Privacy Policy

Last updated: September 12, 2026

May-London operates this store and website, including its related content, features, tools, products and services, collectively referred to as the “Services”.

Our store is powered by Shopify. This Privacy Policy explains how personal information is collected, used, stored and disclosed when you browse our website, place an order, use the Services or communicate with us.

For processing that we determine, May-London acts as the data controller. Shopify and other providers may also act as independent controllers for certain processing undertaken for their own purposes.

This Privacy Policy does not constitute a request for consent. Where consent is required, it will be requested separately.

Personal Information We Collect

Personal information means information that identifies you or can reasonably be linked to you.

Depending on how you use the Services, we may collect the following categories of information:

• Identity and delivery details: your name, billing address, shipping address, email address and telephone number.
• Order and transaction information: products purchased, order amounts, payment status, delivery details, returns, refunds and exchanges.
• Payment information: information needed by payment providers to process your transaction, together with payment confirmations and limited payment details made available to us. Full payment credentials are handled by the relevant payment provider.
• Account information: account identifiers, saved preferences and account settings, where account features are available.
• Communications: information you provide in questions, requests, feedback or other correspondence.
• Device and technical information: IP address, browser type, device identifiers, operating system and connection information.
• Usage information: pages viewed, products browsed, cart activity and interactions with the Services.
• Privacy and marketing preferences: consent records, cookie choices and communication preferences.

Not all categories are collected during every interaction.

Sources of Personal Information

We collect personal information:

• Directly from you when you place an order, complete a form, create an account or communicate with us.
• Automatically when you use the Services, including through cookies and similar technologies, subject to applicable consent requirements.
• From Shopify and providers supporting payments, fulfilment, delivery, security and other store functions.
• From advertising or analytics partners where those services are enabled and the processing is permitted by law.

How We Use Personal Information

Orders and Store Services

We use information to process payments, fulfil orders, arrange delivery, manage returns and refunds, maintain accounts and provide order-related updates.

Customer Assistance

We use order details and communications to respond to questions, investigate delivery issues and resolve requests.

Security and Fraud Prevention

We use relevant transaction, account and technical information to identify suspicious activity, prevent fraud, protect accounts and maintain the security of the Services.

Store Improvement

Where permitted, we use browsing and usage information to understand how the store performs, identify technical problems and improve navigation and product presentation.

Marketing and Advertising

Where enabled and permitted by law, we use information to send promotional communications, measure campaign performance and display relevant advertisements.

Where consent is required for these activities, processing takes place only after that consent has been obtained.

Legal and Administrative Purposes

We use information to maintain required records, comply with legal obligations, respond to valid legal requests and establish, exercise or defend legal claims.

Legal Bases for Processing

Where the EU GDPR or UK GDPR applies, we rely on the following legal bases:

• Contract: processing necessary to fulfil your order or take steps you request before entering into a contract.
• Legal obligation: processing necessary for accounting, tax, consumer protection and other legal requirements.
• Legitimate interests: processing necessary to secure the store, prevent fraud, respond to enquiries and manage or improve our business, where those interests are not overridden by your rights.
• Consent: processing for activities that require your permission, including certain cookies and marketing activities.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Information necessary to process payment and deliver an order must be supplied for us to complete the purchase. Optional information and marketing consent are not conditions of purchase.

Cookies and Similar Technologies

The Services use cookies and similar technologies to support functions such as shopping carts, checkout, security and saved preferences.

Where enabled, additional technologies may be used for analytics, personalisation and advertising.

Non-essential technologies requiring consent must remain inactive until that consent is provided. Where cookie controls are available, you can use them to review or change your choices.

You may also manage cookies through your browser. Blocking certain cookies may affect store functionality.

How We Share Personal Information

We disclose personal information where necessary for the purposes described in this policy, including with:

• Shopify, which hosts and supports the store.
• Payment providers processing transactions.
• Fulfilment providers and carriers delivering orders.
• Technology providers supporting hosting, security, storage and customer assistance.
• Analytics and advertising providers, where enabled and legally permitted.
• Professional advisers where necessary for accounting, insurance or legal matters.
• Authorities or other parties where disclosure is legally required or necessary to protect legal rights.

Information may also be disclosed in connection with a proposed merger, acquisition or business transfer, subject to applicable safeguards.

Shopify’s Role

Shopify processes personal information to operate and support the Services.

Where Shopify Network Intelligence or other enhanced services are enabled, Shopify may also process information about interactions with this store together with information from interactions with other merchants and Shopify.

For some of these activities, Shopify acts as an independent data controller and is responsible for responding to requests concerning that processing.

Shopify’s own privacy disclosures explain its processing activities and the privacy choices available for those activities.

International Transfers

Personal information may be stored or processed in countries outside your country of residence.

Where information is transferred outside the European Economic Area or the United Kingdom, applicable transfer requirements must be met. Depending on the destination and circumstances, safeguards may include an adequacy decision, approved contractual clauses and any necessary supplementary measures.

Retention of Personal Information

We retain personal information for as long as necessary for the purpose for which it was collected.

Retention depends on the type of information and relevant requirements:

• Order, payment and invoice records are retained for applicable accounting, tax and legal periods.
• Account information is retained while needed to provide and administer the account.
• Correspondence is retained for as long as necessary to resolve the matter and address related obligations or disputes.
• Marketing preferences and consent records are retained as needed to administer and demonstrate your choices.
• Security and technical records are retained according to their operational purpose and the risks involved.

Certain information may need to be retained after an account is closed or a deletion request is received. Information no longer needed is deleted or anonymised.

Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, misuse, loss, alteration and disclosure.

No website, storage system or transmission method can guarantee absolute security.

Keep account credentials confidential and avoid including unnecessary sensitive information in messages.

Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Access personal information held about you.
• Correct inaccurate or incomplete information.
• Request deletion of personal information.
• Restrict certain processing.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Receive eligible information in a portable format.
• Withdraw consent where processing relies on consent.
• Opt out of certain targeted advertising, sale or sharing activities where applicable law provides that right.

These rights are subject to legal conditions and exceptions.

We may request proportionate information to verify your identity before fulfilling a request. An authorised representative may act on your behalf where permitted by law.

Requests will be handled within the applicable statutory timeframe. You will not be unlawfully discriminated against for exercising your rights.

Marketing Preferences

You can unsubscribe from promotional emails using the unsubscribe option included in those messages.

Unsubscribing from marketing does not stop necessary service communications, such as order confirmations, delivery updates, refund notifications or security notices.

Where available, advertising and cookie preferences can be managed through the relevant privacy controls.

Automated Processing

Shopify, payment providers and security services may use automated tools to assess transactions and identify potential fraud.

Where processing involves a solely automated decision producing legal or similarly significant effects, applicable disclosure requirements and safeguards apply, including rights to human intervention and to challenge a decision where required by law.

Children’s Privacy

The Services are intended for a general adult shopping audience and are not directed at children.

If we become aware that a child’s personal information has been collected without a lawful basis, appropriate steps will be taken to delete it or otherwise address the processing as required by law.

Third-Party Services

The Services may include integrations or features operated by third parties.

Those providers may process information under their own privacy policies. This policy describes May-London’s practices and does not replace the privacy disclosures of independent providers.

Complaints

You have the right to complain to the relevant data protection supervisory authority about the handling of your personal information.

In the Netherlands, this is the Autoriteit Persoonsgegevens. In the United Kingdom, this is the Information Commissioner’s Office.

Where the EU GDPR applies, you may also complain to the supervisory authority in the country where you normally live, work or believe an infringement occurred.

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Services, processing practices or legal requirements.

The latest version will be published on this website with an updated revision date. Additional notice will be provided where required by law.