Last updated: 7 September 2026

This Privacy Policy explains how LUSHFILLS collects, uses, discloses and protects personal information in connection with lushfills.com and our related sales and customer-support services.

It applies to website visitors, customers, business representatives, delivery recipients and individuals who contact us or submit information to us.

This Policy explains our practices. It does not replace consent where consent is required by law.

1. Who Is Responsible for Your Information?

Lushfills.com is operated by LUSHFILLS.

In this Policy, “we”, “us” and “our” refer to LUSHFILLS.

We act as the controller of personal information where we determine why and how it is processed in connection with our business.

Certain providers, including payment providers, carriers and Shopify for some services, may also process information independently under their own privacy notices.

Privacy contact: info@lushfills.com
Phone / WhatsApp: +372 5360 2282

2. Personal Information We Collect

The information collected depends on your interactions with us and the services you use.

We aim to collect information relevant to the particular purpose. Please avoid sending unnecessary identity documents, financial information or sensitive personal information.

Payment information

Card payments, where available, are handled through payment providers. We do not ask you to send complete card details or card security codes by email or messaging.

We may receive transaction information and limited payment details needed to verify payment or handle a dispute.

Where you provide bank account details for a refund or transfer verification, those details form part of the records we process and protect.

3. Where Information Comes From

We may receive personal information:

• Directly from you when you place an Order, create an account, contact us or submit a Claim.
• From a purchaser who designates you as a recipient or business contact.
• Automatically through our website and related technologies.
• From payment providers, carriers and fulfilment partners.
• From professional registers or relevant authorities where needed for verification.
• From service providers and technology partners supporting our website and business.
• From social platforms when you contact or interact with us through their services.

If you provide another person’s information, provide only what is necessary and ensure you are permitted to disclose it. Where appropriate, make this Policy available to that person.

4. How We Use Information and Our Legal Grounds

Where applicable law requires a legal basis, the basis depends on the purpose and circumstances.

Where we rely on legitimate interests, we consider the effect on individuals and whether their interests or fundamental rights override ours.

We do not rely on this table to avoid consent or another condition required by applicable law.

If required information is not provided, we may be unable to process an Order, verify eligibility, complete delivery or provide a requested service. We will explain this where relevant.

5. Shopify and Shopify Network Intelligence

Our store is hosted on Shopify, which provides the platform supporting our online store and associated services.

Shopify receives and processes personal information about access to and use of our store, including information submitted during shopping and checkout.

Shopify Network Intelligence is enabled for our store.

This allows Shopify to use personal information from interactions with our store together with information from interactions with Shopify and other merchants to provide enhanced services. Depending on the features used, these may include personalisation, analytics, store improvements and advertising-related services.

For certain enhanced services, Shopify is responsible for processing your information and responding to requests concerning its processing.

You can learn more about Shopify’s practices and available choices through:

• Shopify Consumer Privacy Policy
• Shopify Privacy Portal

Your applicable consent and opt-out choices must be respected in connection with these services.

6. Service Providers and Other Disclosures

We disclose personal information where necessary and lawful for the purposes described in this Policy.

Relevant recipients may include:

• Service providers and technology partners: website hosting, software, account administration, communications, support, analytics and other operational services.
• Payment and financial providers: payment verification, processing, reconciliation, refunds and fraud prevention.
• Fulfilment and logistics partners: preparing Orders, arranging transportation, delivery and investigating shipment issues.
• Manufacturers, suppliers and qualified specialists: investigating Product quality, authenticity, safety or conformity concerns.
• Customs and regulatory authorities: clearance, verification and legal compliance.
• Professional advisers and insurers: accounting, legal advice, insurance matters and dispute resolution.
• Marketing and advertising partners: where relevant features are used and the disclosure is permitted by your choices and applicable law.

We seek to limit disclosures to information relevant to the purpose.

Where a provider processes information on our behalf, appropriate contractual protections are required. Some recipients act as independent controllers and have their own legal obligations and privacy notices.

We may also disclose information where reasonably necessary to:

• Comply with a binding legal requirement.
• Protect individuals against harm.
• Investigate fraud or unlawful activity.
• Establish, exercise or defend legal claims.
• Support a genuine business restructuring or transfer, subject to appropriate safeguards and notice where required.

7. Sale, Sharing and Advertising Choices

We do not sell customer lists or personal information for money.

However, privacy laws in some jurisdictions define “sale”, “sharing” or “targeted advertising” more broadly than an exchange for payment.

Certain disclosures through advertising technologies or Shopify’s enhanced services may fall within those definitions, depending on the features used and applicable law.

Where such processing occurs and a legal opt-out right applies, you may exercise that right through the relevant privacy controls or by contacting us.

This distinction does not mean that unrelated businesses receive unrestricted access to your customer account or Order records.

8. Cookies and Similar Technologies

Our website and technology partners may use cookies, pixels, local storage and similar technologies.

These technologies may support:

• Essential functions: cart operation, checkout, account access, security and remembering privacy choices.
• Preferences: remembering selected settings and improving convenience.
• Analytics: understanding website use and performance.
• Marketing and personalisation: measuring campaigns, personalising content and supporting relevant advertising.

Where required by law, optional technologies must remain inactive until you provide consent.

You can use the website’s cookie or privacy controls to manage available choices and withdraw consent. Browser controls can also restrict cookies, although this may affect some website functions.

Rejecting optional cookies does not remove access to essential purchasing functionality.

The technologies used, their providers and their durations should be reflected in the information made available through the relevant cookie controls.

9. Marketing Communications

We may send promotional communications where you have consented or another specific legal permission applies.

You can stop promotional communications by:

• Using the unsubscribe option in an email.
• Following an available opt-out instruction in another channel.
• Contacting us at info@lushfills.com.

Withdrawing marketing permission does not prevent necessary messages concerning Orders, payments, delivery, recalls or a request you have submitted.

We may retain limited suppression information to avoid sending marketing after an opt-out.

Marketing permissions are separate from agreement to our Terms and Conditions.

10. Professional Verification and Identity Documents

Where necessary, we may process professional registration, business information, identity details or authorisation documents to assess eligibility or meet legal requirements.

We aim to:

• Request only information relevant to the check.
• Limit access to staff and providers who need it.
• Avoid retaining complete document copies where a limited verification record is sufficient.
• Retain records only for an appropriate purpose and period.

Please redact unrelated information where it is not required for the check. We will explain where an unredacted document is necessary.

11. Product Complaints and Sensitive Information

Some complaints may involve treatment photographs, medical reports or other information concerning health.

Please do not send identifiable patient records or unnecessary medical information through ordinary email or messaging. Contact us first so we can identify what information is needed and an appropriate method for providing it.

Where sensitive information is necessary:

• We will identify an appropriate legal basis and any additional condition required by law.
• We will limit its use to the relevant investigation, safety obligation or legal matter.
• We will restrict access and disclosures.
• We will seek anonymised or redacted information where that can meet the purpose.

A customer’s consent does not automatically authorise disclosure of another person’s medical information.

Where necessary and lawful, relevant information may be provided to a manufacturer, qualified specialist, insurer, legal adviser or competent authority.

Complaint evidence will not be repurposed as marketing content without separate appropriate permission.

12. Reviews, Photographs and Testimonials

If you submit content for publication, the information you choose to include may become publicly visible.

Please do not include another person’s identifying or sensitive information without appropriate permission.

We will obtain consent or other required permission before using identifiable photographs, videos or testimonials for promotional purposes.

Where publication relies on consent, you may withdraw that consent by contacting us. We will explain any practical limits affecting material already lawfully distributed or independently reproduced by others.

13. International Processing and Transfers

Our business uses international service and fulfilment arrangements.

Personal information may be accessed or processed in countries other than the country where you live, including locations where Shopify, fulfilment partners, carriers and other relevant providers operate.

The legal protections in those countries may differ.

Where an international transfer is subject to legal restrictions, the transfer must use an applicable mechanism, such as:

• A recognised adequacy decision.
• Appropriate contractual safeguards, including approved standard contractual clauses.
• Another legally permitted transfer mechanism or narrowly applicable exception.

Additional safeguards will be applied where required.

You may contact us for information about relevant safeguards and how to obtain a copy or explanation, subject to necessary redactions.

14. How Long We Keep Information

We retain personal information for as long as reasonably necessary for the relevant purpose, subject to legal requirements.

Information may need to be preserved longer for an active dispute, investigation or binding legal requirement.

When retention is no longer necessary, information should be deleted or anonymised. Backup copies may remain temporarily within established backup cycles and must not be restored to ordinary use without an appropriate reason.

A deletion request does not automatically require removal of records we must lawfully retain.

15. Information Security

We use appropriate technical and organisational measures designed to protect personal information.

Measures should be proportionate to the information and risks involved and may include access controls, secure systems, staff confidentiality obligations and provider safeguards.

No website, communication channel or storage system can be guaranteed completely secure.

Please protect your account credentials and avoid sending complete payment-card details or unnecessary sensitive information through support channels.

If a personal data breach occurs, we will assess and fulfil applicable notification and response obligations.

16. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• Obtain information about our processing.
• Request access to personal information.
• Correct inaccurate or incomplete information.
• Request deletion.
• Restrict certain processing.
• Receive eligible information in a portable format.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Withdraw consent without affecting processing lawfully undertaken before withdrawal.
• Opt out of qualifying sale, sharing or targeted advertising.
• Exercise applicable rights concerning significant automated decisions.
• Complain to a competent data protection authority.

Rights are subject to applicable conditions and exceptions. We will explain a refusal or limitation where required.

Where EU or UK data protection rules apply, objection to processing for direct marketing must be respected.

17. Additional United States Privacy Rights

Where a relevant US state privacy law applies to our business and your information, additional rights may include:

• Knowing the categories and specific information collected.
• Knowing relevant sources, purposes and recipient categories.
• Correcting or deleting eligible information.
• Opting out of qualifying sale, sharing or targeted advertising.
• Limiting certain uses of sensitive information where the law provides that right.
• Using an authorised agent.
• Appealing a request decision where required.
• Exercising rights without unlawful discrimination.

Where legally required, recognised opt-out preference signals, such as Global Privacy Control, must be honoured.

Applicable rights and procedures depend on the law governing the request. This section does not represent that every US privacy statute applies to every transaction.

18. How to Submit a Privacy Request

Send requests to:

Email: info@lushfills.com
Phone / WhatsApp: +372 5360 2282

Describe the request and provide enough information for us to locate the relevant records.

We may verify your identity or an agent’s authority using proportionate information. We will not request excessive documents simply to discourage a request.

Requests are ordinarily handled without charge, subject to lawful exceptions.

Where EU or UK GDPR applies, we generally respond within one month. A permitted extension may apply to complex or numerous requests, with notice and reasons provided within the initial period.

Where the CCPA applies, qualifying access, correction and deletion requests generally have a 45-day response period, subject to a lawful extension. Different deadlines apply to some choices, including opt-outs.

Other applicable legal deadlines will be respected.

If we cannot fulfil a request in full, we will explain the reason and any available review or complaint route.

19. Children

Our services are directed to adults and are not intended for individuals under 18.

If you believe a minor has provided information through our services, contact us.

We will assess the circumstances and take appropriate action, including deletion where required, while retaining limited records only where a lawful obligation or safeguarding purpose justifies it.

20. External Websites and Communication Platforms

Links to external websites and interactions through messaging or social platforms may involve processing by those providers.

Their privacy notices govern processing for which they are independently responsible.

Please review the relevant provider’s privacy information before sharing sensitive or unnecessary personal information.

21. Changes to This Policy

We may update this Policy to reflect changes in our practices, services or legal requirements.

The updated version will display a revised date. We will provide additional notice of material changes where required.

If a new use requires consent, publishing an updated policy does not replace obtaining that consent.

22. Contact and Complaints

LUSHFILLS
Email: info@lushfills.com
Phone / WhatsApp: +372 5360 2282

Please identify your message as a privacy enquiry where appropriate.

You may complain to a competent data protection authority without first contacting us. Where EU or UK rules apply, this may include the authority in your place of habitual residence, place of work or the location of an alleged infringement.