Privacy policy

HH-HAQS LTD, a company registered in England and Wales under company number 16774162, trading as Su-luna, operates this store and website (the "Services"). We are the data controller for the personal information described below, and you can reach us at info@su-luna.com.

Su-luna is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

Personal information we collect

Depending on how you interact with the Services, we may collect or process:

  • Contact details including your name, billing address, shipping address, phone number and email address.
  • Payment information including payment card details, transaction details, form of payment and payment confirmation. We never see or store your full card number — that is handled by our payment provider.
  • Account information including your username, password, preferences and settings.
  • Transaction information including items you view, add to your cart, purchase, return, exchange or cancel, and your past orders and subscriptions.
  • Communications with us including anything you tell us by email, such as a question about your skin or an order.
  • Device information including your device, browser, network connection, IP address and other identifiers.
  • Usage information including how you navigate and interact with the Services, which may include a recording of your visit — see Cookies and tracking below.

We collect this directly from you, automatically through the Services and cookies, and from the service providers listed below.

Why we use it, and our lawful basis

UK GDPR requires us to have a lawful basis for everything we do with your information. These are ours:

  • To take and fulfil your order — process payment, arrange delivery, manage returns, manage a subscription, and keep you updated. Lawful basis: performance of a contract with you.
  • To answer you when you get in touch. Lawful basis: performance of a contract, or our legitimate interest in running a responsive business.
  • To keep accounting and tax records. Lawful basis: legal obligation (Companies Act 2006 and HMRC requirements).
  • To prevent fraud and keep the store secure. Lawful basis: our legitimate interest in protecting the business and our customers, and legal obligation.
  • To send you marketing emails. Lawful basis: your consent — or, if you have bought from us, our legitimate interest in telling you about similar products, which you can stop at any time. Every email has an unsubscribe link.
  • To understand how the site is used and to advertise — analytics, session recording and advertising cookies. Lawful basis: your consent, given through our cookie banner, which you can withdraw at any time.
  • To publish reviews you choose to leave. Lawful basis: your consent.

Who we share it with

We only share what each provider needs to do its job. None of them may use your information for their own purposes except where stated.

  • Shopify — runs the store, checkout and customer accounts. Receives order, account, device and usage data.
  • Shopify Payments — takes your payment. Receives payment and billing details.
  • Selfnamed — makes and ships your order. Receives your name, delivery address and order contents.
  • Delivery carriers — deliver your parcel. Receive your name, delivery address and contact details. The carrier is chosen by our fulfilment partner and may vary.
  • Klaviyo — sends our emails. Receives your name, email address and order history.
  • Appstle — manages subscriptions. Receives order and subscription details.
  • Loox — collects and displays reviews. Receives your name, email address and order details.
  • Meta (Facebook and Instagram) — advertising measurement and targeting. Receives device and usage data through cookies, with your consent.
  • Google (Analytics and Tag Manager) — site analytics. Receives device and usage data through cookies, with your consent.
  • Microsoft Clarity — session recording and heatmaps. Receives device and usage data and a recording of your visit, with your consent.

We may also disclose personal information where you ask us to, where the law requires it, or in connection with a business sale or restructuring.

Cookies and tracking

Cookies are small files stored on your device. We use them for two different things, and the difference matters.

Essential cookies keep the site working — your cart, your currency, your login, fraud prevention. These do not need your consent, because without them the store cannot function.

Non-essential cookies cover analytics, session recording and advertising. We only set these if you agree, through the banner shown when you first visit. You can change your mind at any time by reopening your cookie preferences, or by clearing cookies in your browser.

Please note that Microsoft Clarity records your visit. This includes mouse movement, clicks, scrolling and the content of the pages you look at, so we can see where the site is confusing. It is a recording of your session, not just a count of your visits. Recordings are used to improve the site and nothing else. If you would rather not be recorded, decline analytics cookies.

We also load fonts and code libraries from Google, jsDelivr and Cloudflare, which receive your IP address as a technical necessity of serving those files.

How long we keep it

  • Order and accounting records: six years after the end of the accounting period they relate to. We are legally required to keep these and cannot delete them on request.
  • Account and subscription information: for as long as you have an account, and then up to two years.
  • Marketing contact details: until you unsubscribe, and then only enough to make sure we do not email you again.
  • Customer service emails: up to three years.
  • Analytics and advertising data: as long as each provider's settings allow, which we review. We do not keep it indefinitely.

Security

No security measures are perfect, and information sent to us over the internet may not be secure in transit. Please do not send us sensitive or confidential information through unsecured channels. We never ask for your full card details by email.

Your rights

Under UK GDPR you have the right to:

  • Access the personal information we hold about you
  • Correct anything inaccurate
  • Delete it, where we do not have a legal reason to keep it
  • Receive a copy in a portable format, or have it transferred
  • Object to, or restrict, how we use it
  • Withdraw consent at any time, where we rely on consent — this does not affect anything done before you withdrew it
  • Opt out of marketing using the unsubscribe link in any email

Email info@su-luna.com and we will respond within one month, as the law requires. We may need to confirm who you are first. Exercising any of these rights costs nothing and we will never treat you differently for it.

Children

The Services are not intended for children, and we do not knowingly collect personal information about anyone under 16. If you are a parent or guardian and believe your child has given us their information, email us and we will delete it.

Where your information goes

Some of our providers are outside the UK.

  • Selfnamed is in the European Union, which the UK recognises as providing an adequate level of data protection.
  • Shopify, Klaviyo, Meta, Google, Microsoft, Loox and Appstle process data in the United States and elsewhere. These transfers rely on the UK extension to the EU–US Data Privacy Framework, or on the International Data Transfer Agreement or Addendum to the Standard Contractual Clauses, as applicable.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit will be transmitted to Shopify and to third parties that may be located in countries other than where you live. We also use certain Shopify enhanced features that draw on data from your interactions with our store, other merchants and Shopify itself. For those features Shopify is responsible for the processing of your personal information, including responding to requests about it. See the Shopify Consumer Privacy Policy at shopify.com/legal/privacy/app-users, and the Shopify privacy portal at privacy.shopify.com.

Links to other sites

The Services may link to websites operated by other people. We do not control them and are not responsible for their privacy practices. Please read their policies before giving them your information.

Complaints

If you are unhappy with how we have handled your personal information, please email info@su-luna.com first and give us the chance to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. You do not have to come to us first.

Changes

We may update this policy to reflect changes in how we work or in the law. The revised version will be posted here with a new date.

Contact

Email info@su-luna.com. Our full business details are on our contact information policy. For the purposes of UK data protection law, HH-HAQS LTD is the data controller of your personal information.