Privacy Policy

Last updated: 16 September 2026

Who we are

Lucy&Lola Ltd (trading as Lucy & Lola), company number 13554307, registered office Unit 1, Copley Hill Business Park, Cambridge, England, CB22 3GN, is the data controller for the personal data described in this policy. This policy covers lucyandlolashop.com and the orders, emails and messages that come through it.

Questions or requests about your data: hello@lucyandlolashop.com, or write to us at the address above.

What we collect and why

When you place an order. Your name, email address, phone number, billing and delivery address, the products you ordered, and the photo or photos of your pet that you upload. We use these to design your portrait, make and deliver your order, take payment, send you your proof and order updates, and deal with any questions or problems. Legal basis: performing our contract with you. Payment card details are handled by our payment providers and never stored by us.

Your pet photo. The photo you upload is used to design your portrait. It is seen by the members of our design team who work on your order. We keep it with your order record so that we can handle reorders, remakes and queries. We do not use it in marketing unless you have given us permission (see below).

When you contact us. Your name, contact details, order number and whatever you tell us, so that we can help. Legal basis: performing our contract, or our legitimate interest in running a customer service that works.

When you join our mailing list or enter a prize draw. Your email address and, if you give it, your name. We send you marketing emails only if you have opted in, and you can unsubscribe from any email at any time. Prize draw entries are used to run the draw and contact the winner, under the draw's own terms. Legal basis: consent for marketing; performing the draw contract for entries.

When you browse. Device and browser type, IP address, pages viewed, how you arrived at the site and how you use it, collected through cookies and similar technologies. We use this to make the site work, to understand how it is used and to measure and improve our advertising. Legal basis: strictly necessary cookies run on our legitimate interest in operating the site; all other cookies run only with your consent, which you can give or withdraw through the cookie banner.

When you leave a review or send us a photo of your finished piece. Your name as you give it, the review text and any photo. Reviews are published on our site and through our review platform under their terms. We use customer photos in our marketing only where you have given permission, for example by ticking the option when you upload, tagging us on social media, or replying yes to a request from us. You can withdraw that permission at any time by emailing us.

Who we share it with

We share personal data only with the companies that help us run the business, and only what they need:

• Shopify, which hosts our store and processes orders and payments (Shopify's privacy policy: https://www.shopify.com/legal/privacy)
• Our payment providers (Shopify Payments, PayPal, and Shop Pay, Apple Pay and Google Pay where you choose them)
• [INTERNATIONAL CHECKOUT PROVIDER, e.g. Global-e], which acts as merchant of record for orders shipped outside the UK and handles duties, taxes and payment for those orders
• Our design team, including contractors outside the UK, who see your photo and first name to design your portrait
• Delivery carriers (Royal Mail, DPD, DHL, FedEx) who receive your name, address and contact details to deliver your order
• Our email platform (Klaviyo) for order updates and, where you have opted in, marketing emails
• Our review platform ([REVIEW APP NAME]) and Trustpilot, for review requests and published reviews
• Our customer service platform ([CS PLATFORM NAME]) for handling enquiries
• Analytics and advertising providers (Google, Meta, TikTok) where you have consented to their cookies

We may also share data where the law requires it, to protect our legal rights, or to prevent fraud. We do not sell personal data.

International transfers

Your order data is stored by Shopify, whose servers are in Canada and the United States, under the UK's adequacy arrangements and Shopify's data protection terms. We do not transfer other personal data outside the UK except through the providers listed above under their own safeguards.

How long we keep it

• Order records, including your photo and proof: 6 years after the order, for tax and accounting purposes and so we can handle remakes and reorders. Your photo and proof can be deleted earlier on request once the order is complete.
• Customer service messages: 2 years after the last contact.
• Mailing list data: until you unsubscribe or ask us to delete it, or 2 years after you last opened or clicked one of our emails.
• Prize draw entries: 6 months after the draw closes, unless you also opted into marketing.
• Analytics and advertising data: for the periods set by the cookie in question, shown in the cookie banner.

Your rights

Under UK GDPR you have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent at any time where consent is the basis. Email hello@lucyandlolashop.com and we will respond within one month. There is no charge.

If you are unhappy with how we handle your data or your request, you can complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113.

If you are in the European Economic Area, you have equivalent rights under the EU GDPR and may complain to your local supervisory authority. If you are in California, you have the rights set out in the CCPA, including the right to know and to delete, and can exercise them by contacting us.

Automated decisions

We do not make decisions about you using fully automated processing that has a legal or similarly significant effect. Shopify runs automated fraud screening on orders, which may decline a transaction; if that happens you can contact us.

Children

Our site and products are for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

Cookies

Strictly necessary cookies (cart, checkout, session, security) are set without consent because the site cannot work without them. Analytics, advertising and social media cookies are set only if you accept them in the cookie banner, and you can change your choice at any time using the cookie settings link in the footer. A full list of the cookies we use, with their purpose and duration, is shown in the banner's settings panel. Blocking cookies in your browser may stop parts of the site working.

Changes

We will update this policy when our practices change and show the date at the top. Significant changes will be flagged on the site.