Privacy Policy

Last updated: September 9, 2026

Cecilia & Grace SL operates this online store and website, including the related information, content, features, products and services offered through it (the “Services”).

Our store is powered by Shopify, which provides the ecommerce platform that enables us to offer the Services to you.

This Privacy Policy explains how Cecilia & Grace SL collects, uses and shares your personal information when you visit our website, make a purchase, interact with our Services or otherwise communicate with us.

If there is any conflict between our Terms of Service and this Privacy Policy regarding the collection, use or disclosure of personal information, this Privacy Policy will apply.

Personal Information We Collect

Depending on how you interact with our Services, we may collect or process the following categories of personal information:

• Contact information, including your name, email address, telephone number, billing address and shipping address.
• Order and transaction information, including products purchased, order history, returns, refunds, cancellations and transaction details.
• Payment information, including payment method, payment confirmation and related transaction information. Payment information may be processed directly by Shopify and third-party payment providers.
• Communications, including information you provide when contacting us for customer support or other enquiries.
• Device and technical information, including your IP address, browser type, device information, network connection and similar identifiers.
• Usage information, including information about how you browse, access and interact with our website and Services.
• Marketing information, including preferences relating to marketing communications and advertising where applicable.

Sources of Personal Information

We may collect personal information:

• directly from you when you place an order, contact us or otherwise provide information;
• automatically when you use our website, including through cookies and similar technologies;
• from Shopify and other service providers that help us operate our store;
• from payment, fulfillment, shipping, analytics, advertising and other business partners where permitted by applicable law.

How We Use Your Personal Information

We may use your personal information for the following purposes:

Providing our Services

We use personal information to:

• process and fulfill orders;
• process payments;
• arrange shipping and delivery;
• manage returns and refunds;
• communicate with you about your order;
• provide customer support;
• maintain and improve the functionality of our online store.

Where applicable, this processing is necessary to perform our contract with you.

Marketing and Advertising

Where permitted by applicable law, we may use personal information to:

• send promotional emails or marketing communications;
• measure the effectiveness of advertising;
• show advertisements that may be relevant to you;
• improve our marketing and customer experience.

Where consent is legally required, we will rely on your consent.

You may unsubscribe from promotional emails at any time using the unsubscribe link included in our communications.

Security and Fraud Prevention

We may process personal information to:

• detect and prevent fraudulent or suspicious transactions;
• protect our website and Services;
• maintain the security of customers and our business;
• investigate potentially illegal or malicious activity.

Communications

We use your information to respond to enquiries, provide support and communicate with you regarding purchases, deliveries, refunds and other customer service matters.

Legal Obligations

We may process personal information where necessary to:

• comply with applicable laws and regulations;
• respond to lawful requests from public authorities;
• establish, exercise or defend legal claims;
• enforce our Terms of Service and policies.

Legal Bases for Processing in the EEA and UK

If you are located in the European Economic Area or United Kingdom, we process personal information where one or more of the following legal bases apply:

• Performance of a contract, such as processing and delivering your order.
• Legal obligation, where processing is required by applicable law.
• Legitimate interests, including operating, securing and improving our business, provided those interests are not overridden by your rights.
• Consent, where you have given us permission for specific processing, such as certain marketing or non-essential tracking activities.

Shopify specifically notes that merchants operating in the EEA may need to include the legal basis for the purposes for which personal data is processed.

How We Share Personal Information

We may share personal information with third parties where necessary to operate our business and provide our Services.

These may include:

• Shopify, which hosts and powers our ecommerce store;
• payment processors;
• fulfillment and shipping partners;
• customer support providers;
• analytics and technology providers;
• advertising and marketing partners;
• professional advisers where necessary;
• public authorities where disclosure is legally required.

We may also disclose information in connection with a merger, acquisition, restructuring or other business transaction.

We do not disclose personal information for purposes unrelated to operating our business except where permitted or required by law.

Relationship with Shopify

Our store is hosted by Shopify.

Shopify collects and processes personal information relating to your access to and use of our Services in order to provide and improve the ecommerce platform.

Information you provide through our store may be transmitted to Shopify and other service providers, including providers located outside the country in which you live.

To learn more about Shopify’s privacy practices, you can review the Shopify Consumer Privacy Policy:

https://www.shopify.com/legal/privacy/app-users

You can also access Shopify’s privacy portal here:

https://privacy.shopify.com/en

Cookies and Similar Technologies

We and our service providers may use cookies and similar technologies to operate our website, remember preferences, understand how visitors use our Services, measure performance and, where permitted, support advertising and marketing activities.

Where required by applicable law, non-essential cookies and tracking technologies will only be used after appropriate consent has been obtained.

You can manage available privacy and cookie choices through the privacy controls provided on our website.

Targeted Advertising and Data Sharing Choices

Depending on where you live, you may have the right to opt out of certain uses or sharing of your personal information for targeted advertising.

Where available, you may exercise these rights using our data-sharing opt-out page:

https://ceciliaandgrace.com/pages/data-sharing-opt-out

Where required by applicable law, we also respect supported privacy preference signals such as Global Privacy Control.

Third-Party Websites and Services

Our website may contain links to websites, platforms or services operated by third parties.

We are not responsible for the privacy or security practices of third-party services. We recommend reviewing their privacy policies before providing them with personal information.

Children's Privacy

Our Services are not intended for children.

We do not knowingly collect personal information from children below the minimum age required under applicable law.

If you believe that a child has provided us with personal information, please contact us so that we can review and, where appropriate, delete that information.

Security

We take reasonable technical and organisational measures to protect personal information.

However, no method of transmission over the internet or electronic storage can be guaranteed to be completely secure.

For this reason, we recommend that you do not send sensitive or confidential information through unsecured communication channels.

Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention periods may depend on factors such as:

• our contractual relationship with you;
• legal and tax requirements;
• fraud prevention and security requirements;
• dispute resolution;
• legal claims and regulatory obligations.

Your Privacy Rights

Depending on your location and applicable law, you may have rights relating to your personal information, including:

• Right of access — request information about the personal data we hold about you.
• Right to correction — request correction of inaccurate or incomplete information.
• Right to deletion — request deletion of your personal information where applicable.
• Right to restriction — request that certain processing be restricted.
• Right to object — object to certain processing based on legitimate interests.
• Right to portability — request a portable copy of certain personal information.
• Right to withdraw consent — withdraw consent where processing is based on consent.
• Right to opt out of targeted advertising or certain data sharing, where applicable.

These rights are not absolute and may be subject to legal exceptions.

The GDPR requires controllers to provide information about the identity and contact details of the controller, processing purposes, legal bases, recipients and applicable rights.

Exercising Your Rights

To exercise your privacy rights, contact us at:

ecommerce.gribas@gmail.com

We may need to verify your identity before responding to certain requests.

We will respond within the time limits required by applicable law.

You will not be discriminated against for exercising your privacy rights.

Marketing Communications

You may opt out of promotional emails at any time using the unsubscribe link contained in our marketing communications.

Even if you unsubscribe from marketing messages, we may continue to send non-promotional communications relating to your orders, transactions, customer service requests or legal matters.

International Data Transfers

Your personal information may be transferred, stored or processed outside the country in which you live.

Where personal information is transferred outside the European Economic Area or United Kingdom, appropriate legal mechanisms may be used where required, including recognised adequacy decisions or Standard Contractual Clauses.

Complaints

If you have concerns about how we process your personal information, please contact us first at:

ecommerce.gribas@gmail.com

If you are located in the European Economic Area, you may also have the right to lodge a complaint with your local data protection authority.

A list of European supervisory authorities is available through the European Data Protection Board.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to our business, Services, legal requirements or privacy practices.

When we make changes, we will update the “Last updated” date shown at the beginning of this Privacy Policy.

Contact

For questions about this Privacy Policy, our privacy practices or requests relating to your personal information, contact:

Cecilia & Grace SL
Email: contact@ceciliaandgrace.com

For the purposes of applicable data protection laws, Cecilia & Grace SL is the data controller of the personal information described in this Privacy Policy.