Privacy Policy

Last updated: 16 September 2026

This Privacy Policy explains how Lilla collects, uses, shares and protects personal information when you visit wearlilla.com, contact us or purchase from us. It applies alongside our cookie settings and other notices displayed when information is collected.

1. Who controls your information

The data controller for wearlilla.com.

Business correspondence address: Via della Resistenza 12 Agrano, Verbano-Cusio-Ossola 28887 Italy

Email: support@wearlilla.com

Phone Number: + 44 20 39968191

The controller identified above is responsible for the personal information described in this policy, except where another organisation acts as an independent controller.

2. Information we collect

We may collect identity and contact information, including name, billing and delivery address, email address and telephone number. We process order information, product selections, transaction values, returns, refunds, customer-service correspondence and fraud-prevention indicators.

We also receive technical and usage information, such as IP address, device and browser data, cookie identifiers, pages viewed, interactions, approximate location, referral source and advertising attribution information. Payment providers process payment credentials; Lilla generally receives confirmation and limited transaction details rather than complete card data.

We collect information directly from you, automatically from your device, and from service providers such as Shopify, payment processors, carriers, fulfilment partners, analytics providers and advertising platforms.

3. Why we use information and our legal bases

We use personal information to accept payment, fulfil orders, deliver products, process returns and provide customer support because this is necessary to perform our contract with you.

We use information to keep accounting and transaction records, handle product-safety or tax obligations, respond to lawful requests and comply with other legal duties.

We use limited information for security, fraud prevention, service improvement, business administration and the establishment or defence of legal claims where this is necessary for our legitimate interests or those of another party, balanced against your rights.

We use consent for non-essential analytics or advertising technologies where consent is required. We also rely on consent for email marketing where required. You may withdraw consent at any time without affecting processing that occurred beforehand.

4. Shopify and payments

Our store is hosted by Shopify, which supplies the ecommerce platform and related services. Shopify and connected payment providers process information to host the store, secure transactions, take payment, prevent fraud and support checkout. Their handling of information is also governed by their applicable terms and privacy notices.

We do not receive or store complete payment-card credentials. Payment information is transmitted using the security measures provided by Shopify and the selected payment provider.

5. Suppliers, fulfilment partners and carriers

We share the minimum information needed to prepare and deliver an order with suppliers, warehouses, logistics providers and carriers. Because products may be fulfilled internationally, this can include recipients outside the United Kingdom and European Economic Area.

These providers receive information such as recipient name, delivery address, telephone number, order contents and customs information where necessary. They may act as processors for Lilla or as independent controllers for their own legal and operational duties.

6. Google Analytics and Google Ads

Subject to your cookie choices, we use Google Analytics and Google Ads technologies to understand store usage, measure advertising, attribute conversions, build audiences and improve campaigns. Google may receive identifiers, device and browser information, website interactions, approximate location and conversion information.

Where enhanced conversion measurement is enabled and legally permitted, selected first-party information may be transformed using a one-way hashing process before being sent to Google to improve conversion measurement. We do not intentionally send special-category information to Google for advertising.

Google may act as our processor or as an independent controller depending on the service and processing activity. Information may be combined with data Google receives from other services according to Google’s terms and privacy documentation.

Non-essential Google analytics and advertising technologies are not activated before consent where UK cookie law requires consent. You can refuse or withdraw consent through the cookie settings available from the store footer or cookie banner.

7. Cookies and similar technologies

Strictly necessary technologies support functions requested by you, such as security, cart contents and checkout. Other technologies support analytics, personalisation and advertising.

When you first visit, the cookie banner allows you to accept or reject non-essential categories. Continuing to browse does not, by itself, constitute consent. You can change your preference at any time by selecting the cookie preferences or privacy choices link in the website footer.

Browser controls can also block or remove cookies, although doing so may affect store functionality. Additional information about individual technologies, providers, purposes and durations is available through the store’s cookie settings.

8. Other recipients

We may share necessary information with professional advisers, hosting and security providers, customer-support and email providers, accounting services, regulators, courts, law-enforcement bodies and a purchaser or successor involved in a genuine business sale or restructuring.

We do not disclose personal information to unrelated parties merely for their own marketing in return for payment.

9. International transfers

Our service providers and fulfilment network may process information in countries outside the UK and European Economic Area. Where required, we use an applicable adequacy decision or regulation, approved contractual safeguards or another lawful transfer mechanism. You may contact us for more information about the safeguard relevant to a transfer.

10. Retention

We retain order, payment, tax and accounting records for the period required by applicable law. We retain customer-service, return, fraud-prevention and legal-claim information for as long as reasonably necessary for the relevant purpose and limitation period.

Marketing information is kept until consent is withdrawn, the address remains inactive for an appropriate period, or continued retention is no longer justified. Analytics retention follows the configured period in the relevant platform. We delete or anonymise information when it is no longer required, unless preservation is necessary for legal obligations or claims.

11. Your rights

Depending on applicable UK or European data-protection law, you may have rights to access, correct or erase personal information; restrict or object to processing; receive portable information; and withdraw consent.

You have the right to object to direct marketing at any time. Use the unsubscribe link in an email or contact support@wearlilla.com. You may also change advertising and analytics consent through the cookie settings.

We may need to verify your identity before fulfilling a request. Some rights are subject to legal exceptions, including obligations to retain transaction records.

You may complain to the UK Information Commissioner’s Office if the matter concerns UK data-protection law. Because the controller is based in Italy, you may also have the right to complain to the Garante per la protezione dei dati personali or another competent European authority. We encourage you to contact us first so that we can try to resolve the concern.

12. Security

We use reasonable organisational and technical measures designed to protect information against loss, misuse and unauthorised access, alteration or disclosure. No internet transmission or storage system can be guaranteed completely secure.

13. Children

The store is not directed at children who cannot lawfully enter a purchase contract. We do not knowingly collect personal information from children for behavioural advertising.

14. Changes

We may update this Privacy Policy when our operations, service providers or legal duties change. We will post the revised version with a new update date and provide additional notice where a material change requires it.
We use Google Ads Enhanced Conversions to measure the success of our advertising campaigns. When you make a purchase, we may securely share hashed, first-party data (such as your email address) with Google to help track and attribute sales.