Privacy Policy

1. Controller identity

The controller of your personal data is Velimira Designs LLC, registered at 5900 Balcones Dr STE 100, Austin, TX 78731, USA.

For all privacy-specific correspondence — including data-subject requests under the GDPR, the UK GDPR, the CCPA/CPRA, Quebec Law 25, or the Australian Privacy Act — please use privacy@velimiradesigns.com. This inbox is distinct from our general support channel and is staffed by the person responsible for privacy requests.

For non-privacy questions, our general contact is mail@velimiradesigns.com.

We are not required to appoint a Data Protection Officer under Article 37 of the GDPR or the UK GDPR: we are not a public authority, our core activities do not consist of regular and systematic monitoring of data subjects on a large scale, and we do not process special-category data on a large scale. Responsibility for data protection sits with the owner of the business, who is reachable at the privacy address above.

↑ Back to top

2. Data we collect

We collect the following categories of personal data:

• Account credentials — your email address and password hash, and optionally a name and phone number you supply.
• Order data — the items you order, the order total, order status, and any messages or personalization you provide on a made-to-order item.
• Tokenized payment references — we never store full payment-card numbers (PAN) or security codes (CVV). Stripe and PayPal tokenize the payment instrument and we retain only the resulting reference.
• Shipping and billing addresses — supplied by you at checkout.
• Marketing-consent metadata — the timestamp, IP address, user agent, and source (e.g. signup, checkout, preference center, public opt-out page) for each consent decision you make.
• Device and cookie identifiers — see Section 11 (Cookies and similar technologies) below.
• Support correspondence — any message you send to us via the contact form or email, plus our reply.
• Chat messages — if you have an account, the messages you exchange with us in the chat on your account, and our replies. Your chat history stays visible to you in your account, and on a custom order it is the record of the design we agreed.
• Reviews and other content you post — the text of any product review or rating you submit, the display name shown with it, and the account and order it relates to.
• Personalization content — the text, initials, artwork or other material you supply to be reproduced on a made-to-order item, together with the proof we send you and your approval of it. We keep the approved proof as the record of what you asked us to make.
• Photographs of finished work — images we take of pieces we have made, which we may show in the portfolio on our site. We remove or obscure any name, dedication or other wording that would identify you before publishing, and we do not caption images in a way that connects them to you. Section 7D of our Terms of Use explains how this works and how to ask us not to publish, or to take something down.
• Audit-trail metadata — three kinds of record. Events evidencing your orders, payments and refunds, which corroborate the invoice and are retained under our legal obligation to keep accounting records. Records of the consents you gave us and of any you withdrew, retained because data protection law requires us to be able to demonstrate that a consent was given and when. And security events such as sign-ins, password and address changes and device registrations, each carrying an IP address and a browser identifier, retained under our legitimate interest in detecting and investigating account-takeover and payment fraud. They are kept for different periods — see Section 6.

Where we collect personal data from you

Almost all of the personal data we hold comes directly from you — when you create an account, place an order, contact us, or post a review. We also receive a limited amount from third parties: from Google, if you choose to sign in with a Google account (your email address, name and a Google account identifier); from Stripe and PayPal, confirmation that a payment succeeded and a tokenized reference to the payment method; and from our carrier, delivery and tracking status for your parcel.

What you have to give us. To create an account we need an email address and a password. To fulfill an order we need your name, delivery address, and a successful payment. For orders shipped outside the United States, and for expedited delivery services, we also need a telephone number, because the carrier requires one so that it can contact you if there is a problem with the delivery. Without these we cannot open an account or complete the order.

Everything else is optional — a telephone number on a standard domestic order, a saved address, marketing consent, personalization content — and declining to give it does not affect your ability to buy from us.

↑ Back to top

3. Purposes and legal bases

We process each category of personal data for a specific purpose and on a specific legal basis. The applicable basis depends on your jurisdiction — under the GDPR / UK GDPR we identify the basis under Article 6; under the CCPA / CPRA we identify the “business purpose”; equivalent concepts apply in Quebec, the Australian APPs, and elsewhere.

• Fulfilling your order — processing your name, address, items, and payment to ship a product you purchased. Basis: performance of a contract.
• Account services — letting you sign in, view your order history, manage addresses, and exercise data-subject rights. Basis: performance of a contract.
• Marketing communications — sending promotional emails about new collections and offers. Basis: consent (you can withdraw at any time — see Section 8).
• Tax and accounting retention — keeping invoice and order records for the periods mandated by tax authorities in the jurisdictions where we operate. Basis: legal obligation.
• Fraud detection and security — analyzing login patterns, payment attempts, and audit events to detect account-takeover and payment fraud. Basis: legitimate interest in protecting our customers and our business.
• Audit logging — recording security-relevant actions for investigative purposes and regulatory evidence. Basis: legitimate interest; the log is append-only and cannot be altered once written, so entries are retained intact until their retention period expires and are then deleted in full — see Section 6.
• Customer support — responding to questions, resolving issues, processing returns. Basis: a mix of performance of a contract (returns, order issues) and legitimate interest (general enquiries).
• Publishing reviews — displaying the reviews and ratings you choose to post, together with the display name you select. Basis: our legitimate interest, and yours, in a review section that stays complete and is not edited after the fact by either side. Section 6 explains what happens if you ask us to take your name off a review or to delete your personal data.
• Producing personalized items — reviewing, proofing and reproducing the personalization content you supply. Basis: performance of a contract. We also screen that content for unlawful or infringing material, on the basis of our legitimate interest in not manufacturing goods that breach the law or a third party’s rights.
• Product safety — responding to a safety concern you raise, and contacting you if we need to issue a safety notice or recall an item you bought. Basis: legal obligation, and our legitimate interest in the safety of people using our products.

↑ Back to top

4. Recipients and processors

We share personal data with the third-party processors that deliver parts of our service — hosting, payment, email, shipping. The complete current list, with each processor’s purpose, the data categories they touch, their jurisdiction, and the legal mechanism covering the relationship (Data Processing Agreement, Standard Contractual Clauses), is set out on our Subprocessors page, which forms part of this Privacy Policy.

By category, the third parties that receive personal data from us are: cloud hosting and infrastructure providers; payment processors; email delivery providers; consent-management providers; bot-protection and security providers; identity providers, where you choose federated sign-in; and delivery carriers.

Delivery carriers. We pass your name, delivery address and contact details to the carrier that delivers your parcel. A carrier decides for itself how it handles that data in order to perform carriage and to meet its own legal obligations, so it acts as an independent controller rather than as our processor, and its own privacy notice applies to that handling.

Payment providers. Stripe and PayPal process your payment on our instruction. Each of them also acts as an independent controller in its own right when it uses payment data to meet its own legal and regulatory obligations, such as fraud prevention, anti-money-laundering checks and financial reporting. PayPal is an independent controller of the payment data it receives from us, and its own privacy statement, available at www.paypal.com, governs how it handles that data. Stripe’s privacy policy governs its own controller activity in the same way.

Pay-over-time providers. If you choose to pay using a credit option such as Klarna or Affirm, you enter into a separate agreement with that provider and it becomes an independent controller of the information you give it. It decides for itself whether to offer you credit, and it may run its own checks to do so. We are not part of that decision and are not told the reason for it. Its own privacy notice governs the information it holds about you.

Product safety representative. Because we sell into the European Union from outside it, we are required to appoint a representative there for product safety purposes. Sipact EU acts in that role. If you raise a safety concern about one of our products, or if an EU authority asks about one, we share with Sipact EU only what that matter requires, which is usually your name, your contact details and the details of the product and the concern. We do not send them customer or order data as a matter of routine. Their contact details appear on each product listing and in our Terms of Use.

We do not sell your personal information for monetary or other valuable consideration, and we do not share it for cross-context behavioral advertising as that term is used in California law. We do not disclose your personal data to third parties for their own marketing purposes.

Where you have consented to marketing emails, we pass your email address to MailerLite, our email-delivery provider, so that it can send those emails on our behalf. MailerLite acts as our processor and service provider and may not use your address for its own purposes. That disclosure is therefore not a sale or a share — but you can stop it at any time by unsubscribing, and we honor a California opt-out request as an instruction to stop it. See Section 7 and Your Privacy Choices.

Other disclosures. We may also disclose personal data: to our professional advisers (lawyers, accountants, auditors) where they need it to advise us; where we are required to do so by law, by a court, or by a regulator, or where disclosure is necessary to establish, exercise or defend legal claims; to protect the rights, property or safety of our customers, our staff or the public, including for fraud prevention; and, if our business or its assets are sold or reorganized, to the buyer or prospective buyer, subject to confidentiality obligations and to this Privacy Policy continuing to apply. Where the law permits us to tell you that we have received a legal demand for your data, we will.

↑ Back to top

5. International transfers

Our infrastructure is hosted in the United States (AWS us-east-1). Personal data of customers in the European Economic Area, the United Kingdom, Canada, Australia, and elsewhere is therefore transferred outside the data subject’s home jurisdiction.

For each processor receiving data outside the European Economic Area or the United Kingdom, we rely on the European Commission’s Standard Contractual Clauses (SCCs) — and the UK International Data Transfer Addendum or IDTA where applicable — as the transfer mechanism under GDPR Article 46 and the equivalent UK GDPR provision. SCCs are executed with AWS, Stripe, PayPal, MailerLite, Termly, Google, and any other processor listed on the subprocessor page where SCCs apply.

A Transfer Impact Assessment (TIA) addressing the analysis required by the Court of Justice of the European Union in Schrems II, covering the transfers of EEA and UK personal data described above, is in progress. We will publish a summary here once it is complete; in the meantime you can ask us about it using the contact details in Section 13.

↑ Back to top

5A. How we protect your personal data

We take appropriate technical and organizational measures to protect personal data against unauthorized access, loss, alteration and disclosure, taking account of the nature of the data and the risks involved. These include: encryption of data in transit and at rest; storing passwords only as salted hashes, never in a form we can read; support for multi-factor authentication on customer accounts; access controls that limit staff access to what each person needs; an audit trail of security-relevant events; bot protection on public forms; and use of established payment processors so that full card numbers and security codes never reach our systems.

No system can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it where the GDPR or UK GDPR requires, and we will tell you directly without undue delay where the breach is likely to result in a high risk to you. We also comply with the breach-notification laws of the US states and other jurisdictions where our customers live.

You can help protect your account by using a strong, unique password, turning on multi-factor authentication, and telling us promptly at the address in Section 13 if you think someone else has accessed your account.

↑ Back to top

6. Retention

We retain personal data only for as long as necessary for the purpose for which it was collected, except where a longer retention period is required by law (typically for tax and accounting records).

A note on the words we use. Where we say data is deleted, it is removed from our live systems and falls out of routine backups within 35 days. Where we say data is de-identified, we strip the fields that identify you — such as your name, address and contact details — from a record we are obliged to keep, such as a tax invoice. A de-identified record is not anonymous: some of these records still contain limited information that could in principle be linked back to you, so we continue to treat them as personal data and your rights continue to apply to them. Where a payment dispute or a legal claim is open, we pause any scheduled deletion of the records it concerns until it is resolved.

• Your account and marketing — closed 3 years after our relationship ends. Our relationship ends at the later of your last order (plus the legal guarantee period that applies to it, where your country has one), your last message to us, and your last sign-in. Three years after that we will write and ask whether you want to keep your account; that message reaches you even if you have unsubscribed from marketing, because it is about your account rather than an offer. If we do not hear from you, we close it, stop using your data for marketing, and delete the personal data in it, keeping only records we are legally required to retain, which are de-identified as described below.
• Abandoned orders — hard-deleted after 30 days when the order was never paid, whether or not you were signed in.
• Unsubscribes — we keep a record that you opted out, but not your address. When you unsubscribe we delete your email address and keep only a one-way scrambled version of it, which lets us recognize the address if it is offered to us again without storing it in readable form. You can always sign up again yourself.
• Never-confirmed email subscriptions (you signed up but never clicked the double-opt-in confirmation link) — hard-deleted after 30 days.
• Stale custom-order drafts — hard-deleted after 180 days of inactivity.
• Delivery details on completed orders — gift messages, phone numbers, order notes and personalization text are removed 24 months after delivery. The delivery address, the recipient name and our proof of delivery are kept for six years after delivery, the period in which a claim about the delivery can be brought, and are then removed. We keep only the country, and the state or province where one applies, because that is what determines how long we must keep the order record itself.
• Paid orders — de-identified once both of the following have passed: the tax-retention period applying to your order, and, if you have an account, the closure of that account. The tax-retention period is set by the tax and accounting law of the country your order was delivered to, counted from the end of the year in which it was delivered, or of any later refund or adjustment on the order.

  While your account is open we keep your order history complete, so that you can see everything you have bought from us rather than watching older orders disappear. That is a separate purpose from our tax obligation and it lasts as long as the account does. When the account closes — three years after our relationship ends, or straight away if you delete it — the orders in it are de-identified, unless the tax period on a particular order has not yet expired, in which case that order is de-identified when it does. Orders placed as a guest are de-identified at the end of the tax period.

  Your name and email address are retained until de-identification, because tax law requires the counterparty to an invoice to be identifiable and because we need them to answer a data-subject request about the order. The amounts, dates and SKUs needed for tax and accounting are retained on a de-identified basis afterwards. Note that older entries in your history will show less detail than recent ones: the delivery address and the other fields described above are removed on their own schedule whether or not your account is still open.

• De-identified order records — deleted fifteen years after the end of the year of sale. Once an order record has been de-identified, what remains of it (the order number, dates, amounts, tax and payment references, the items supplied and the delivery country) is kept in a restricted archive as an accounting and product-safety record, and is deleted fifteen years after the end of the year in which the order was placed.
• Records we keep for product-safety reasons — where we must be able to identify and contact purchasers of a particular item in the event of a safety recall, we keep the link between an order and the item supplied for as long as that obligation lasts, even where we have already de-identified other parts of the record.
• Proofs and photographs of finished work — kept as our records. The proofs we prepared for your order and the photographs and video we take of the finished piece are our own work product. Once your order record is de-identified they are kept in our design archive with no link to you, and any name or dedication they show is obscured at that point. Whether a piece appears in our portfolio is governed by Section 7D of our Terms.
• Reviews — published reviews are permanent. Your review, rating and any photographs or video you attached stay on the product page once published, and they outlive the order they were posted from. What you can withdraw at any time is your separate consent for us to feature the review elsewhere or in marketing. You can also ask us to take your name off it, and this is what we do if you ask us to delete your personal data: we replace your name with “Velimira Customer”, remove the link to your account and order, and remove any wording in it that identifies you, after which the review no longer says anything about you and stays published. The reviewer name and account link are in any case de-identified when the related order record is de-identified.
• Messages you send us — where a conversation relates to an order, we keep it for as long as we keep that order record, because on a custom order the chat is the record of what we agreed. Any other conversation is kept for six years after the last message, whether or not you have an account, and is then de-identified. If you delete your account we remove your name, your contact details and anything else in the messages that identifies you at once, and keep the messages themselves, without any link to you beyond the order number, until that period ends.
• Audit-trail events — kept for a period that depends on the kind of event. Records of your orders, payments, refunds and the consents you gave us are kept for six years from the end of the year in which they were recorded. Records of sign-ins, password and address changes and device registrations are kept for three years. Each record is then deleted in full. Our audit log is append-only and tamper-evident: once an event is written it cannot be edited or removed before its retention period expires, and that integrity is itself one of our security measures. It follows that where an entry refers to an account you have since deleted, we cannot edit or de-identify that entry — it stays intact until its period ends, and is then deleted along with the rest of the record. We keep these events under our legitimate interest in investigating security incidents and in holding evidence for regulatory and legal purposes. If you ask us to erase personal data that exists only in the audit log, we may decline for those records, and we will tell you that we have and why.

If you delete your account (see Section 8), records we are legally required to retain — chiefly tax and accounting records — are de-identified rather than deleted: we keep the transaction record and remove the fields that identify you. Everything not subject to a retention obligation is deleted.

If we ever cease trading, we keep a final copy of the records we are legally required to hold until those obligations expire, and then destroy it. Before that copy is made we run every retention rule in this section as of the closing date, so it holds information that identifies you only for orders still inside their retention period.

↑ Back to top

7. Your rights

Your rights over your personal data depend on the law of your jurisdiction. Where you are entitled to rights under more than one regime (for example a Quebec resident is covered by both PIPEDA and Quebec Law 25), all applicable rights apply.

European Union / EEA — GDPR

• Right of access to your personal data
• Right to rectification of inaccurate data
• Right to erasure (the “right to be forgotten”)
• Right to data portability
• Right to restrict processing
• Right to object to processing
• Right to withdraw consent (where consent is the basis)
• Right to lodge a complaint with your national supervisory authority
• Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you — see Section 10.

We respond without undue delay and in any event within one month of receiving your request. Where a request is complex, or where you have made a number of requests, we may extend that period by up to two further months; if we do, we will tell you within the first month and explain why. Exercising these rights is free. For requests that are manifestly unfounded or excessive, in particular because they are repetitive, we may charge a reasonable fee or refuse to act — we will explain our reasoning in writing, and you can complain to a supervisory authority if you disagree.

United Kingdom — UK GDPR

Rights are materially the same as under the GDPR (listed above) — enforced by the UK Information Commissioner’s Office (ICO).

California — CCPA / CPRA

• Right to Know what personal information we have collected about you, the categories of sources, the business purpose, and the categories of third parties with whom we share it.
• Right to Delete personal information we have collected from you, subject to applicable exceptions (such as tax retention).
• Right to Correct inaccurate personal information.
• Right to Opt-Out of Sale or Sharing of personal information. We do not sell personal information; marketing-related sharing with our email-delivery processor is honored as an opt-out — see Your Privacy Choices.
• Right to Limit Use of Sensitive Personal Information. The account credentials you use to sign in — your email address together with your password — fall within the CPRA’s definition of sensitive personal information. We collect them only so that you can access your account, and we use them only for that purpose and for the related security purposes permitted by the CPRA regulations. We do not use or disclose sensitive personal information to infer characteristics about you. Because our use is limited to those permitted purposes, the right to limit does not give you anything further to restrict — but if you would like us to confirm how we handle these credentials, contact us at the address in Section 13. We do not collect any other category of sensitive personal information, such as precise geolocation, government identifiers, or racial or ethnic origin. Nor do we read the contents of communications between you and anyone else: where you write to us, by email, through the contact form or in the chat on your account, we are the intended recipient, and California law treats that differently from intercepting your correspondence.
• Right to Non-Discrimination — we will not deny you goods or services, charge different prices, or provide a different level of quality for exercising any California privacy right.

Opt-out preference signals. We honor the Global Privacy Control (GPC) signal sent by a browser or extension, and treat it as a valid request to opt out of the sale or sharing of personal information. Section 11 explains how we handle it and what it applies to.

The twelve months before this policy. In the twelve months before the date at the top of this policy, we collected the categories of personal information listed in Section 2, for the purposes listed in Section 3, from the sources described in Section 2, and disclosed them for a business purpose to the categories of recipients listed in Section 4. We did not sell or share personal information in that period.

Authorized agents. You may use an authorized agent to make a request on your behalf. We will ask the agent for written proof that you have authorized them to act, and we may contact you directly to confirm both that you gave that authorization and that you want the request made. If the agent holds a valid power of attorney, we will not ask you to confirm separately.

Verifying who you are. Before we act on a request to know, delete or correct, we need to be reasonably sure the request comes from you. For most requests, being signed in to your account is enough. If you do not have an account, we will ask you for the email address used on your orders and enough detail to match a request to our records. We use what you give us only to verify the request. If we cannot verify you to the standard the law requires, we will tell you why and, where we can, offer a narrower response instead of refusing outright.

Other United States states

A number of other US states have comprehensive privacy laws, including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, Nebraska, New Hampshire, New Jersey, Maryland and Minnesota. Whether a particular law applies to us depends on thresholds that turn on how many residents of that state we deal with. Where one applies to you, you have rights to confirm whether we process your personal data and to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects — and you may appeal a refusal, after which you can complain to your state Attorney General.

We do not engage in targeted advertising, sale of personal data, or profiling of that kind. As a matter of policy, and regardless of whether a threshold is met, we will honor a request from a resident of any US state to know, correct, delete or port their personal data on the same basis as a California request. Use the contact details in Section 13 or the Your Privacy Choices page. If we refuse a request, we will tell you why and how to appeal.

Authorized agents may submit requests on your behalf with appropriate proof of authorization.

Quebec — Law 25 (Act respecting the protection of personal information in the private sector)

In addition to the access, correction, and consent rights granted by PIPEDA and Quebec Law 25 generally, you have the right to:

• Receive your personal data in a structured, commonly used technological format (portability).
• Request that information published about you be de-indexed from search engines or that an obsolete or no-longer-justified link be ceased.
• Make all of the above requests in French, and to receive our responses in French.

Australia — Privacy Act 1988 and the Australian Privacy Principles

• Right of access to and correction of your personal information (APP 12 & APP 13).
• Right to opt out of receiving direct marketing communications (APP 7).
• Right to complain to the Office of the Australian Information Commissioner (OAIC).

↑ Back to top

8. Exercising your rights

Most rights are exercisable directly from your account:

• /account/data-request — request a downloadable copy of your personal data (Right of Access / Right to Know).
• /account/delete-account — initiate deletion of your account and associated personal data, with a 14-day cooldown during which you can cancel (Right to Erasure / Right to Delete).
• /account/email-preferences — manage your marketing-email subscription with one click (Right to Object to direct marketing / Right to Withdraw Consent / CCPA opt-out for marketing-related sharing).
• /account/settings — update your name and phone number (Right to Rectification / Right to Correct).
• /account/addresses — add, edit, or remove shipping addresses (Right to Rectification).
• /account/security — enable multi-factor authentication and manage sign-in security.
• /your-privacy-choices — the public CCPA / CPRA opt-out and request page, usable without signing in.

When we cannot start a deletion straight away. We cannot begin deleting your account while you have an order in progress, because we need your details to fulfill it: you can ask again once the order has been delivered, or cancel the order first. We also finish any data request you already have open before we start a deletion, so that you receive the copy of your data you asked for. These are short delays to a request we will carry out, not a refusal, and we will tell you which applies and when you can proceed.

Once a deletion starts, your account stays open for 14 days and you can cancel it during that period. At the end of the 14 days we delete your personal data, except for records we are required to keep, which are de-identified as described in Section 6.

For any right that is not exercisable through the surfaces above, or if you do not have an account but need to submit a request, email privacy@velimiradesigns.com. We will respond within the timeframe required by the law that applies to you: one month under the GDPR and UK GDPR, extendable by up to two further months for complex requests; 30 days under Quebec Law 25; 45 days under the CCPA, extendable by a further 45 days with notice; and 30 days under the Australian Privacy Act. We will tell you if we need an extension, and why.

↑ Back to top

9. Children’s privacy

Our Services are intended for adults. Our Terms of Use require account holders to be at least 18 years old, and we do not direct the Services at children.

We do not knowingly collect personal data from children. The age below which we treat a person as a child depends on where they live: under 13 in the United States, in line with the Children’s Online Privacy Protection Act; under 13 in the United Kingdom; and between 13 and 16 in the European Economic Area, depending on the age of digital consent set by the member state where the child lives.

If you believe a child has given us personal data, contact us at privacy@velimiradesigns.com and we will delete it promptly. If we become aware that we hold personal data of a child, we will delete it and close any associated account.

↑ Back to top

10. Automated decision-making

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or that similarly significantly affect you. Prices, the products available to you, and the content you see are not personalized by automated profiling.

Two processes do involve automated screening, and we describe them so that you can see where the line falls. First, our payment processors (Stripe and PayPal) run their own automated fraud checks on a transaction and may decline it; that decision is theirs, made under their own privacy notices, and a declined payment simply means an order is not completed. Second, we apply automated checks to sign-in attempts and order patterns to detect account takeover and payment fraud, which can flag an account or an order for review.

A third sits outside our systems entirely. If you choose a pay-over-time option such as Klarna or Affirm, that provider may run an automated check to decide whether to offer you credit, and it may decline. That decision is the provider’s, made under its own privacy notice and its own terms; we do not make it, we are not told the reason for it, and we cannot overturn it. If you want to know why you were declined, or to challenge it, contact the provider directly. Being declined does not affect your ability to buy from us by any other payment method.

Where an automated check would otherwise result in an order being refused or an account being suspended, a person reviews the case before that outcome takes effect. If you believe an order or an account has been wrongly refused, contact us at the address in Section 13: you can ask for human intervention, put your point of view, and contest the outcome.

↑ Back to top

11. Cookies & tracking

This section is our Cookie Policy. It explains the cookies and similar technologies we use, what they do, and how you control them. It replaces the separate cookie policy page we previously linked to; that page now points here.

What cookies and similar technologies are

A cookie is a small text file that a website asks your browser to store. Similar technologies — such as local storage, and requests your browser makes to a third-party server — can be used in comparable ways, and we treat them the same way in this section. Some are set by us (first party) and some by a provider we use (third party).

How we ask for your consent

Cookies that are strictly necessary for the Services to work do not require your consent, and you cannot turn them off through our banner — without them the site cannot keep you signed in or keep your basket. For everything else, we ask for your consent before the cookie is set wherever consent is required, including in the European Economic Area, the United Kingdom and Quebec. We manage that through our consent platform, Termly. You can change or withdraw your choices at any time — see Managing your choices below.

Cookies we use

The table below lists the cookies and similar technologies in use on the Services.

Analytics

We use Google Analytics 4 to understand how the site is used — which pages are visited, how visitors move through checkout, and where people run into difficulty — so that we can improve it. Google acts as our processor for this purpose and may not use the data for its own purposes.

Google Analytics is not essential to the operation of the site, so it is switched off by default and does not load until you consent to analytics cookies. If you decline, or withdraw consent later, no analytics data is collected from your browser. Where consent is required — including in the European Economic Area, the United Kingdom and Quebec — we do not load it until you have given it.

We have configured Google Analytics to limit what it collects: the advertising features and Google signals are switched off, we do not allow the data to be used for advertising or shared with other Google services for Google’s own purposes, and we have set the shortest data retention period that still lets us see year-on-year trends. This is why the analytics we run does not amount to a sale or a share of personal information as California law defines those terms.

We do not use marketing or advertising pixels, remarketing tags, or any cross-site tracking technology. If we add tooling of that kind, we will update this section and our consent banner in the same change, record it in the change log below, and, where consent is required, will not set it until you have given consent.

Third-party connections that are not cookies

Some features cause your browser to contact a third party without setting a cookie. These are still disclosed here because they involve your personal data, usually your IP address.

Bot protection (Cloudflare Turnstile). We use Cloudflare Turnstile on forms that accept user-submitted data — signup, marketing opt-in, the privacy-choices page, and our order surfaces — to tell people from automated abuse. Cloudflare states that Turnstile does not profile visitors: when a challenge runs, your IP address is sent to Cloudflare for that single verification, and Cloudflare’s use of it is contractually limited to operating the bot-detection service. Turnstile may also set one security cookie, cf.turnstile.u, listed in the table above. This is strictly necessary for the security of the Services and is not subject to consent.

Sign in with Google. If you choose to sign in with a Google account, your browser contacts Google and Google gives us your email address, name and a Google account identifier. This happens only if you choose that option; if you sign in with a password instead, your browser does not contact Google.

Address autocomplete (Google Maps and Places). The checkout delivery form can offer address suggestions as you type, which requires the partial address text and your IP address to be sent to Google. This is a convenience feature rather than a necessary one, so we ask for your consent before enabling it and you can decline and simply type your address in full.

Fonts. The Lato typeface is downloaded at build time and served from our own servers, so your browser does not contact Google to load fonts.

Managing your choices

You can change or withdraw your cookie consent at any time using the button below, or by reopening the cookie banner from the link in the footer of any page. Withdrawing consent does not affect the lawfulness of what we did before you withdrew it.

You can also control cookies in your browser: most browsers let you see what is stored, delete it, and refuse cookies generally or from particular sites. Blocking strictly necessary cookies will stop parts of the Services from working — you will not be able to stay signed in or keep a basket. Browser help pages explain how to do this for Chrome, Safari, Firefox and Edge.

Opt-out preference signals. We honor the Global Privacy Control (GPC) signal. Where your browser sends it, we treat it as a request to opt out of the sale or sharing of personal information and to switch off non-essential cookies for that browser, without you needing to use the banner. We do not currently respond to the older Do Not Track header, which has no agreed meaning.

Records of your consent

When you make a cookie choice, Termly records it — including your IP address and the time — so that we can show what you were asked and what you chose. We keep that record for 180 days and rely on our legal obligation to demonstrate consent as the basis for keeping it.

Changes to this section

If we add a cookie or a similar technology — for example an analytics tool or an advertising pixel — we will update this section and our consent banner in the same change, record it in the change log below, and, where consent is required, we will not set it until you have given consent.

All active third-party touchpoints are listed on the subprocessor page.

↑ Back to top

12. Updates to this policy

We may update this policy from time to time. The “Last updated” date at the top of this page shows when the latest version was published. Material changes will also be communicated via a notice on our site or by email to subscribed customers.

Change log

• 2026-10-17 — Legal review. Disclosures for a wind-down added. Retention rewritten: account and marketing data now runs on a relationship clock separate from the record-keeping clock; order retention is set by the law of the country of delivery, counted from the end of the year; order history is kept while an account is open; audit-trail retention is tiered by event type; and the wording throughout distinguishes de-identification from anonymization. The 30-day deletion of orders that were never paid applies whether or not you were signed in.
• 2026-09-29 — Cloudflare Turnstile’s security cookie, cf.turnstile.u, added to the cookie table as strictly necessary. The earlier description of Turnstile as cookieless was corrected; what Turnstile does and why it does not require consent are unchanged.
• 2026-08-19 — Legal review. Chat messages and portfolio photographs added as categories of personal data we collect, with the retention rule that applies to each. Pay-over-time providers (such as Klarna and Affirm) described as independent controllers, and their credit decision described as an automated decision taken outside our systems. Our commitment to honor the Global Privacy Control signal stated in Sections 7 and 11. The California sensitive-personal-information wording narrowed: we do not read communications between you and anyone else, but where you write to us we are the intended recipient, and the previous flat denial did not describe that accurately.
• 2026-08-11 — Legal review. Cookie Policy consolidated into Section 11 and the separate cookie page retired. Security section added. Sources of personal data, verification and authorized-agent procedures, rights for US states other than California, and disclosures for legal process and business transfer all added. Retention wording corrected to distinguish de-identification from anonymization, order-retention periods changed from a single ten-year window to the period required in the country of purchase, and audit-trail retention stated as seven years with no earlier de-identification, reflecting the immutable design of the log. Telephone number disclosed as required for international and expedited orders. Google Analytics disclosed, consent-gated, with advertising features off. Switzerland removed from scope.
• 2026-05-31 — Bot protection on public forms transitioned from Google reCAPTCHA to Cloudflare Turnstile. Turnstile is cookieless and does not profile visitors. The Google reCAPTCHA touchpoint and its associated browser-to-Google data flow have been removed. Address-autocomplete (Google Maps / Places) on the checkout shipping form was disclosed explicitly in Section 11 at the same time — the underlying behavior is unchanged.
• 2026-05-28 — Full rewrite for multi-jurisdiction privacy compliance: per-jurisdiction rights enumeration, processor disclosure linked to the new /subprocessors page, retention windows aligned to our internal retention schedule, international-transfer mechanism (SCCs) named, account-rights deep links added, children’s-privacy and automated-decision-making statements added.

↑ Back to top

13. Contact us

For all privacy-specific correspondence, contact privacy@velimiradesigns.com. This inbox is staffed by the owner responsible for privacy requests and is separate from our general support address.

↑ Back to top

14. Legal Representatives

Because we are established outside the European Union and the United Kingdom but offer goods to people in both, we are required to designate a representative in each.

Our representatives are:

You can contact the relevant representative on any matter relating to our processing of your personal data, as an alternative to contacting us directly.

↑ Back to top