Privacy policy

Privacy policy

Effective date: 16 September 2026

This Privacy Policy explains how Vestellum collects, uses, discloses and protects personal data when you visit vestellum.com, make a purchase, contact customer support or otherwise interact with the store.

Controller: Vestellum Holdings LLC
Trading name: Vestellum
Registered office: 2335 E. Atlantic Blvd. Ste 200, Pompano Beach, FL 33062, United States
Privacy contact: help@vestellum.com

Vestellum Holdings LLC is the controller of the personal data described in this policy.

1. Personal data collected

Depending on how you use the store, Vestellum may collect:

  1. Identity information, including your name.
  2. Contact information, including your email address, telephone number, billing address and delivery address.
  3. Order information, including products purchased, order value, currency, discounts, delivery status and refund history.
  4. Payment information, including payment status, payment method and limited card details supplied by the payment provider. Vestellum does not ordinarily receive your complete payment card number.
  5. Customer service information, including messages, photographs, complaints and refund requests.
  6. Device and technical information, including your IP address, browser type, device identifiers, operating system and approximate location.
  7. Usage information, including pages visited, links selected, referral sources, interactions, session information and shopping activity.
  8. Marketing information, including marketing preferences, consent records and interactions with emails or advertisements.
  9. Fraud and security information, including indicators used to identify suspicious transactions or misuse.
  10. Delivery and tracking information supplied by carriers, fulfilment providers and 17TRACK.

2. How personal data is collected

Personal data may be collected:

  1. Directly from you when you place an order, subscribe to marketing, contact support or submit a refund request.
  2. Automatically through cookies, pixels, tags and similar technologies.
  3. From Shopify, payment providers, delivery carriers, fraud-prevention services, advertising platforms and analytics providers.
  4. From the third-party supplier responsible for fulfilling and dispatching your order from China.

3. Purposes and lawful bases

Vestellum processes personal data for the following purposes and lawful bases under the UK GDPR:

  1. Contract: To process payments, confirm orders, arrange fulfilment, provide tracking, deliver products, handle cancellations and issue refunds.
  2. Legal obligation: To maintain accounting and transaction records, respond to lawful requests and comply with consumer, tax, fraud-prevention and regulatory requirements.
  3. Legitimate interests: To secure the store, prevent fraud, administer the business, improve customer support, establish or defend legal claims and understand store performance where those interests are not overridden by your rights.
  4. Consent: To send marketing where consent is required and to use non-essential cookies, advertising pixels and similar tracking technologies.
  5. Direct marketing permitted by law: In limited circumstances, Vestellum may contact existing customers about similar products where legally permitted and where an effective opt-out is provided.

Where processing relies on consent, you may withdraw that consent at any time without affecting processing completed before withdrawal.

4. How personal data is shared

Personal data may be disclosed to:

  1. Shopify and providers that host or support the ecommerce store.
  2. Payment processors, banks and card networks.
  3. The third-party supplier in China that prepares and dispatches products.
  4. Carriers, customs agents, delivery partners and 17TRACK.
  5. Meta, Google and TikTok when you consent to advertising or measurement technologies.
  6. Klaviyo for email marketing, consent records and campaign measurement.
  7. Fraud-prevention, security, information technology and customer-support providers.
  8. Accountants, insurers, legal advisers and other professional advisers.
  9. Government authorities, courts, regulators or law-enforcement bodies where disclosure is required or legally permitted.
  10. A purchaser, investor or successor in connection with a proposed or completed sale, merger, financing or reorganisation of the business.

Service providers may use personal data only as permitted by their contracts and applicable law. Some advertising and analytics providers may act as separate controllers for aspects of their processing.

Vestellum does not sell personal data for monetary payment.

5. International transfers

Vestellum Holdings LLC is established in the United States. Order fulfilment involves a supplier in China. Other providers may process information in the United States, the United Kingdom, the European Economic Area or other countries.

Where UK personal data is transferred internationally, Vestellum uses legally recognised safeguards where required, such as adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful transfer mechanism.

You may contact help@vestellum.com for information about the safeguards applicable to a particular transfer.

6. Cookies and similar technologies

Cookies are small files placed on a device. Pixels, tags and similar technologies may recognise a device, record interactions or transmit information to service providers.

Strictly necessary technologies support essential functions such as checkout, security, payment processing, basket contents and order management. Non-essential analytics, advertising and marketing technologies are used only after consent where required by the Privacy and Electronic Communications Regulations.

Vestellum uses the following tools:

  1. Meta Pixel: Measures interactions with the store, attributes sales and supports advertising and audience measurement on Meta services.
  2. Google Analytics 4: Provides aggregated and event-based information about visits, traffic sources, user interactions and store performance.
  3. TikTok Pixel: Measures interactions, attributes conversions and supports advertising and audience measurement on TikTok.
  4. Google Tags: Loads or manages Google measurement and advertising tags and records relevant website events according to your consent choices.
  5. 17TRACK: Provides shipment tracking and may process order numbers, tracking numbers, delivery events, device information and interactions with tracking pages.
  6. Klaviyo: Manages email subscriptions, marketing messages, consent records, customer segments and email engagement measurements.
  7. Shopify technologies: Support essential storefront, basket, checkout, security, fraud-prevention and preference functions.

7. How to refuse or withdraw consent

You can refuse non-essential cookies through the cookie consent controls displayed on the store. You can later change or withdraw consent through the available cookie settings.

You may also block or delete cookies through your browser. Blocking strictly necessary cookies may prevent checkout or other store functions from operating correctly.

You may unsubscribe from Klaviyo marketing emails by using the unsubscribe link in the message or by contacting help@vestellum.com.

Browser controls and provider settings may also limit advertising personalisation. Deleting cookies may remove an earlier opt-out choice, in which case you may need to set that choice again.

UK rules generally require clear information and consent before non-essential cookies or similar technologies are used. Further information is available from the Information Commissioner’s Office guidance on cookies.

8. Data retention

Vestellum retains personal data only for as long as reasonably necessary for the purposes described in this policy.

Order, payment, refund and tax records may be retained for up to seven years after the relevant transaction, unless a longer period is required by law or necessary for a legal claim. Customer-support records are retained for as long as necessary to resolve the matter and manage related legal obligations.

Marketing information is retained until you unsubscribe, withdraw consent or the information is no longer needed. Cookie and analytics retention periods vary according to the relevant provider and configuration.

When personal data is no longer required, it is deleted, anonymised or securely isolated, subject to applicable legal and technical requirements.

9. Your UK data protection rights

Subject to applicable conditions and exceptions, you may have the right to:

  1. Be informed about the processing of your personal data.
  2. Obtain access to your personal data.
  3. Correct inaccurate or incomplete data.
  4. Request deletion of personal data.
  5. Restrict processing.
  6. Receive certain personal data in a portable format.
  7. Object to processing based on legitimate interests.
  8. Object at any time to direct marketing.
  9. Withdraw consent at any time.
  10. Request safeguards where a decision with legal or similarly significant effects is made solely by automated means.

To exercise a right, email help@vestellum.com. Vestellum may request information reasonably necessary to verify your identity. A response will ordinarily be provided within one month, subject to any lawful extension.

You may complain to the UK Information Commissioner’s Office. Information about UK GDPR lawful bases and individual rights is available from the Information Commissioner’s Office.

10. Marketing

Vestellum may send marketing emails where you have consented or where another lawful basis permitted by UK law applies. Every marketing email will provide a way to unsubscribe.

Unsubscribing from marketing does not prevent service communications concerning an order, payment, delivery, refund, security issue or legal notice.

11. Security

Vestellum uses reasonable administrative, technical and organisational measures intended to protect personal data. No online transmission or storage system can be guaranteed to be completely secure.

12. Children

The store is not directed at children under 18. Vestellum does not knowingly collect personal data from a child for the purpose of permitting that child to make a purchase independently.

If you believe a child has provided personal data improperly, contact help@vestellum.com.

13. External websites

The store may contain links to external websites. Vestellum is not responsible for the privacy practices of websites or services that it does not control.

14. Changes to this policy

Vestellum may update this Privacy Policy to reflect operational, legal or regulatory changes. The updated version will be published on vestellum.com with a revised effective date.

15. Contact

Vestellum
Vestellum Holdings LLC
2335 E. Atlantic Blvd. Ste 200
Pompano Beach, FL 33062
United States
help@vestellum.com