Privacy policy

Gleamira, trading as Gleamira, Bijltje 10, 2321 Hoogstraten, Belgium, is the data controller for the personal data described here. Company number 1015.418.962, VAT number BE1015.418.962.

For anything relating to your data, email info@gleamira.co.uk. We are not required to appoint a data protection officer, so your message goes straight to the people who run the shop.

This policy applies to gleamira.co.uk, to orders placed through it and to emails and messages you send us. It does not cover third-party sites we link to, such as social media, which have their own policies.

Order and account data

• Name, delivery address, billing address, email address and, if given, phone number.
• Order history, basket contents, discounts applied and order value.
• Payment confirmation and the last four digits and card type from Shopify. We never receive or store your full card number.
• Returns, refunds and guarantee claims.

Communication data

• Emails and messages you send us, and our replies.
• Reviews, photographs or videos you choose to submit.
• Newsletter subscription status and the date you gave consent.

Technical data

• IP address, browser and device type, and approximate region.
• Pages viewed, products opened and referring site, if you accept analytics cookies.
• Preferences stored in your browser, such as currency, language and basket contents.

We do not collect special category data such as health, religion or political views, and we ask you not to send it to us.

Most data comes directly from you when you order, create an account, subscribe or email us. Some is generated automatically as you browse, through cookies and similar technology described in our cookie policy. A small amount comes from our providers, for example a payment result from Shopify or a delivery status from the carrier.

• Taking payment, dispatching orders, handling returns and guarantee claims. Legal basis: performance of a contract with you.
• Answering questions and providing customer service. Legal basis: legitimate interest in running a shop people can rely on.
• Keeping accounting, VAT and invoice records. Legal basis: legal obligation.
• Preventing fraud and securing the site. Legal basis: legitimate interest in protecting our customers and our business.
• Understanding how the shop is used, through aggregated analytics. Legal basis: consent, given through the cookie banner.
• Sending marketing email about new products and offers. Legal basis: consent, or legitimate interest where you are an existing customer buying similar products. Withdrawable at any time.
• Publishing reviews and customer photographs. Legal basis: consent.

We only email you about products and offers if you asked us to, or if you have bought from us and we think a similar product is relevant. Every message has an unsubscribe link at the bottom, and one click is enough. You can also email us and we will remove you the same working day.

Unsubscribing from marketing does not stop service emails such as order confirmations, dispatch notices and refund confirmations, which are part of the contract.

Only the parties needed to run the shop, and only with the data they need. They act on our instructions and may not use your data for their own purposes. We never sell your data and we never share it for someone else's advertising.

• Shopify, which powers the store and processes payments.
• Delivery carriers, which receive the name, address and contact details needed to deliver your parcel.
• Our email provider, for order emails and the newsletter.
• Our analytics provider, if you accepted analytics cookies.
• Our accountant and, where required, tax authorities, for invoice and VAT records.

We may also disclose data if the law requires it, to enforce our terms, or if the business is sold, in which case the buyer takes on the obligations in this policy.

Some providers store data outside the European Economic Area, for example in the United States. Where that happens, the transfer is covered by an adequacy decision, by standard contractual clauses approved by the European Commission, or by an equivalent safeguard. You can email us for details of the safeguard used by a particular provider.

• Order and invoice records: seven years, to meet accounting and VAT rules.
• Customer service emails: two years after the conversation ends.
• Newsletter subscription: until you unsubscribe, then a suppression record so we do not email you again.
• Account data: until you ask us to close the account.
• Analytics data: up to twenty-six months, in aggregated form.

When a period ends we delete the data or anonymise it so it can no longer identify you.

The site runs over HTTPS. Access to order data is limited to the people who need it and is protected by individual accounts with two-factor authentication. Payment data is handled entirely by Shopify on PCI-compliant infrastructure. If a breach ever put your rights at risk, we would tell you and the supervisory authority without undue delay.

• Access. Ask for a copy of the data we hold about you.
• Rectification. Have inaccurate or incomplete data corrected.
• Erasure. Ask us to delete data we no longer need, subject to records we must keep by law.
• Restriction. Ask us to pause processing while a question is resolved.
• Objection. Object to processing based on legitimate interest, including direct marketing.
• Portability. Receive your data in a common, machine-readable format.
• Withdraw consent. At any time, without affecting processing already carried out.

Email info@gleamira.co.uk and we will respond within one month. Exercising these rights is free; we only charge if a request is clearly unfounded or repetitive. We may ask a question to confirm your identity before we release data.

We do not make decisions about you by automated means that produce a legal or similarly significant effect. Our payment provider runs automated fraud checks on transactions; if a payment is declined on that basis you can contact us and a person will look at it.

Our shop is intended for adults. We do not knowingly collect data from anyone under sixteen. If you believe a child has given us data, email us and we will delete it.

Cookies and browser storage are described in detail in our cookie policy, including what each one does, how long it lasts and how to switch the optional ones off.

If you are unhappy with how we handle your data, tell us first and we will try to put it right. You also have the right to complain to the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels, gegevensbeschermingsautoriteit.be. If you live elsewhere, you may complain to the supervisory authority in your own country, such as the Information Commissioner's Office in the UK.

We update this policy when our processes or the law change. The date at the top of the page shows when it last changed. If a change materially affects how we use your data, we will tell you by email or with a notice on the site.