Last updated: 24 July 2026

This Privacy Policy explains how LILY & ROO collects, uses, stores and shares your personal information when you visit lilyandroo.com (the “Site”), place an order, contact us or otherwise use our services.

We want you to understand what information we hold, why we need it and the choices available to you.

Contact Us

If you have questions about this policy, would like more information about our privacy practices, wish to exercise your rights or want to make a complaint, please contact us:

• Email: info@lilyandroo.com

• Post: LILY & ROO, 49 Clarendon Road, Watford WD17 1HP, United Kingdom

The Personal Information We Collect

We collect information about your device, your use of the Site and the details required to process your purchases. We may also collect information when you contact our Client Services team. In this policy, “personal information” means information that identifies you or could reasonably be linked to you.

Device and Website Information

What we collect: 

Your browser type and version, IP address, time zone, cookie information, pages and products viewed, search terms, referring pages and information about how you interact with the Site.

Why we collect it: 

To display the Site correctly, maintain its security, understand how it is used and improve its performance.

How we collect it: 

Automatically through cookies, log files, web beacons, tags, pixels and similar technologies, subject to the choices available through our cookie settings.

Who we share it with: 

Service providers that support our website, analytics, security and advertising, including Shopify and our selected advertising partners.

Order and Customer Information

What we collect: 

Your name, billing and delivery addresses, email address, telephone number, order details and payment-related information. Payments are processed by our payment providers, and LILY & ROO does not ordinarily receive or store your complete card number.

Why we collect it: 

To process payment, fulfil and deliver your order, provide invoices and order confirmations, communicate with you, handle returns or customer queries, prevent fraud and comply with our legal obligations. Where permitted, we may also use your information to tell you about products or services that may interest you.

How we collect it: 

Directly from you when you place an order, create an account or contact us.

Who we share it with: 

Shopify, payment providers, delivery and fulfilment partners, returns providers, customer-service providers and other suppliers required to complete or support your order. Authorised staff may also access relevant order information through Claude, as explained below.

How We Share Personal Information

We only share personal information where it is reasonably necessary to operate our business, provide our services, meet a legal obligation or protect our rights. Recipients may include:

• Shopify, which powers our online store. You can read Shopify’s privacy notice at shopify.com/legal/privacy.

• Payment providers, including Klarna where you choose a Klarna payment method.

• Delivery, fulfilment, returns and logistics providers.

• Customer-service, email, marketing, analytics, website-personalisation and technology providers.

• Anthropic, where authorised staff use Claude as an internal productivity tool.

• Professional advisers, regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law.

• A buyer, investor or adviser in connection with a potential sale, merger, restructuring or transfer of all or part of our business, subject to appropriate confidentiality measures.

AI Tools Used by Our Team

We use Claude, an AI assistant supplied by Anthropic, PBC (“Anthropic”), as an internal productivity tool. Authorised team members may use it to find or manage information already held in our Shopify store - for example, to check an order, confirm stock availability or prepare a shipping label.

Claude is not customer-facing, does not communicate with customers directly and does not make decisions on our behalf. Our staff review the information and make any decision or take any action affecting a customer.

Information that may be processed: 

Your name, contact details, order details and delivery or billing information, but only where an authorised team member needs to access that information through the tool.

Why we use it: 

To help our team work more efficiently when managing orders, stock, fulfilment and customer queries.

International processing: 

Information processed through Claude may be transferred to the United States or other countries in which Anthropic or its service providers operate. Where required, we use appropriate contractual safeguards for international transfers, such as the UK International Data Transfer Addendum or Agreement and the European Commission’s Standard Contractual Clauses.

Automated decisions: 

Claude is not used by LILY & ROO to make solely automated decisions or carry out profiling that produces legal or similarly significant effects. Decisions affecting customers are made by people.

Retention: 

Information is retained in accordance with the settings and terms applying to our Anthropic account and our own retention requirements. You can learn more at privacy.claude.com and anthropic.com/legal/privacy.

Payment Information

If you choose a Klarna payment method, we may provide Klarna with contact and order details during checkout so that Klarna can assess your eligibility and tailor the available payment options. Klarna processes that information under its own privacy notice.

Marketing

Email Marketing

Where we have your consent, or another lawful basis permits us to do so, we may send you news, product updates, offers and other marketing from LILY & ROO. You can unsubscribe at any time using the link in any marketing email or by contacting us.

We share the information needed to provide these communications with our email and newsletter platform providers. These providers help us send messages and manage your subscription preferences.

Marketing by Post

Where permitted by law, we may use your postal address, or share it with a mailing partner acting on our instructions, to send LILY & ROO promotional material. You can opt out by emailing marketing@lilyandroo.com.

Behavioural and Targeted Advertising

Subject to your cookie choices and applicable law, we may use information about your activity on the Site, your purchases and your interactions with our advertising to measure campaigns and show you more relevant advertising.

We use services including Google Analytics and advertising platforms operated by companies such as Google and Meta. Some information may be collected directly by these partners through cookies, pixels or similar technologies.

You can manage non-essential cookies through our cookie settings. You can also review advertising preferences through the relevant platform:

• Google advertising settings: adssettings.google.com

• Meta advertising settings: facebook.com/adpreferences

• Digital Advertising Alliance opt-out tools: optout.aboutads.info

How We Use Personal Information

We use personal information to:

• Offer and supply our products and services.

• Process payments and manage orders, deliveries, returns, exchanges and refunds.

• Provide customer support and respond to enquiries.

• Maintain accounts, preferences and loyalty benefits.

• Detect and prevent fraud, misuse and security incidents.

• Improve our Site, products, services and customer experience.

• Send marketing and show advertising where permitted.

• Comply with legal, tax, accounting and regulatory requirements.

• Establish, exercise or defend legal claims.

Our Lawful Bases

Under the UK GDPR and, where applicable, the EU GDPR, we rely on one or more of the following lawful bases:

• Contract: where processing is necessary to provide a product or service you have requested.

• Consent: where you have actively agreed to a particular use, such as certain marketing or cookies. You can withdraw consent at any time.

• Legal obligation: where we must process information to comply with the law.

• Legitimate interests: where processing is necessary for our or another party’s legitimate business interests and those interests are not overridden by your rights and freedoms. This may include fraud prevention, service improvement, business administration and certain marketing activities.

• Vital interests or public task: where applicable in exceptional circumstances.

How Long We Keep Your Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to fulfil orders, provide support, meet tax and accounting requirements, resolve disputes, prevent fraud and comply with the law.

Retention periods vary according to the type of information and our legal or operational requirements. When information is no longer required, we delete it, anonymise it or securely restrict access to it. A request for erasure may be subject to legal exceptions that require or permit us to retain certain records.

Automated Decision-Making

You may have rights in relation to decisions based solely on automated processing, including profiling, where those decisions have legal or similarly significant effects.

Shopify may use limited automated tools to help identify potential fraud, such as temporarily blocking IP addresses associated with repeated failed transactions or payment cards associated with blocked IP addresses. These controls may remain in place for a limited period.

As explained above, LILY & ROO does not use Claude to make solely automated decisions about customers. Staff review the relevant information and make the final decision.

International Transfers

Some of our service providers process personal information outside the United Kingdom or European Economic Area, including in the United States and Canada.

Where required, we use an approved transfer mechanism or another lawful safeguard. This may include an adequacy decision, the UK International Data Transfer Agreement or Addendum, the European Commission’s Standard Contractual Clauses and appropriate supplementary measures.

Your Privacy Rights

Depending on where you live and the law that applies, you may have the right to:

• Ask for access to the personal information we hold about you.

• Ask us to correct inaccurate or incomplete information.

• Ask us to erase your information in certain circumstances.

• Ask us to restrict how we use your information.

• Object to certain processing, including direct marketing.

• Receive certain information in a portable format or ask us to transfer it.

• Withdraw consent at any time where processing relies on consent.

• Challenge certain decisions made solely through automated processing.

• Complain to a data protection authority.

To exercise your rights, contact us using the details at the beginning of this policy. We may need to verify your identity before completing a request. These rights are subject to legal conditions and exemptions.

California Privacy Rights

California residents may have rights to know about, access, correct or delete personal information, and to limit or opt out of certain uses or disclosures, subject to applicable law. You may also appoint an authorised agent to submit a request. Contact us using the details at the beginning of this policy.

Cookies

Cookies and similar technologies are small files or pieces of information stored on or accessed from your device. They help the Site work, remember your choices, understand how the Site is used and, where permitted, support advertising.

Some cookies are strictly necessary and do not require consent. Other cookies will only be used with your consent unless a legal exemption applies. Where we rely on an exemption for limited statistical or appearance-related purposes, we will provide the information and controls required by law.

Strictly Necessary and Functional Cookies

These cookies support essential functions such as navigation, checkout, account access, security, privacy choices and shopping-cart operation.

Reporting and Analytics Cookies

These cookies help us understand visits, referrals and Site performance. We use them with consent or under a legal exemption where the requirements for that exemption are met.

Marketing Cookies

With your consent, marketing and advertising cookies may measure how you use the Site, attribute sales or visits to advertising and affiliate partners, and help us show more relevant advertising.

Providers may include Google, YouTube, Meta (Facebook and Instagram), AdRoll, Rakuten Advertising, TikTok, Snapchat and Pinterest. The providers in use may change as our marketing arrangements develop.

Social Media Cookies

Social media buttons and embedded content may allow providers such as Meta, Pinterest or Snapchat to place or read cookies when you interact with them. Non-essential social media cookies are used only with your consent unless an exemption applies.

Managing Cookies

You can accept, reject or adjust non-essential cookies through our cookie settings. You can also control cookies through your browser. Blocking some cookies may affect how the Site works.

Session cookies generally expire when you close your browser. Persistent cookies remain until they expire or you delete them. The duration depends on the particular cookie and may range from a few minutes to several years.

For general guidance on managing cookies, visit allaboutcookies.org.

Do Not Track

Some browsers offer a “Do Not Track” signal. Because there is not currently a consistent industry standard for responding to that signal, the Site may not respond to it in a uniform way. You can use our cookie settings and the controls described above to manage your preferences.

Changes to This Policy

We may update this Privacy Policy to reflect changes to our practices, suppliers, technology or legal and regulatory requirements. When we make changes, we will update the date shown at the top of this policy.

Complaints

If you have a concern about how we use your information, please contact us first so that we can try to resolve it.

If you are not satisfied with our response, you may complain to the Information Commissioner’s Office (ICO) or your local data protection authority. ICO complaints information is available at ico.org.uk/make-a-complaint.