Last updated: 7 September 2026

This Privacy Policy describes how LUSHFILLS collects, processes, shares and safeguards personal information when you use lushfills.com or interact with our sales and customer-support services.

It applies to website users, customers, business contacts, delivery recipients and anyone who contacts us or otherwise provides information to LUSHFILLS.

This Policy describes our privacy practices but does not replace consent in situations where consent is legally required.

1. Who Is Responsible for Your Personal Information?

Lushfills.com is operated by LUSHFILLS.

Throughout this Privacy Policy, “we”, “us” and “our” mean LUSHFILLS.

Where we decide the purposes and methods for processing personal information in connection with our business, we act as the controller of that information.

Some third-party providers, including payment companies, delivery carriers and Shopify for certain services, may separately process personal information under their own privacy policies and responsibilities.

Privacy contact: info@lushfills.com
Phone / WhatsApp: +372 5360 2282

2. Personal Information We May Collect

The information we collect depends on how you interact with LUSHFILLS and which services you use.

Category	Examples	Main reasons for processing
Contact and account information	Name, email, telephone number, account information and communication preferences	Account management, identification and communication
Billing and delivery information	Billing and shipping addresses, recipient information and delivery instructions	Invoicing, fulfilment, shipping and delivery assistance
Order and transaction information	Products, quantities, purchase history, payment status, transaction references and discounts	Processing Orders, maintaining records, refunds and dispute resolution
Payment and refund information	Payment confirmations, bank-transfer receipts and refund account details	Payment verification, reconciliation and refund processing
Professional and business information	Business details, professional registration, licences and relevant authorisations	Eligibility verification and regulatory compliance
Customs and shipping information	Recipient identification, import documents, tracking information and customs correspondence	Lawful shipment, clearance and delivery investigations
Device and usage information	IP address, browser and device information, approximate IP-derived location and website activity	Website functionality, security, performance and permitted analytics
Shopping activity	Viewed Products, cart activity, purchases and interactions with promotions	Shopping functionality, service improvement and permitted personalisation
Communications and Claim information	Emails, messages, complaints, photographs, videos and supporting documents	Customer support, investigations, refunds and legal Claims
Submitted content	Reviews, testimonials, photographs and videos provided by you	Publication or promotional use where lawful and authorised
Privacy and consent records	Cookie settings, marketing choices, consent withdrawals and privacy requests	Respecting your preferences and demonstrating compliance

We aim to collect only information reasonably relevant to its intended purpose.

Please avoid providing unnecessary identity documents, financial details or sensitive personal information.

Payment Information

Where card payments are available, they are processed through relevant payment providers.

We do not ask customers to send complete payment-card numbers or card security codes through email or messaging services.

We may receive transaction references and limited payment information needed to confirm payment or investigate a transaction.

If you provide bank-account information for a refund or payment verification, those details become part of the information we process and protect.

3. Sources of Personal Information

We may obtain personal information:

• Directly from you when you place an Order, register an account, contact us or submit a Claim.

• From a purchaser who identifies you as a delivery recipient or business contact.

• Automatically through lushfills.com and associated technologies.

• From payment companies, carriers and fulfilment providers.

• From professional registers or competent authorities where verification is necessary.

• From technology providers and other service partners supporting our operations.

• Through social-media or messaging platforms when you interact with us using those services.

If you provide information concerning another person, only provide information necessary for the relevant purpose and ensure that you are permitted to share it.

Where appropriate, you should also make this Privacy Policy available to that individual.

4. How and Why We Use Personal Information

Where applicable law requires us to identify a legal basis for processing, the appropriate basis depends on the purpose and circumstances involved.

Purpose	Legal basis where required
Processing an individual customer's Order, payment, delivery or refund	Performance of a contract or steps requested before entering into a contract
Communicating with representatives of business customers	Legitimate interests in managing business relationships
Completing legally required verification and maintaining statutory records	Compliance with applicable legal obligations
Carrying out proportionate eligibility or fraud checks	Legitimate interests in lawful trading, security and fraud prevention, where permitted
Handling support enquiries, complaints and disputes	Contract performance, legal obligations or legitimate interests depending on the circumstances
Protecting accounts, systems and transactions	Legitimate interests in security and fraud prevention and, where relevant, legal obligations
Improving services using information that does not require consent	Legitimate interests in understanding and developing our business, subject to applicable law
Optional cookies, analytics, tracking or advertising technologies	Consent where required or another basis permitted by law
Promotional communications	Consent or another specific legal permission for direct marketing
Identifiable testimonials and promotional materials	Consent or another appropriate permission and legal basis
Establishing, exercising or defending legal Claims	Legitimate interests together with any additional requirements applicable to sensitive information

When relying on legitimate interests, we consider the potential effect on individuals and whether their interests, rights or freedoms override our interests.

The legal bases listed above are not used to avoid obtaining consent or satisfying another legal condition where one is required.

If necessary information is not provided, we may be unable to fulfil an Order, verify eligibility, complete delivery or provide a requested service. Where relevant, we will explain this to you.

5. Shopify and Shopify Network Intelligence

Our online store is hosted by Shopify, which provides the technology used to operate lushfills.com and related e-commerce services.

Shopify receives and processes personal information relating to access to and use of our store, including information submitted while browsing, shopping and completing checkout.

Shopify Network Intelligence is enabled for our store.

This functionality may allow Shopify to combine information generated through interactions with our store with information from interactions with Shopify and other merchants in order to provide enhanced services.

Depending on the features being used, these services may include personalisation, analytics, improvements to stores and advertising-related functionality.

For certain enhanced services, Shopify is responsible for its own processing of personal information and for handling requests relating to that processing.

Further information about Shopify's processing practices and available privacy options can be found through the Shopify Consumer Privacy Policy and Shopify Privacy Portal.

Applicable consent and opt-out preferences must be respected when these services are used.

6. Service Providers and Other Disclosures

We may disclose personal information where doing so is necessary, lawful and consistent with the purposes described in this Privacy Policy.

Recipients may include:

• Service and technology providers: website hosting, software, account management, communications, customer support, analytics and operational services.

• Payment and financial providers: payment processing and verification, reconciliation, refunds and fraud prevention.

• Fulfilment and logistics providers: preparing Orders, transportation, delivery and investigation of shipping problems.

• Manufacturers, suppliers and qualified specialists: investigation of Product quality, safety, authenticity or conformity concerns.

• Customs and regulatory authorities: customs clearance, verification and legal compliance.

• Professional advisers and insurers: accounting, legal matters, insurance and dispute resolution.

• Advertising and marketing partners: where relevant functionality is used and disclosure is permitted by applicable law and your privacy choices.

We seek to disclose only information reasonably necessary for the relevant purpose.

Where another organisation processes information on our behalf, appropriate contractual protections are required.

Certain recipients may instead act as independent controllers and therefore have their own legal responsibilities and privacy notices.

Personal information may also be disclosed where reasonably necessary to comply with binding legal requirements, protect individuals from harm, investigate suspected fraud or unlawful conduct, establish or defend legal Claims, or support a legitimate business restructuring or transfer subject to appropriate safeguards and any required notification.

7. Sale, Sharing and Advertising Choices

We do not sell customer lists or personal information in exchange for money.

However, some privacy laws define terms such as “sale”, “sharing” and “targeted advertising” more broadly and may include certain disclosures that do not involve monetary payment.

Depending on the technologies used and applicable law, certain advertising technologies or Shopify enhanced services may fall within these broader definitions.

Where such processing takes place and you have a legal right to opt out, you may exercise that right through the applicable privacy controls or by contacting us.

This does not mean that unrelated businesses are given unrestricted access to customer accounts or Order information.

8. Cookies and Similar Technologies

Lushfills.com and our technology providers may use cookies, pixels, local storage and comparable technologies.

These technologies may be used for:

• Essential functionality: shopping carts, checkout, account access, security and remembering privacy preferences.

• Preferences: retaining selected settings and improving convenience.

• Analytics: measuring and understanding website use and performance.

• Marketing and personalisation: measuring campaigns, personalising content and supporting relevant advertising.

Where legally required, optional technologies will not be activated until the necessary consent has been provided.

Available cookie and privacy controls can be used to manage your choices and withdraw consent.

Browser settings may also allow cookies to be restricted, although disabling certain cookies can affect website functionality.

Rejecting optional cookies does not prevent access to essential purchasing functions.

Information made available through our cookie controls should identify the relevant technologies, providers and applicable durations.

9. Marketing Communications

We may send marketing communications where you have consented or where another specific legal permission allows us to do so.

You may stop promotional communications by:

• Selecting the unsubscribe option contained in an email.

• Following an available opt-out process provided through another communication channel.

• Contacting us at info@lushfills.com.

Opting out of marketing does not prevent communications that are necessary for Orders, payments, shipping, Product recalls or requests you have submitted.

Limited suppression information may be retained so that we can continue respecting an opt-out request.

Marketing consent is separate from acceptance of our Terms and Conditions.

10. Professional Verification and Identity Documents

Where reasonably necessary, we may process business information, professional registration details, identity information or authorisation documents to determine eligibility or satisfy legal requirements.

We seek to:

• Request only information relevant to the required verification.

• Restrict access to employees and providers who need the information.

• Avoid keeping complete document copies where a limited verification record is sufficient.

• Retain verification records only for an appropriate purpose and period.

Where information is unrelated to the verification, you may redact it unless the complete document is necessary.

If an unredacted document is required, we will explain why.

11. Product Complaints and Sensitive Information

Some Product complaints may involve health information, treatment photographs, medical reports or other sensitive information.

Please do not send unnecessary medical information or identifiable patient records through ordinary email or messaging channels.

Contact us first so that we can determine what information is actually required and identify an appropriate method for providing it.

Where processing sensitive information is necessary, we will identify the relevant legal basis and any additional legal condition required, limit processing to the appropriate investigation, safety obligation or legal matter, restrict access and disclosure, and seek anonymised or redacted information where this can achieve the required purpose.

A customer's consent does not automatically provide authority to disclose another individual's medical information.

Where necessary and lawful, relevant information may be disclosed to a manufacturer, qualified specialist, insurer, legal adviser or competent authority.

Evidence submitted in connection with a complaint will not subsequently be used for marketing without separate appropriate permission.

12. Reviews, Photographs and Testimonials

Content submitted for publication may become publicly accessible depending on what you choose to include.

Do not include another person's identifiable or sensitive information unless you have appropriate permission.

We will obtain consent or another legally required permission before using identifiable photographs, videos or testimonials for promotional purposes.

Where publication is based on consent, you may withdraw that consent by contacting us.

We will explain any practical limitations affecting material that has already been lawfully distributed or independently reproduced by others.

13. International Processing and Transfers

LUSHFILLS works with international technology, service and fulfilment providers.

As a result, personal information may be accessed or processed outside your country of residence, including countries in which Shopify, fulfilment companies, carriers and other relevant service providers operate.

Privacy protections may differ between countries.

Where an international transfer is legally restricted, an appropriate transfer mechanism must be used. Depending on the circumstances, this may include:

• A recognised adequacy decision.

• Appropriate contractual safeguards, including approved standard contractual clauses.

• Another legally permitted transfer mechanism or narrowly applicable exception.

Additional protections will be implemented where required.

You may contact us for information about relevant transfer safeguards and how to obtain an appropriate copy or explanation, subject to necessary redactions.

14. Retention of Personal Information

We keep personal information only for as long as reasonably necessary for its intended purpose, subject to applicable legal obligations.

Record category	Factors affecting retention
Account and customer information	Whether an account remains active, continuing service requirements and applicable recordkeeping obligations
Orders, invoices, payments and refunds	Accounting, taxation, transaction records and applicable legal-Claim periods
Professional verification information	Verification purpose, regulatory requirements and continuing necessity
Shipping and customs information	Completion of delivery, customs obligations, shipping disputes and required records
Complaints and Product-safety records	Investigations, traceability, regulatory reporting and applicable Claim periods
Marketing preferences	Until changed or withdrawn, while retaining limited information necessary to respect opt-outs
Device and analytics information	Purpose of the technology, configured duration and applicable consent requirements
Privacy-request records	Evidence that requests were properly handled and compliance with legal obligations

Information may need to be retained for longer where an active dispute, investigation or binding legal obligation requires it.

When information is no longer required, it should be deleted or anonymised.

Backup copies may temporarily remain within established backup cycles and should not be restored to ordinary use without an appropriate reason.

A request for deletion does not automatically require us to remove information that we are legally required or permitted to retain.

15. Information Security

We use appropriate technical and organisational safeguards intended to protect personal information.

Measures are proportionate to the type of information and the risks involved and may include access restrictions, secure systems, confidentiality obligations and safeguards imposed on relevant providers.

No website, communication method or storage system can be guaranteed to be completely secure.

You should protect your login credentials and avoid transmitting complete payment-card information or unnecessary sensitive information through ordinary support channels.

If a personal-data breach occurs, we will assess the circumstances and comply with applicable notification and response requirements.

16. Your Privacy Rights

Depending on your location and the law applicable to your information, you may have rights to:

• Receive information about how your personal information is processed.

• Request access to personal information held about you.

• Correct inaccurate or incomplete information.

• Request deletion of eligible information.

• Restrict certain processing activities.

• Receive eligible information in a portable format.

• Object to processing based on legitimate interests.

• Object to direct marketing.

• Withdraw consent without affecting processing lawfully carried out before withdrawal.

• Opt out of qualifying sale, sharing or targeted advertising.

• Exercise applicable rights concerning significant automated decision-making.

• Submit a complaint to a competent data-protection authority.

These rights may be subject to legal conditions, limitations and exceptions.

Where required, we will explain why a request cannot be fulfilled or can only be fulfilled in part.

Where EU or UK data-protection legislation applies, an objection to processing for direct-marketing purposes must be respected.

17. Additional United States Privacy Rights

Where an applicable US state privacy law applies to LUSHFILLS and your personal information, you may have additional rights, including the right to:

• Know categories and specific pieces of personal information collected.

• Obtain information about relevant sources, purposes and categories of recipients.

• Correct or delete eligible personal information.

• Opt out of qualifying sale, sharing or targeted advertising.

• Restrict certain uses of sensitive information where applicable law provides such a right.

• Appoint an authorised agent.

• Appeal certain decisions concerning privacy requests where required.

• Exercise applicable privacy rights without unlawful discrimination.

Where legally required, recognised opt-out preference signals such as Global Privacy Control must be respected.

The specific rights and procedures available depend upon the law applicable to the request.

Nothing in this section represents that every US privacy statute applies to every customer or transaction.

18. How to Exercise Your Privacy Rights

Privacy requests may be submitted using:

Email: info@lushfills.com
Phone / WhatsApp: +372 5360 2282

Please clearly describe your request and provide enough information for us to identify the relevant records.

We may use proportionate measures to verify your identity or an authorised agent's authority.

We will not request excessive documentation simply to discourage the exercise of privacy rights.

Requests are generally handled without charge, subject to legally permitted exceptions.

Where the EU or UK GDPR applies, we generally respond within one month. Where an extension is legally permitted because a request is complex or numerous, we will provide notice and reasons within the original response period.

Where the CCPA applies, qualifying requests involving access, correction or deletion generally have a 45-day response period, subject to any legally permitted extension.

Different deadlines may apply to certain privacy choices, including opt-out requests.

Any other applicable statutory deadlines will also be respected.

If a request cannot be fulfilled completely, we will explain the reason and identify any available review or complaint procedure where required.

19. Children

Our services are intended for adults and are not directed toward individuals under 18 years of age.

If you believe that a minor has submitted personal information through our services, please contact us.

We will review the circumstances and take appropriate steps, including deletion where legally required.

Limited records may nevertheless be retained where justified by a legal obligation or safeguarding requirement.

20. External Websites and Communication Platforms

Links to third-party websites and interactions through external messaging or social-media platforms may involve personal-information processing by those providers.

Their respective privacy policies govern processing activities for which they act independently.

Please review the relevant provider's privacy information before sharing sensitive or unnecessary personal information through those services.

21. Changes to This Privacy Policy

We may revise this Privacy Policy from time to time to reflect changes to our services, business practices or legal requirements.

An updated version will display a revised publication date.

Where legally required, additional notice will be provided for material changes.

If a new processing activity requires consent, simply publishing an updated Privacy Policy will not replace the requirement to obtain that consent.

22. Contact and Complaints

LUSHFILLS

Email: info@lushfills.com
Phone / WhatsApp: +372 5360 2282

Where appropriate, please identify your communication as a privacy enquiry.

You may also submit a complaint directly to a competent data-protection authority without first contacting LUSHFILLS.

Where EU or UK data-protection rules apply, this may include the authority responsible for your habitual place of residence, place of work or the location of the alleged infringement.