Privacy policy

Privacy Policy

This Privacy Policy explains how Varielio collects, uses, stores and shares personal information when you visit our website, create an account, place an order, contact our customer service team or otherwise use our services.

1. Data Controller

For the processing activities described in this Privacy Policy, the data controller is:

Varielio
Responsible Person: Niamh Bailey

E-mail: contact@varielio.shop
Telephone: +44 7700 135707
Address: 2 The Lks, Northampton, NN4 7YD, United Kingdom

2. Personal Information We Collect

Depending on how you interact with our website, we may collect the following categories of personal information:

first and last name;
billing and delivery address;
e-mail address and telephone number;
information relating to orders, returns and refunds;
certain information necessary to process payments;
messages and requests sent to our customer service team;
customer account information;
IP address, browser, device and operating system information;
pages visited, products viewed and interactions with our website;
preferences relating to marketing communications and cookies.

We do not directly store complete payment card details. Such information is processed by our payment service providers.

3. How We Collect Personal Information

We may collect your personal information:

directly from you when you place an order, create an account, complete a form or contact us;
automatically when you use our website, including through cookies and similar technologies;
from service providers such as payment providers, delivery providers, analytics providers or fraud-prevention services where necessary.

4. How We Use Personal Information

We use personal information to:

process, prepare and deliver orders;
manage payments, returns, exchanges and refunds;
send order confirmations and information relating to your purchases;
respond to questions and customer service requests;
create and manage customer accounts;
detect and prevent fraud, abuse and security incidents;
improve the operation, security and performance of our website;
analyse how our store and services are used;
personalise the user experience where permitted by applicable law;
send marketing communications where permitted by applicable law;
comply with legal, tax, accounting and regulatory obligations;
establish, exercise or defend our legal rights.

5. Lawful Bases for Processing

Where the UK GDPR applies, we process personal information on one or more appropriate lawful bases, which may include:

Performance of a contract: processing orders, payments, deliveries, returns and after-sales support;
Legal obligation: maintaining records and complying with applicable accounting, tax and regulatory requirements;
Legitimate interests: preventing fraud, maintaining website security, improving our services and protecting our legal rights, where those interests are not overridden by your rights and interests;
Consent: where consent is required for marketing communications, certain cookies, advertising or other processing activities.

Where we rely on your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Marketing Communications

Where permitted by applicable law, we may send you information about our products, promotions and updates.

You can unsubscribe from marketing communications at any time by:

using the unsubscribe link included in our marketing e-mails;
contacting us at contact@varielio.shop.

Transactional communications necessary to process and manage your order are not marketing communications and may continue to be sent where necessary.

7. Cookies and Similar Technologies

Our website may use cookies and similar technologies to:

enable the operation of the shopping cart and checkout;
remember preferences;
maintain website security;
measure traffic and performance;
personalise content and advertising where permitted and, where required, where you have provided consent.

Strictly necessary cookies may be used where they are essential for providing the website or services you request. Optional cookies and similar technologies, including certain analytics or advertising technologies, will be used in accordance with applicable UK privacy and electronic communications requirements.

You can manage your cookie preferences through the cookie management tools available on our website where provided. You can also configure your browser to restrict or delete cookies, although doing so may affect certain website functionality.

8. Sharing Personal Information

Where necessary, personal information may be shared with:

e-commerce and hosting platforms;
payment service providers;
logistics partners and delivery carriers;
IT, hosting and cybersecurity service providers;
customer service technology providers;
analytics, advertising and marketing providers where permitted by applicable law;
legal, accounting and professional advisers;
government, regulatory, judicial or law-enforcement authorities where disclosure is required or permitted by law.

These parties may process personal information only for the purposes for which it has been provided to them or in accordance with their own applicable legal obligations.

We do not sell your personal information in exchange for monetary payment.

9. Shopify Platform

Our online store is hosted using the Shopify platform. Shopify may process certain personal information necessary to host and operate the store, provide shopping-cart and checkout functionality, process orders and provide its services.

Depending on the Shopify services and functionality used by our store, Shopify may process information in accordance with its applicable terms and privacy documentation.

10. Payments

Payments are processed through specialised payment service providers. Information necessary to process a payment is transmitted to the relevant provider using appropriate technical safeguards.

Varielio generally receives and retains only payment confirmation and limited transaction information, such as the payment method, transaction status and a payment reference.

11. International Transfers of Personal Information

Some of our service providers may process personal information outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we will rely on an appropriate transfer mechanism, which may include UK adequacy regulations, appropriate contractual safeguards or another mechanism permitted under applicable UK data protection law.

You may contact us if you would like further information about the safeguards applicable to international transfers of your personal information.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and to comply with applicable legal requirements.

In general:

order and transaction records may be retained for the period required by applicable accounting and tax obligations;
customer account information may be retained while the account remains active and subsequently where retention is reasonably necessary;
customer service communications may be retained for the period necessary to manage the request and protect our legal rights;
information processed for marketing purposes may be retained until you withdraw consent, object where applicable, unsubscribe, or for another period permitted by applicable law;
cookies and similar technologies are retained for periods appropriate to their purpose and applicable legal requirements.

When applicable retention periods expire, personal information may be deleted, anonymised or securely archived where continued retention is required by law.

13. Data Security

We use reasonable technical and organisational measures designed to protect personal information against:

unauthorised access;
loss or destruction;
unauthorised alteration;
accidental disclosure;
unlawful use.

No information system or method of electronic transmission can guarantee absolute security. We therefore recommend using a strong and unique password and never sharing your account credentials with others.

14. Your Data Protection Rights

Subject to applicable conditions and exemptions under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you may have rights including:

the right to access your personal information;
the right to request correction of inaccurate or incomplete personal information;
the right to request erasure of personal information in certain circumstances;
the right to request restriction of processing in certain circumstances;
the right to object to certain processing;
the right to data portability where applicable;
the right to withdraw consent at any time where processing is based on consent;
rights relating to certain decisions based solely on automated processing where applicable.

To exercise your rights, contact us at contact@varielio.shop and explain the nature of your request.

We may request additional information where reasonably necessary to verify your identity. We will respond within the time limits required by applicable law.

15. Complaints to the Supervisory Authority

If you have concerns about how we process your personal information, you have the right to raise a complaint with the relevant data protection supervisory authority.

In the United Kingdom, the supervisory authority is the Information Commissioner's Office (ICO).

We encourage you to contact us first so that we have an opportunity to investigate and, where possible, resolve your concerns.

16. Children's Personal Information

Our website is not intended for children who do not have the legal capacity required to independently enter into a purchase transaction.

We do not knowingly collect children's personal information in violation of applicable law. If you believe that a child has provided personal information to us without appropriate authorisation, please contact us so that we can take appropriate action.

17. Third-Party Links

Our website may contain links to websites or services operated by third parties. Varielio is not responsible for the privacy practices of those third parties.

We recommend reviewing the relevant privacy policies before providing personal information to third-party websites or services.