Last updated: 4 September 2026

This Privacy Policy explains how Varellune ("Varellune", "we", "us") collects, uses, shares and protects personal information when you visit varellune.com, place an order, create an account, or contact us (together, the "Services").

Our store runs on Shopify. Shopify hosts the Services and processes personal information on our behalf so that we can operate the shop, take payment and deliver orders.

If any part of this policy conflicts with our Terms of Service, this Privacy Policy governs anything to do with personal information.

Who is responsible for your data

Varellune is the controller of the personal information described here. You can reach us about anything in this policy, including any request to exercise your rights, at:

Email: contact@varellune.com

We answer privacy requests within 30 days. If we need longer because a request is complex, we will tell you why before that deadline passes.

What we collect

• Contact details — name, billing and shipping address, email address, phone number.
• Order information — what you bought, order number, delivery and tracking details, returns and repairs history, gift messages you ask us to include.
• Payment information — payment method and the outcome of the transaction. Card numbers are entered directly into our payment providers' systems and are never stored by us.
• Account information — the email you register with, your saved addresses, your wishlist and your order history.
• Messages you send us — the content of emails and contact form submissions, including anything you choose to attach.
• Device and usage information — IP address, browser and device type, pages viewed, referring site, and the actions you take on the store. This is collected automatically through cookies and similar technologies.
• Marketing preferences — whether you have subscribed to our emails and whether you have opted out.

We do not knowingly collect special categories of data (health, religion, political opinions, biometrics) and we ask that you do not send them to us.

Where the information comes from

• From you, when you order, register, subscribe, or write to us.
• Automatically, through cookies and similar technologies while you browse.
• From our service providers — Shopify, payment providers, carriers, and email and analytics tools — when they process an order or an interaction on our behalf.

Why we use it, and on what legal basis

Purpose	Legal basis (EEA and UK)
Taking, processing, shipping and tracking your order; handling returns, refunds, exchanges and repairs	Performance of a contract with you
Answering your questions and providing customer service	Performance of a contract, and our legitimate interest in supporting customers
Preventing fraud, abuse and chargebacks, and keeping the store secure	Legitimate interest, and legal obligation
Keeping accounting, tax and customs records	Legal obligation
Improving the store, our products and our merchandising	Legitimate interest
Sending marketing emails	Your consent, which you can withdraw at any time
Non-essential cookies and advertising measurement	Your consent

We do not sell your personal information, and we do not share it for cross-context behavioural advertising in the sense given to those terms by United States state privacy laws.

Who we share it with

• Shopify, which hosts the store and processes orders and payments.
• Payment providers, to take payment, verify it and process refunds.
• Carriers and logistics partners, to deliver your parcel and carry returns and repairs, including the customs data a shipment requires.
• Email and analytics providers, to send the messages you asked for and to understand how the store is used.
• Professional advisers and authorities, where the law requires it, or to establish, exercise or defend legal claims.
• A buyer or successor, if the business is sold, merged or reorganised. We will tell you before your information becomes subject to a different privacy policy.

Our providers may only use your information to do the work we hired them for.

International transfers

We ship worldwide, and our providers operate in several countries, so your information may be stored or processed outside the country you live in. When we move personal information out of the European Economic Area or the United Kingdom, we rely on a recognised transfer mechanism, such as the European Commission's Standard Contractual Clauses or the UK equivalent, together with the additional safeguards those clauses require.

How long we keep it

• Order and transaction records — for as long as tax, accounting and customs law requires, generally up to ten years from the order.
• Account information — while your account is open, and then for a short period after you close it.
• Customer service messages — up to three years after the conversation ends.
• Marketing data — until you unsubscribe, plus a suppression record so we do not email you again by mistake.
• Cookie and usage data — for the lifetime of the cookie concerned, as set out in the section below.

Security

The store runs over HTTPS, payment card data is handled by PCI-DSS compliant providers and never reaches our systems, and access to customer data is limited to the people who need it to run the shop. No method of transmission or storage is perfectly secure, so we cannot promise absolute security, but we will notify you and the relevant authority where the law requires it if a breach affects your data.

Cookies

We use cookies and similar technologies to keep the store working (your bag, your session, your currency, fraud prevention), to remember your preferences, to measure how the store is used, and — where you consent — to measure advertising.

Essential cookies are needed for the store to function and cannot be switched off. You can refuse or withdraw consent for the rest through the cookie banner where it is shown to you, and you can delete or block cookies in your browser settings. Blocking essential cookies will break checkout.

Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• have inaccurate information corrected;
• have your information deleted;
• receive your information in a portable format, or have it sent to another controller;
• object to, or ask us to restrict, certain processing;
• withdraw consent at any time, without affecting processing already carried out;
• not be discriminated against for exercising any of these rights.

To exercise any of them, email contact@varellune.com from the address on your order, or tell us your order number, so that we can confirm who you are. If someone acts for you, we will ask for proof that you authorised them.

You can unsubscribe from marketing emails using the link at the bottom of any of them, or by writing to us. You will still receive transactional messages about orders you have placed.

Complaints

If you are unhappy with how we have handled your personal information, write to us first at contact@varellune.com and we will look into it. You also have the right to complain to your local data protection authority, and in the EEA and the UK to do so without contacting us first.

Children

The Services are not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us their information, write to us and we will delete it.

Other websites

The store may link to sites we do not run. We are not responsible for their privacy practices, and this policy does not cover them.

Changes to this policy

We may update this policy to reflect changes in how we work or in the law. The date at the top shows when it last changed. Where the change is significant, we will make it visible on the store.