Privacy policy

Last updated: March 10, 2026

At Lilly's Boutique, we respect your privacy and are committed to protecting your personal data. This Privacy Policy explains which personal data we collect, how we collect it, the purposes for which we use it, and the rights you have regarding your personal information.

1. Data Controller

Lilly's Boutique
Owner: D. de Man
Address: Oosterstraat 64, 9502EE, Stadskanaal, Netherlands
Email: support@lillys-boutique.com
Phone: +1 929 581 6052

Customer service hours:
Monday – Friday: 09:00 – 18:00
Saturday: 09:00 – 12:00
Sunday: Closed

Response time: Within 24 hours on working days.

2. What Personal Data Do We Collect?

When you visit our website or place an order, we may collect the following personal data:

  • First and last name

  • Billing and shipping address

  • Email address

  • Phone number

  • IP address

  • Order details and purchase history

  • Device and browser information

  • Marketing preferences and consent, where applicable

3. How Do We Collect Your Data?

We collect personal data in the following ways:

  • Directly, when you place an order, subscribe to our newsletter, or contact us via forms on our website

  • Automatically, through cookies and analytics tools such as Google Analytics

  • Via transactional and marketing emails, for example through Klaviyo, where consent has been given

4. For What Purposes Do We Use Your Data?

We use your personal data solely for the following purposes:

  • Processing and fulfilling orders

  • Communicating with you regarding your order (order confirmations, status updates, invoices)

  • Providing customer support

  • Sending newsletters and promotional offers, where you have given consent

  • Personalising your shopping experience

  • Analysing website performance and visitor statistics

  • Complying with legal and tax obligations

5. Legal Basis for Processing Personal Data

We process personal data on the basis of the following legal grounds:

  • Your consent, for example when subscribing to our newsletter or accepting cookies

  • Performance of a contract, such as placing and fulfilling an order

  • Legal obligations, including accounting and tax record retention requirements

  • Legitimate interests, such as analysing data to improve our services and website functionality

6. Who Has Access to Your Data?

Your data is stored securely within the Shopify system. Access is restricted to the store owner only.

In order to operate our webshop and provide our services, your personal data may be processed by the following parties:

  • Shopify – e-commerce platform

  • Google – analytics and advertising services

  • Klaviyo – email marketing services, where consent has been given

All third parties process personal data in accordance with the General Data Protection Regulation (GDPR).

7. Cookies

Our website uses cookies for the following purposes:

  • Ensuring the proper functioning of the webshop

  • Saving user preferences

  • Analysing website traffic (Google Analytics)

  • Marketing purposes, where consent has been given

When you visit our website for the first time, a cookie banner is displayed allowing you to accept or reject cookies.

8. Data Retention Period

We retain personal data for a maximum period of two years, unless a longer retention period is required by law.

9. Your Rights

You have the right to:

  • Access your personal data

  • Correct inaccurate or incomplete data

  • Request deletion of your data (“right to be forgotten”)

  • Withdraw your consent at any time

  • Restrict the processing of your data

  • Lodge a complaint with the competent data protection authority

To exercise any of these rights, please contact us at: support@lillys-boutique.com

10. Protection of Personal Data

Lilly's Boutique implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or unlawful disclosure.

All personal data is stored on secure servers provided by Shopify, which complies with the requirements of the General Data Protection Regulation (GDPR). Access to personal data is strictly limited to the store owner, and all communication is secured using encryption technologies.