information we hold about you.

Right to Erasure ("right to be forgotten"): You have the right to request deletion of personal information we have collected from you, subject to certain exceptions (e.g., where retention is required to complete a transaction, comply with a legal obligation, or establish, exercise, or defend legal claims).

Right to Restrict Processing: You have the right to request that we limit how we use your personal information in certain circumstances, for example while a dispute about its accuracy is resolved.

Right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

Right to Object: You have the right to object to processing based on our legitimate interests, including direct marketing, at any time.

Right to Withdraw Consent: Where processing is based on your consent (such as marketing emails or non-essential cookies), you have the right to withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.

Authorised agents: You may designate an authorised representative to make a GDPR request on your behalf. To do so, your representative must provide written permission signed by you, and we may still require you to verify your identity directly with us to confirm the representative's authority.

Right to lodge a complaint: If you believe our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or with the supervisory authority in your own EU member state. We would, however, prefer the opportunity to resolve your concern directly first — please contact us at info@lyvella-shop.com.

We respond to all requests at no charge. We will not discriminate against you for exercising any of your GDPR rights.

We retain personal data only for as long as necessary for the purposes for which it was collected or as required by applicable law. We implement industry-standard security measures to protect your data against unauthorised access, loss, or disclosure.

Order data: Retained for 7 years from the date of the transaction to comply with the Dutch fiscal retention obligation (fiscale bewaarplicht) enforced by the Belastingdienst (Dutch Tax Administration) and other applicable EU accounting requirements. After this period, data is securely deleted or anonymised.

Marketing data: Retained for as long as you remain subscribed to marketing communications. Upon unsubscribe, we retain a suppression record of your opt-out to ensure we do not contact you again. If no commercial email has been sent for 3 years, the record is reviewed and deleted unless you are also an active customer.

Account & customer data: Retained until you request deletion of your account or personal data (subject to our legal retention obligations). We will confirm deletion within 30 days of a valid request.

Analytics & cookies: Aggregated analytics data is retained in line with our analytics providers' default retention periods (typically 14–26 months). Session-level cookie data is purged at the end of each browsing session.

We review and update this Privacy Policy periodically to reflect changes in our business practices, applicable law, and the services we offer. When we make material changes, we will notify you.

Policy updates: We may update this Privacy Policy at any time. The effective date at the top of this page always reflects the current version. For material changes — those that meaningfully affect your privacy rights or how we handle your data — we will notify you by posting a prominent banner on lyvellashop.com before the changes take effect. We encourage you to review this Policy periodically.

Governing law: This Privacy Policy is governed by the laws of the Netherlands and, where applicable, European Union law, without regard to conflict of law principles. Disputes will be submitted to the competent courts of the Netherlands, without prejudice to any mandatory consumer protection rights you may have in your own country of residence.

Response times: We aim to acknowledge your request within 5 business days and respond in full within one month of receipt, extendable by up to two further months for complex or numerous requests as permitted under the GDPR.