Privacy Policy

Last updated: October 5, 2026

Lumelle is a trading name of Oakshott Innovations Ltd.

Lumelle operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the “Services”).

Lumelle is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy explains how Oakshott Innovations Ltd, trading as Lumelle (“Lumelle”, “we”, “us” or “our”), collects, uses, stores and discloses your personal information when you visit or use our website, make a purchase or other transaction, subscribe to our communications, interact with our SMS, MMS or RCS messaging programme, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls in relation to the collection, processing and disclosure of personal information.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood this Privacy Policy.

Personal Information We Collect or Process

When we use the term “personal information”, we mean information that identifies you or can reasonably be linked to you.

Personal information does not include information that has been anonymised or de-identified so that it can no longer reasonably identify you.

Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process the following categories of personal information:

• Contact details, including your name, postal address, billing address, shipping address, telephone number and email address.
• Financial information, including payment information, transaction details, payment method and payment confirmation. Payment information may be processed directly by our payment providers rather than stored by us.
• Account information, including your username, password, preferences and settings.
• Transaction and shopping information, including products you view, place in your basket, add to your wishlist, purchase, return, exchange or cancel, as well as your previous transactions.
• Marketing information, including whether you have subscribed to email, SMS, MMS or RCS marketing, your marketing preferences, opt-in records and consent information.
• Communications with us, including information you provide when contacting customer support or otherwise communicating with us.
• Device information, including information about your device, browser, internet connection, IP address and other identifiers.
• Usage information, including information about how and when you interact with or navigate the Services.
• Cookie and tracking information, including information collected through cookies, pixels, plugins and similar technologies.

Personal Information Sources

We may collect personal information from the following sources:

• Directly from you, including when you create an account, use the Services, place an order, subscribe to communications, enter information into our website, communicate with us or otherwise provide personal information.
• Automatically through the Services, including from your device when you use our website and through cookies, pixels, plugins and similar technologies.
• From Shopify and other service providers that collect or process personal information on our behalf.
• From payment processors, fulfilment providers, delivery providers, analytics providers, marketing platforms and communications providers.
• From business partners or other third parties where permitted by applicable law.

How We Use Your Personal Information

Depending on how you interact with us and which Services you use, we may use your personal information for the purposes described below.

Providing and Improving the Services

We may use your personal information to:

• Process payments
• Process and fulfil orders
• Arrange shipping and delivery
• Process returns, exchanges and refunds
• Remember your preferences
• Maintain your account
• Provide customer support
• Send account and order notifications
• Recommend products
• Personalise your shopping experience
• Improve our products, website and Services
• Analyse how customers use our website
• Detect and resolve technical issues

Marketing and Advertising

We may use your personal information for marketing and promotional purposes, including sending communications by:

• Email
• SMS
• MMS
• RCS
• Postal mail

We may use information about products you have viewed, purchased, placed in your basket or otherwise interacted with to personalise marketing and advertising.

We may also use personal information to show advertisements for our products or services on our website, social media platforms or other websites.

Where consent is required by applicable law, we will only send electronic marketing communications where you have provided the appropriate consent.

You can withdraw your consent or unsubscribe from marketing communications at any time using the methods described in this Privacy Policy.

SMS, MMS and RCS Messaging Privacy

If you provide your mobile telephone number and consent to receive SMS, MMS or RCS communications from Lumelle, we may use your telephone number and related information to send marketing, promotional and service-related messages.

These messages may include:

• Product announcements
• Discounts and special offers
• Abandoned basket reminders
• Back-in-stock notifications
• Product recommendations
• Order updates
• Delivery notifications
• Customer service messages
• Promotional campaigns
• Other transactional or marketing communications you have consented to receive

Consent to receive marketing messages is not a condition of purchase.

Message frequency may vary.

Message and data rates may apply depending on your mobile network provider and plan.

Abandoned Basket and Cart Reminder Messages

Our website uses cookies, plugins and similar technologies to help keep track of products that you view or add to your shopping basket, including when a basket or checkout has been abandoned.

This information may be used to determine whether a shopping basket has been abandoned and, where you have provided the appropriate consent, to determine when to send an abandoned basket or checkout reminder by SMS, MMS or RCS.

For example, information relating to your shopping session, basket contents, checkout activity, telephone number and marketing consent may be processed for the purpose of providing these reminders.

We will only send marketing-related abandoned basket messages where permitted by applicable law and where any required consent has been obtained.

SMS and Messaging Data Sharing

Notwithstanding any other provision of this Privacy Policy concerning the disclosure or sharing of personal information, text messaging originator opt-in data and consent will not be sold, rented or shared with non-affiliated third parties for their own marketing or promotional purposes.

This restriction includes your mobile number when it forms part of your SMS, MMS or RCS marketing opt-in information.

We may, however, share or make this information available to service providers that process information on our behalf where necessary to operate our messaging programme.

These service providers may include:

• Messaging platforms
• SMS, MMS and RCS providers
• Telecommunications providers
• Technology providers
• Customer relationship management providers
• Shopify applications and plugins used to provide messaging functionality

Such service providers may process your information only as necessary to provide services to Lumelle and not for their own independent marketing or promotional purposes.

Opting Out of Messaging

You may withdraw your consent to receive marketing messages at any time.

Where supported, you may reply STOP to unsubscribe from SMS marketing.

Where replying STOP is unavailable, including in certain RCS messaging experiences, you may use the unsubscribe functionality provided within the message.

For assistance with our messaging programme, where supported you may reply HELP, or contact us at:

support@lumellebeauty.co.uk

We may continue to send non-promotional communications that are necessary to fulfil an order, provide customer support, provide delivery information, issue important service notifications or otherwise perform a contract with you.

Security and Fraud Prevention

We may use personal information to:

• Authenticate accounts
• Protect customer accounts
• Provide a secure shopping experience
• Detect and prevent fraud
• Investigate suspected fraudulent or unlawful activity
• Protect our business, customers and Services
• Prevent misuse of our website or payment systems

Communicating With You

We may use your personal information to:

• Respond to enquiries
• Provide customer support
• Handle complaints
• Contact you regarding an order
• Resolve delivery or payment issues
• Maintain our business relationship with you

Legal Reasons

We may process or disclose personal information where necessary to:

• Comply with applicable laws or regulations
• Respond to valid legal processes
• Respond to lawful requests from authorities
• Investigate or defend legal claims
• Enforce our Terms of Service or other policies
• Protect our legal rights
• Protect the rights, property or safety of our customers or others

How We Disclose Personal Information

In certain circumstances, we may disclose personal information to third parties for legitimate business purposes and subject to applicable data protection law.

This may include:

• Shopify, which provides our ecommerce platform.
• Payment providers that process payments and prevent fraud.
• Fulfilment and delivery providers that help us fulfil and deliver orders.
• IT and cloud service providers that support our website and systems.
• Analytics providers that help us understand use of our website.
• Customer support providers that help us communicate with customers.
• Marketing and advertising providers where permitted by law.
• Messaging providers that enable SMS, MMS or RCS communications on our behalf.
• Business partners where necessary to provide a service requested by you.
• Third parties where you specifically direct or consent to the disclosure.
• Affiliates or companies within our corporate group.
• Parties involved in a merger, acquisition, restructuring, financing, sale of assets or similar corporate transaction.
• Government agencies, regulators, courts or law enforcement where disclosure is required by law.
• Other parties where necessary to protect our legal rights, customers or Services.

Text messaging originator opt-in data and consent are excluded from any disclosure to non-affiliated third parties for their own marketing or promotional purposes.

Service providers that operate our messaging programme may process this information on our behalf solely as necessary to provide those services.

Relationship With Shopify

The Services are hosted by Shopify.

Shopify collects and processes personal information relating to your access to and use of the Services in order to provide and improve Shopify's services.

Information that you submit through the Services may be transmitted to Shopify and other service providers, including organisations located outside the country in which you reside.

We may also use Shopify features that use information from your interactions with our store and other merchants to help protect, improve and grow our business.

In certain circumstances, Shopify may act as an independent controller of personal information it processes.

You can learn more about Shopify's privacy practices through Shopify's own privacy notices and privacy portal.

Cookies and Similar Technologies

We and our service providers may use cookies, pixels, plugins and similar technologies to:

• Operate our website
• Keep products in your shopping basket
• Identify when a basket or checkout has been abandoned
• Remember your preferences
• Keep you signed into your account
• Understand how customers use the Services
• Improve our website and products
• Measure the effectiveness of marketing
• Support advertising
• Prevent fraud
• Personalise content and communications
• Support abandoned basket email or text reminders where permitted

Some cookies and technologies are necessary for the operation of our website.

Other cookies may be used for analytics, personalisation or advertising where permitted by law.

Where required, we will request your consent before placing non-essential cookies or similar technologies.

You may be able to manage your preferences through our cookie consent tool or through your browser settings.

Disabling certain cookies may affect the functionality of parts of our website.

Location Information

We do not use precise location tracking as part of our SMS, MMS or RCS marketing programme unless this is specifically disclosed to you and, where required, you have provided consent.

We may process general location information derived from information such as your IP address, delivery address or device information where necessary to provide our Services, prevent fraud, determine applicable shipping options, provide relevant website experiences or comply with applicable law.

If we introduce a service that collects precise location information or uses location information to provide location-based marketing, we will update this Privacy Policy and provide any notice or obtain any consent required by applicable law.

Third-Party Websites and Links

The Services may contain links to websites or other online platforms operated by third parties.

If you follow a link to a website that is not operated or controlled by us, you should review that third party's privacy policy, security practices and terms.

We are not responsible for the privacy or security practices of third-party websites.

Information that you voluntarily disclose on public or semi-public platforms, including social media platforms, may be visible to other users.

Our inclusion of a third-party link does not necessarily mean that we endorse that third party or its services.

Children's Data

The Services are not intended for use by children.

We do not knowingly collect personal information from children under the age of majority applicable in their jurisdiction.

If you are a parent or guardian and believe that a child has provided personal information to us, please contact us using the details at the end of this Privacy Policy.

Where applicable, you may request that the information be deleted.

Security and Retention of Your Information

We take reasonable technical and organisational measures designed to protect personal information.

However, no method of transmission over the internet or electronic storage system is completely secure, and we cannot guarantee that information transmitted or stored electronically will never be accessed, altered, disclosed or destroyed without authorisation.

You should not use insecure communication channels to send highly sensitive or confidential information to us.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including where necessary to comply with legal, accounting or regulatory obligations.

Retention periods may depend on factors including:

• Whether you have an account with us
• Whether we need the information to provide the Services
• The nature of our relationship with you
• Legal and regulatory requirements
• Accounting and tax requirements
• Fraud prevention requirements
• Resolving disputes
• Enforcing agreements or policies
• Establishing, exercising or defending legal claims

Your Rights and Choices

Depending on where you live, you may have certain rights relating to your personal information.

These may include:

• Right of access – you may request access to personal information we hold about you.
• Right to deletion – you may request that certain personal information be deleted.
• Right to correction – you may request that inaccurate or incomplete personal information be corrected.
• Right to portability – in certain circumstances, you may request a copy of your information in a portable format.
• Right to object – in certain circumstances, you may object to particular types of processing, including direct marketing.
• Right to restrict processing – you may request that we limit how your information is used in certain circumstances.
• Right to withdraw consent – where processing is based on consent, you may withdraw that consent at any time.

These rights are not absolute and may be subject to exemptions or limitations under applicable law.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

Managing Communication Preferences

We may send promotional communications where permitted by law and where you have provided any consent required.

Email

You may unsubscribe from promotional emails at any time by using the unsubscribe link included in the email.

SMS, MMS and RCS

You may opt out of SMS marketing by replying STOP where supported.

For RCS or other messaging services where replying STOP is unavailable, you may use the unsubscribe functionality included within the message.

You can also contact us at:

support@lumellebeauty.co.uk

If you opt out of promotional communications, we may still send non-promotional messages relating to:

• Orders
• Deliveries
• Returns
• Refunds
• Your account
• Customer service enquiries
• Important service notices

Exercising Your Privacy Rights

You may exercise applicable privacy rights by contacting us using the contact details provided at the end of this Privacy Policy.

We may need to verify your identity before processing a request.

Where permitted by law, you may authorise another person to make a request on your behalf.

We will respond to valid requests within the timeframe required by applicable law.

Complaints

If you have a complaint about how we process your personal information, please contact us first using the details below.

If you are not satisfied with our response, you may have the right to lodge a complaint with the relevant data protection authority.

If you are located in the United Kingdom, the relevant regulator is generally the Information Commissioner's Office (ICO).

If you are located in the European Economic Area, you may contact the relevant data protection supervisory authority in your country.

International Transfers

We may transfer, store or process personal information outside the country in which you live.

Where personal information is transferred outside the United Kingdom or European Economic Area, we will use an appropriate lawful transfer mechanism where required.

This may include:

• UK adequacy regulations
• European Commission adequacy decisions
• Standard Contractual Clauses
• The UK International Data Transfer Agreement
• The UK Addendum to the EU Standard Contractual Clauses
• Other legally recognised transfer mechanisms

These measures are intended to ensure that personal information continues to receive an appropriate level of protection when transferred internationally.

Lawful Bases for Processing

Where UK or European data protection law applies, we rely on one or more lawful bases to process personal information.

Depending on the circumstances, these may include:

• Contract – where processing is necessary to fulfil an order or provide a service you have requested.
• Consent – where you have provided consent, including for certain marketing communications or cookies.
• Legitimate interests – where processing is necessary for our legitimate business interests and those interests are not overridden by your rights.
• Legal obligation – where processing is necessary to comply with applicable law.
• Legal claims – where processing is necessary to establish, exercise or defend legal rights.

Where we rely on consent, you may withdraw your consent at any time.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• Changes to our practices
• Changes to our Services
• Changes to applicable laws or regulations
• Changes to service providers
• New technologies or marketing channels
• Operational changes

When we update this Privacy Policy, we will publish the revised version on our website and update the “Last updated” date.

Where required by law, we may provide additional notice of material changes.

Contact

If you have questions about this Privacy Policy, our privacy practices, your personal information, or our SMS, MMS or RCS messaging programme, or if you would like to exercise any of your privacy rights, please contact us:

Oakshott Innovations Ltd trading as Lumelle

Email: support@lumellebeauty.co.uk

Website: https://lumellebeauty.co.uk

Postal address:
Office 5
Dainton Self Storage
Scorrier
Redruth
Cornwall
United Kingdom

For the purposes of applicable data protection law, Oakshott Innovations Ltd is the controller of the personal information described in this Privacy Policy.