Privacy policy
Last updated: 31 August 2026
1. Who we are
Jagoda Bąkowska, a sole trader trading as LALA BOUTIQUE (“LALA BOUTIQUE”, “we”, “us” or “our”), is the controller of the personal information described in this Privacy Policy.
Our contact details are:
Jagoda Bąkowska trading as LALA BOUTIQUE
12 Gate Close
Borehamwood
WD6 5DF
United Kingdom
Email: shop@lalaboutique.co.uk
Website: lalaboutique.co.uk
This Privacy Policy explains how we collect, use, disclose and retain personal information when you visit our website, place or attempt to place an order, contact us, subscribe to marketing, request a return or refund, or otherwise interact with us.
Shopify and certain other service providers may also process personal information as separate controllers for their own services. Their processing is governed by their own privacy notices.
2. Personal information we collect
Information you provide to us
Depending on how you interact with us, we may collect:
- your name;
- billing and delivery address;
- email address and telephone number;
- account login and profile information, if customer accounts are enabled;
- products ordered, size, colour, quantity and order history;
- delivery instructions;
- refund, return and complaint information;
- messages, photographs and other information you send to customer support;
- newsletter subscription and marketing preferences;
- reviews, photographs, blog comments or other content you choose to submit, where these features are available; and
- any other information you choose to provide.
Please do not send us special category information, such as health information, unless it is genuinely necessary for us to deal with your request. We do not intentionally request this type of information.
Payment and transaction information
Payments are processed by Shopify Payments and its payment-processing and banking partners.
We generally do not receive or store your complete payment-card number. We may receive transaction information such as the payment method, payment status, billing details, limited card information, fraud indicators and refund information.
Information collected automatically
When you use our website, Shopify and authorised technologies may collect:
- IP address and approximate location;
- browser, device and operating-system information;
- device or cookie identifiers;
- pages viewed, products searched for or added to a basket;
- referring website and interaction information;
- checkout and transaction events;
- security, diagnostic and server-log information; and
- cookie and consent preferences.
We use non-essential analytics, advertising or similar technologies only after obtaining consent where required. Please see our Cookie Policy.
Information received from other sources
We may receive information from:
- Shopify and Shopify Payments;
- payment providers and financial institutions;
- Evri and other delivery or fulfilment providers;
- fraud-prevention and security providers;
- email, marketing and customer-support providers;
- social-media platforms when you contact us through them;
- a purchaser who gives us another recipient’s details for delivery; and
- public authorities, professional advisers or other persons where permitted by law.
We do not buy customer mailing lists.
3. Information required to purchase from us
Identity, contact, delivery, order and payment information is required to enter into and perform a contract with you. Certain transaction information must also be retained to comply with tax, accounting and consumer-protection law.
If you do not provide information required at checkout, we may be unable to accept, process or deliver your order.
Providing information for marketing, optional cookies, reviews or surveys is voluntary and is not required to make a purchase.
4. How we use personal information and our lawful bases
| Purpose | Information normally used | Lawful basis |
|---|---|---|
| Responding to a product or pre-purchase enquiry | Identity, contact and message information | Steps requested before a contract, or our legitimate interest in responding to customers |
| Accepting payment, processing an order, delivering goods and giving order updates | Identity, contact, delivery, order, payment-status and transaction information | Performance of our contract with you |
| Managing cancellations, returns, refunds, faulty goods and customer support | Identity, contact, order, payment, communications and evidence about the issue | Contract, legal obligation and our legitimate interest in managing and evidencing customer service |
| Keeping accounting, tax and transaction records | Order, invoice, payment, refund and identity information | Legal obligation |
| Preventing fraud, misuse and security incidents | Transaction, device, technical, payment-status, fraud and account information | Our legitimate interests in protecting customers, our business and the website; sometimes legal obligation |
| Maintaining and improving the secure and reliable operation of the website | Technical, device, diagnostic and security-log information | Our legitimate interest in operating and protecting our store |
| Establishing, exercising or defending legal claims | Order, payment, delivery, communications and complaint information | Our legitimate interest in protecting our legal rights |
| Handling data-protection rights requests and complaints | Identity, contact, request, verification and correspondence information | Legal obligation and our legitimate interest in retaining an appropriate record |
| Sending newsletters and promotional emails you requested | Name, email address, consent record and marketing preferences | Consent |
| Using optional analytics, advertising or personalisation technologies | Cookie identifiers, device, usage and interaction information | Consent |
| Recording cookie and marketing choices and honouring opt-outs | Preference, consent and suppression information | Legal obligation and our legitimate interest in demonstrating and respecting your choices |
Where we rely on legitimate interests, those interests include operating a secure and efficient store, preventing fraud and loss, responding to customers, maintaining appropriate business records and protecting or enforcing legal rights. We consider whether our interests are proportionate and whether your rights override them.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before consent was withdrawn.
5. Marketing
We send promotional emails only where you have taken a positive action to subscribe.
You can unsubscribe at any time by selecting the unsubscribe link in any marketing email or emailing shop@lalaboutique.co.uk.
Unsubscribing from marketing will not prevent us from sending service messages necessary for an existing order, refund, product-safety notice or customer-support request.
We may retain a minimal suppression record after you unsubscribe so that we can honour your choice and avoid sending marketing to you again.
We do not sell personal information or mailing lists.
6. Cookies and similar technologies
We use cookies, pixels, local storage and similar technologies. Strictly necessary technologies support functions such as security, basket contents, checkout, consent preferences and Shop Pay login.
Optional analytics, advertising and personalisation technologies are not activated until you give the required consent. You can reject them or change your choice at any time using the Cookie preferences link in the website footer.
Further details are set out in our Cookie Policy.
Google Analytics 4
With your consent, we use Google Analytics 4 (“GA4”), a web analytics service provided by Google Ireland Limited, to understand how visitors use our store and to improve its content, navigation, performance and customer journey.
When analytics cookies are enabled, GA4 may collect or derive a pseudonymous client identifier and session identifier; the date and time of visits; pages, collections and products viewed; referring pages and campaign information; interactions with the store, including searches, basket, checkout and purchase events; transaction references, product information, quantities, currency and order value; browser, operating-system, device, screen and language information; and approximate location.
We do not intentionally send Google Analytics your name, email address, postal address, complete payment-card information or other information that directly identifies you. Google states that, for users in the United Kingdom, it uses an IP address to derive approximate location before discarding it and does not log or store the individual IP address.
GA4 uses first-party cookies _ga and _ga_FYRQK1F3DZ to distinguish pseudonymous visitors and maintain session state. We configure each cookie to last for up to 12 months after it is set or last refreshed during a consented visit. These cookies are not set or refreshed until you consent to analytics cookies. You can refuse or withdraw consent at any time through Cookie preferences. Withdrawing consent stops future analytics collection from your browser. Cookies already stored on your device may remain until they expire or you remove them through your browser settings.
For the standard Google Analytics service, Google Ireland Limited processes Analytics data on our behalf under Google's data-processing terms. We configure user-level and event-level Analytics data to be retained for 14 months and do not reset that period when a user returns. Aggregated statistical reports that no longer identify an individual may be retained for longer.
We do not currently use Google Signals, User-ID, advertising personalisation, enhanced conversions or Google Analytics audience sharing with advertising services.
Further information is available at How Google uses information from sites or apps that use its services.
7. Who we share personal information with
We share only information reasonably required for the relevant purpose. Recipients may include:
- Shopify International Limited and Shopify group companies, which provide our ecommerce platform, hosting, checkout, order-management and related services;
- Shopify Payments, its payment processors, banking partners and card networks, which process payments, refunds and payment security;
- Evri, which delivers orders and assists with delivery enquiries and claims;
- providers of email, marketing, customer-support, IT, security and website services;
- analytics or advertising providers, only where the relevant service is active and the required consent was obtained;
- Google Ireland Limited and its affiliates and subprocessors, which provide Google Analytics 4 where analytics consent has been given;
- accountants, insurers, legal advisers and other professional advisers;
- HM Revenue & Customs, regulators, courts, law-enforcement bodies and other authorities where disclosure is required or permitted by law; and
- a prospective purchaser or successor if all or part of our business is sold or reorganised, subject to appropriate confidentiality and data-protection safeguards.
Service providers acting on our behalf may process personal information only for agreed purposes and under appropriate contractual and security requirements.
8. Shopify
Our store is hosted on Shopify. Shopify generally processes customer information on our instructions to provide the store, checkout and order-management services.
Shopify may also process some information for its own purposes as a separate controller, for example in connection with Shop, Shop Pay, fraud prevention, its consumer services or, where enabled, Shopify Network Intelligence and Enhanced Services.
You can read the Shopify Consumer Privacy Policy and use the Shopify privacy portal for processing for which Shopify is the controller.
9. International transfers
Some providers may process personal information outside the United Kingdom.
Shopify states that customer information for UK merchants is initially processed by Shopify International Limited in Ireland and may be processed by Shopify group companies and subprocessors in other locations, including Canada and the United States.
Where personal information is transferred outside the UK, we use a transfer permitted by UK data-protection law. Depending on the destination and provider, this may include:
- UK adequacy regulations;
- the UK International Data Transfer Agreement;
- the UK Addendum to the European Commission’s Standard Contractual Clauses; or
- another lawful mechanism together with any necessary risk assessment and supplementary safeguards.
Shopify's Data Processing Addendum incorporates international-transfer terms, including the UK Addendum where applicable.
Google Analytics is provided under contract by Google Ireland Limited. Google states that data from devices in the United Kingdom is initially collected through domains and servers in the United Kingdom or Europe before being forwarded to Analytics systems for processing. Google group companies and subprocessors may process information in other countries, including the United States.
Depending on the transfer, Google states that it uses safeguards that may include UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework and contractual protections approved for restricted transfers. Further information is available in Google's information about international data transfers.
You may contact shop@lalaboutique.co.uk for further information about safeguards relevant to a particular transfer or to request a copy of applicable contractual protections, subject to removal of confidential information.
10. How long we retain personal information
We retain information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and claims requirements.
Our normal retention periods are:
| Record | Normal retention |
|---|---|
| Orders, invoices, payments, deliveries, returns and refunds | Six years after the end of the relevant tax year, or after final resolution of a related dispute or claim if later |
| Complete payment-card details | We do not normally store them; payment providers apply their own periods |
| Abandoned checkout information | Up to 90 days, unless it becomes an order or is required for fraud prevention, reconciliation or a legal claim |
| Customer-support correspondence not required as part of an order record | Two years after the enquiry is closed |
| Customer-account profile | For the life of the account; inactive accounts are reviewed after 24 months. Order records are retained separately |
| Newsletter contact details | Until you unsubscribe, withdraw consent or have been inactive for 24 months |
| Marketing consent and suppression records | Consent evidence and a minimal suppression record may be kept for up to six years after the last marketing communication or as reasonably required to honour an opt-out |
| Routine security and technical logs | Normally up to 12 months |
| Security-incident or fraud-investigation records | Up to six years after closure where needed for legal claims |
| Data-protection requests and complaints | Normally three years after closure, or up to six years where a dispute or legal claim is reasonably anticipated |
| Cookie and similar-technology information | As specified in the Cookie Policy and cookie settings tool |
| Google Analytics user-level and event-level data | 14 months; the retention period is not reset when a visitor returns |
| Google Analytics cookies | Up to 12 months after the cookie is set or last refreshed during a consented visit, unless it expires sooner, is deleted by the user or is restricted by the browser |
| Aggregated Analytics reports that no longer identify an individual | For as long as reasonably required for business trend and performance analysis |
We may retain information longer where required by law, a regulator, court proceedings or an unresolved dispute. We may retain anonymised information that can no longer identify an individual.
When information is deleted from active systems, limited copies may remain temporarily in protected backups until they are overwritten. They are not used for ordinary business purposes during that period.
11. Security
We use appropriate technical and organisational measures designed to protect personal information. These include restricting access, using password and account-security controls, using secure ecommerce and payment providers and limiting information shared with service providers.
No internet transmission or storage system can be guaranteed to be completely secure. Please contact us promptly if you believe that an account or communication with us was compromised.
12. Automated decision-making and profiling
We do not currently make decisions about customers based solely on automated processing where the decision produces legal or similarly significant effects.
Shopify, payment providers and fraud-prevention providers may automatically assess transaction and device information to identify suspected fraud, and a payment may be declined, delayed or referred for review. Where a provider makes such decisions as a separate controller, its privacy notice and rights process apply.
Optional analytics and advertising technologies may create audience or interest profiles, but we activate them only after the required consent.
13. Your data-protection rights
Subject to legal conditions and exceptions, you may have the right to:
- request access to your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information;
- ask us to restrict processing;
- object to processing based on legitimate interests;
- object at any time to direct marketing;
- receive certain information you provided in a structured, commonly used and machine-readable format and ask us to transfer it where technically feasible;
- withdraw consent at any time;
- ask not to be subject to certain solely automated decisions; and
- complain about our processing.
To exercise a right, email shop@lalaboutique.co.uk or write to the address in section 1. Please describe your request and provide enough information for us to locate the relevant records.
We may ask for proportionate proof of identity. We normally respond within one month. Where the law permits an extension because a request is complex or numerous, we will explain this within the initial response period. Rights are not absolute, and we will explain if an exemption or restriction applies.
There is normally no fee. A fee may be charged, or a request refused, only where the law permits this, for example if a request is manifestly unfounded or excessive.
14. Data-protection complaints
You can make a data-protection complaint by emailing shop@lalaboutique.co.uk with the subject line “Data protection complaint”, or by writing to our postal address.
Please explain what happened, which information is involved and what outcome you seek. Do not send more personal information than necessary.
We will:
- acknowledge receipt of your complaint within 30 days;
- investigate it fairly and without undue delay;
- take appropriate steps to respond and keep you informed of progress; and
- tell you the outcome without undue delay.
You may also complain to:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: Make a complaint about how an organisation has used your personal information
Your right to contact the ICO is not affected by making, or not making, a complaint to us first.
15. Children
Customers must be at least 18 years old to enter into a purchase contract with us. A person under 18 should purchase through, and with the involvement of, a parent or legal guardian.
Our website and marketing are not directed at children under 13, and we do not knowingly collect their information for marketing. If you believe a child provided personal information inappropriately, please contact us.
16. Third-party websites and social media
Our website may contain links to third-party websites or social-media services. Those organisations control their own processing and privacy practices. Please review their privacy notices before giving them personal information.
A link to a social-media page does not by itself mean that we receive information about your activity on that platform.
17. Changes to this Privacy Policy
We review this Privacy Policy regularly and may update it when our services, providers or legal obligations change.
The current version and its “Last updated” date will be published on the website. If a change materially affects how we use existing personal information, we will take reasonable steps to bring it to your attention before beginning the new processing where required.
18. Contact us
For privacy questions, rights requests or complaints, contact:
Jagoda Bąkowska trading as LALA BOUTIQUE
12 Gate Close
Borehamwood
WD6 5DF
United Kingdom
Email: shop@lalaboutique.co.uk