PRIVACY NOTICE
Lilli Rose is responsible for the customer information used to run this shop. Contact us at hello@lillirose.co.uk or write to:
Lilli Rose
Leet Hill House
Yarmouth Road
Kirby Cane
Bungay
Norfolk
NR35 2HJ
INFORMATION WE USE
When you order, we use the information you provide for payment, delivery and support, including your name, email address, delivery address, ordered items, quantities, totals and payment status. If you give a phone number to a service provider during checkout or contact us by phone, it may be used for that service or your enquiry.
Stripe collects and processes card details on its hosted checkout. The shop stores order and payment references and payment status, not your full card number or card security code. Stripe may process additional information for fraud prevention and its own legal obligations. See https://stripe.com/gb/privacy for its privacy information.
If you contact us, we use your message, contact details and any information needed to resolve your enquiry. Avoid sending unnecessary sensitive information.
Our hosting and security providers may process technical information such as IP address, browser details, requested pages and security logs to deliver and protect the website. Product images may be served by external image-hosting providers, which receive technical requests when those images load.
WHY WE USE INFORMATION
Orders, payment processing and delivery: to take steps at your request before a purchase and to perform our contract with you.
Accounting, tax records and responding to valid legal requests: to meet our legal obligations.
Customer enquiries: to respond to a purchase-related request or, for general enquiries, our legitimate interest in communicating with people who contact the business.
Fraud prevention, resolving disputes, protecting the shop and enforcing or defending legal claims: our legitimate interests in operating a secure business, balanced against your rights and expectations. Some checks may also be carried out by Stripe under its own obligations.
This website does not currently include an advertising pixel, Google Analytics integration or marketing mailing-list signup. We do not treat placing an order as consent to unrelated marketing. If we introduce optional marketing or non-essential tracking, we will update this notice and provide the choices required by law first.
WHO RECEIVES INFORMATION
Stripe receives information needed to process and secure payments. The website uses ChatGPT Sites and its infrastructure providers, including Cloudflare, to host the site and store shop records. Delivery and postal services receive the information necessary to deliver an order. Email providers process messages sent to and from our customer support address. Professional advisers or authorities may receive information where necessary for accounting, legal obligations or a dispute.
We do not pass orders from this independent checkout to Shopify. Links to Instagram, Facebook and other external websites take you to services with their own privacy practices.
BROWSER STORAGE AND COOKIES
The shop uses browser storage to remember your shopping bag and favourites on your device. It also uses temporary browser storage and an order reference to continue checkout and avoid removing paid items from your bag more than once. You can clear this storage in your browser settings; doing so may remove your saved bag or favourites.
Hosting, sign-in and security services may use cookies required to provide or protect their services. Stripe uses its own checkout and fraud-prevention technologies under its policies. The shop does not currently set optional advertising or analytics cookies itself.
INTERNATIONAL PROCESSING
Some service providers operate internationally and may process information outside the UK. Where a transfer requires safeguards under UK data protection law, the applicable transfer arrangements must protect that information. Provider privacy information explains their processing locations and safeguards. Contact us with questions about the providers used for your order.
HOW LONG RECORDS ARE KEPT
We retain order and payment records for the statutory accounting and tax recordkeeping periods that apply to the business, and longer only where needed for an unresolved complaint, dispute, legal claim or legal obligation. Enquiry records are kept for as long as needed to answer the enquiry and resolve any related follow-up. Security records are kept only as needed to investigate misuse and protect the service.
The retention period depends on the type of record, applicable recordkeeping duties, whether the issue is resolved and any period in which a legal claim may be brought. These criteria guide review, deletion or anonymisation; the website does not currently apply an automatic deletion schedule. You can ask which retention period applies to a particular record.
YOUR RIGHTS
Depending on the circumstances and lawful basis, you may have rights to access, correct or erase your information; restrict or object to its use; and receive or transfer information you provided in a portable form. In particular, you can object to processing based on our legitimate interests. Where consent is used, you can withdraw it without affecting processing that was lawful before withdrawal.
Contact hello@lillirose.co.uk to make a request. We may need proportionate information to verify your identity. We normally respond within one month; the law allows extensions in some cases. Some records may need to be retained despite an erasure request where a legal obligation or another exemption applies.
COMPLAINTS
Please contact us if you have a concern. You can also complain to the Information Commissioner's Office at https://ico.org.uk/make-a-complaint/.
Last updated: 24 October 2026
ANONYMOUS WEBSITE STATISTICS
We use independent daily totals of page views, shopping clicks, broad referral categories, device and browser types and countries solely to improve this website. We do not create visitor or session identifiers, store individual analytics events or IP addresses, or link browsing activity to orders. Analytics does not set cookies. Daily statistical totals are kept for up to one year. Open Privacy & analytics at the very bottom of any page and select Turn off anonymous analytics to object at any time. We remember only your on/off preference in browser storage; previous analytics refusals and supported browser privacy signals are respected. Sales reports use the separate order records described above.