Privacy policy

Last updated: July 10, 2026

"Aeloria" ("Aeloria", "we", "us", "our"), operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Aeloria is powered by Shopify, which enables us to provide the Services to you.

We are the data controller responsible for your personal data. This Privacy Policy explains how we collect, use, disclose and protect your personal data when you visit, use, or make a purchase using the Services or otherwise communicate with us, and the rights you have in relation to that data. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are located in Australia, please also see the "Additional Information for Australian Customers" section below.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal data.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use, and disclosure of your information as described here.

Personal Data We Collect or Process

"Personal data" means information that identifies or can reasonably be linked to you. It does not include information that is anonymous or has been de-identified so that it cannot identify or be reasonably linked to you. Depending on how you interact with the Services, we may collect or process:

Contact details including your name, billing address, shipping address, phone number, and email address.
Financial and payment information including payment card information, transaction details, form of payment, and payment confirmation. Card payments are processed by our payment providers; we do not store full card numbers ourselves.
Account information including your username, password, preferences and settings.
Transaction information including the items you view, add to your cart or wishlist, or purchase, return, exchange or cancel, and your past transactions.
Communications including the information you provide when you contact us, for example a customer support enquiry.
Device and usage information including your device, browser, network connection, IP address, other unique identifiers, and information about how and when you interact with the Services (collected through cookies and similar technologies).

Where We Collect Your Personal Data From

Directly from you when you create an account, use the Services, communicate with us, or otherwise provide us with your personal data;
Automatically through the Services from your device and through cookies and similar technologies;
From our service providers (including Shopify) who collect or process personal data on our behalf;
From our partners or other third parties.

How We Use Your Personal Data and Our Lawful Bases

Under the UK GDPR we must have a lawful basis for processing your personal data. We rely on the following:

To provide the Services and fulfil your order — including processing payments, arranging shipping, managing returns and exchanges, managing your account, and providing customer support. Lawful basis: performance of our contract with you.
To operate, secure and improve the Services — including authenticating accounts, providing a secure shopping experience, detecting and preventing fraud or misuse, and improving our products and Services. Lawful basis: our legitimate interests in running a secure and effective business, and compliance with a legal obligation where applicable.
For marketing and advertising — to send you marketing communications and show you relevant advertising. Lawful basis: your consent (where required), or our legitimate interests. Where we rely on consent, you can withdraw it at any time. Every marketing email includes an unsubscribe option, and we handle electronic marketing in line with the Privacy and Electronic Communications Regulations (PECR).
To comply with the law — including responding to lawful requests from authorities, and enforcing our terms and policies. Lawful basis: compliance with a legal obligation and our legitimate interests.

How We Disclose Personal Data

We may disclose your personal data to:

Shopify and other service providers who perform services on our behalf (e.g. IT and hosting, payment processing, data analytics, customer support, cloud storage, fulfilment and shipping), under contracts that require them to protect your data and use it only as instructed.
Business and marketing partners to provide advertising and marketing services. Depending on where you live, you may have the right to direct us not to share information about you for targeted advertising based on your activity across different sites.
Third parties where you direct, request or consent to it, such as to ship you products or through your use of social media or login integrations.
Our affiliates or others within our corporate group.
Other parties in connection with a business transaction (such as a merger or insolvency), or to comply with legal obligations, enforce our terms, or protect our rights, users or others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal data about your access to and use of the Services in order to provide and improve them. Information you submit to the Services will be transmitted to and shared with Shopify and third parties that may be located in countries other than where you reside. Shopify may also use certain enhanced features that incorporate data from your interactions with our store, other merchants, and Shopify. In those circumstances, Shopify is responsible for that processing, including responding to requests to exercise your rights in relation to it. To learn more, see the Shopify Consumer Privacy Policy.

Cookies and Similar Technologies

We use cookies and similar technologies to operate the Services, remember your preferences, analyse usage, and support advertising. You can control non-essential cookies through the cookie settings on our website and through your browser settings. Some cookies are necessary for the Services to function and cannot be switched off.

International Transfers

We are based in the United Kingdom, and we sell to and serve customers in other countries, including Australia. Your personal data may therefore be transferred to, stored, and processed outside the country where you live, including by Shopify and our other service providers.

Where we transfer personal data out of the United Kingdom, we rely on recognised safeguards to protect it, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or transfers to countries the UK has determined provide an adequate level of protection.

Security and Retention

We take reasonable technical and organisational measures to protect your personal data from misuse, loss, and unauthorised access, alteration or disclosure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. We recommend you do not send sensitive or confidential information through unsecure channels.

We keep your personal data only for as long as we need it — to provide the Services, maintain your account, comply with legal, tax and accounting obligations, resolve disputes, and enforce our agreements. When we no longer need it, we take reasonable steps to delete or anonymise it.

Your Rights

Under the UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and may not apply in every circumstance:

Access — to request a copy of the personal data we hold about you.
Rectification — to have inaccurate or incomplete personal data corrected.
Erasure — to request deletion of your personal data in certain circumstances.
Restriction — to ask us to restrict processing in certain circumstances.
Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
Portability — to receive certain personal data in a portable format, or have it transferred to another controller, where applicable.
Withdraw consent — where we rely on your consent, you can withdraw it at any time, without affecting processing carried out before withdrawal.

To exercise any of these rights, contact us using the details below. We will respond within the time required by law (generally one month under the UK GDPR). We may need to verify your identity first. We will not discriminate against you for exercising your rights.

Complaints

If you have a concern about how we handle your personal data, please contact us first using the details below and we will do our best to resolve it. You also have the right to lodge a complaint with the UK's data protection regulator, the Information Commissioner's Office (ICO), at www.ico.org.uk. If you are in Australia, see the section below for how to raise a complaint locally.

Children's Data

The Services are not intended for children, and we do not knowingly collect personal data from children. If you believe a child has provided us with their personal data, please contact us using the details below and we will take steps to delete it.

Additional Information for Australian Customers

Because we sell to customers in Australia, if you are located in Australia the following also applies. We handle your personal information consistently with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth) to the extent they apply to us. This means, among other things, that you can ask us to access or correct the personal information we hold about you.

For marketing messages sent to recipients in Australia, we comply with the Spam Act 2003 (Cth): we obtain consent where required, identify ourselves as the sender, and include a working unsubscribe option in every commercial message.

If we experience a data breach that is likely to result in serious harm and the Notifiable Data Breaches scheme applies to us, we will notify affected individuals and the Office of the Australian Information Commissioner (OAIC).

If you are in Australia and have a privacy complaint, you can contact us using the details below, and you may also contact the OAIC at www.oaic.gov.au.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for operational, legal or regulatory reasons. We will post the revised policy on this website, update the "Last updated" date above, and provide notice where required by law.

Contact

If you have any questions about this Privacy Policy or how we handle your personal data, or if you would like to exercise any of your rights, please email us at info.aeloria@gmail.com.