Privacy Policy

Sophie & Lila ("we", "us") is operated from the Netherlands and acts as the data controller for your personal data. This Privacy Policy explains how we collect, use and protect your personal data when you visit or purchase from sophie-lila.com, in accordance with the UK GDPR and the Data Protection Act 2018, as well as the EU GDPR which applies to us as a Netherlands-based business.

Information We Collect

Identity and contact data: name, email address, phone number, shipping and billing address.
Order data: products purchased, order value, currency, delivery details, returns and support history.
Payment data: processed securely by our payment providers; we do not store full card numbers.
Device and usage data: IP address, browser type, pages viewed, referral source, collected via cookies and similar technologies.
Marketing preferences: email/SMS opt-ins and engagement.

How and Why We Use Your Data (Legal Bases)

Performance of a contract: processing and delivering your order, customer support, returns and refunds.
Legitimate interests: fraud prevention, analytics, improving our store, and direct marketing to existing customers (with an opt-out in every message).
Consent: optional marketing communications and non-essential cookies; you may withdraw consent at any time.
Legal obligation: tax, accounting and consumer law record-keeping.

Sharing Your Data

We share personal data only as needed with: fulfilment and logistics partners (including warehouses and carriers located outside the UK, primarily in Asia and Europe) to deliver your order; payment processors; email/SMS marketing platforms; advertising and analytics providers (including platforms such as Pinterest and Meta); IT and hosting providers (including Shopify); and authorities where legally required. We do not sell your personal data.

International Transfers

Your data is processed in the Netherlands/EU and shared with providers in other countries (including the United States and Asia). Transfers from the UK/EU are protected by appropriate safeguards such as adequacy regulations or standard contractual clauses with our providers.

Retention

We retain personal data only as long as needed for the purposes above, including statutory retention periods for tax and accounting records (typically 7 years under Dutch law), after which it is deleted or anonymised.

Cookies

We use essential cookies to run the store and optional cookies for analytics and advertising. Non-essential cookies are used in accordance with applicable rules; you can manage cookies via your browser settings.

Your Rights

Under the UK GDPR you have the right to: access your data; rectify inaccurate data; erasure; restriction of processing; data portability; object to processing based on legitimate interests, including direct marketing (an objection to direct marketing is always honoured); and withdraw consent at any time. To exercise these rights, email support@sophie-lila.com. We respond within one month. You may also lodge a complaint with the Information Commissioner's Office (ICO, ico.org.uk) or the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Security

We use appropriate technical and organisational measures, including encryption in transit (SSL/TLS) and access controls, to protect your data. No method of transmission is 100% secure; we cannot guarantee absolute security.

Changes to This Policy

We may update this policy from time to time. The current version is always available on this page; material changes will be indicated by an updated effective date.