Privacy policy

Privacy Policy

"Note: This policy applies to customers in both the United Kingdom and the United States. For UK customers, it is written to comply with the UK GDPR and the Data Protection Act 2018. The United States has no single federal law equivalent to the GDPR; instead, certain U.S. states (such as California, Colorado, Virginia, and others) have their own consumer privacy laws, which work differently — mainly through opt-out rights rather than the 'lawful basis' system described below. Where a section refers to a legal basis under Article 6, that basis applies specifically to UK customers; for U.S. customers, Sorelyne follows the same practices as a matter of policy and, where applicable, in compliance with the relevant state law."

1. General Information
Sorelyne takes the protection of your personal data seriously.
This privacy policy explains what personal data is processed when you visit our online shop, place an order, or contact us, for what purposes this occurs, and what rights you have under the UK GDPR, the Data Protection Act 2018, and other applicable data protection laws — including, where relevant, applicable U.S. state privacy laws.
Personal data means any information relating to an identified or identifiable natural person.

2. Data Controller
The data controller responsible for the processing of personal data in connection with the Sorelyne online shop is the operator of:
Sorelyne
Email: contact@sorelyne.com
Full details of the provider and operator are available in the online shop's legal/company information page.

3. Operation of the Online Shop via Shopify
Our online shop is provided through the Shopify e-commerce platform.
Shopify processes certain personal data necessary to technically operate the online shop, process orders, process payments, prevent fraud, and ensure the security of the shop.
This processing may be carried out by companies within the Shopify group. Depending on the location of the relevant service provider, processing may take place outside the United Kingdom, including in the United States.

"For UK customers, where such data leaves the UK, appropriate safeguards are used, such as adequacy regulations or the UK's International Data Transfer Agreement/Addendum. For U.S. customers, this processing generally occurs within the United States and does not raise the same cross-border transfer requirements."

Further details can be found in Shopify's own privacy notices.

4. Data Processed When Visiting the Online Shop
When you access our online shop, certain technical information may be processed automatically, including:

  • IP address;
  • date and time of access;
  • pages and files accessed;
  • referrer URL;
  • browser type and version;
  • operating system;
  • device information;
  • language settings;
  • approximate location information;
  • access status and volume of data transferred;
  • technical log and security data.

This processing takes place in order to:

  • technically provide the online shop;
  • enable a stable and secure connection;
  • detect and resolve errors;
  • prevent misuse or fraudulent activity;
  • comply with applicable security requirements.

"For UK customers, the legal basis is Article 6(1)(f) UK GDPR. Our legitimate interest lies in the secure, reliable, and economical operation of our online shop. For U.S. customers, Sorelyne carries out this processing as part of its standard operation of the shop, in line with applicable state law."

5. Customer Account
If our shop allows you to create a customer account, we process the data you provide to create and manage that account.
This may include:

  • name;
  • email address;
  • phone number;
  • billing and delivery address;
  • order history;
  • saved preferences;
  • account status and login details.

"For UK customers, this processing takes place to carry out pre-contractual steps and to perform the contract, under Article 6(1)(b) UK GDPR."

You may request deletion of your customer account by email. Statutory retention obligations remain unaffected.

6. Orders and Contract Processing
When you place an order, we process the data necessary to carry out the contract.
This includes, in particular:

  • first and last name;
  • email address;
  • phone number, where provided or required;
  • billing address;
  • delivery address;
  • products ordered;
  • order number;
  • order value, in pounds sterling (£) for UK orders or US dollars ($) for US orders;
  • payment status;
  • shipping and delivery information;
  • communication relating to the order;
  • information on withdrawal, return, complaints, and refunds.

"For UK customers, this processing takes place under Article 6(1)(b) UK GDPR to process your order and perform the sales contract, and, where data is retained to meet tax, commercial, or other legal obligations, under Article 6(1)(c) UK GDPR. For U.S. customers, this data is processed to fulfil your order as a matter of contract with Sorelyne, and retained where required under applicable U.S. federal or state recordkeeping and tax rules."

7. Payment Processing
For payment processing, the data required for this purpose is transmitted to the payment service provider you select.
Depending on the payment method available at checkout, this may include, in particular:

  • name;
  • billing address;
  • email address;
  • order number;
  • order amount, in the applicable currency (£ for UK orders, $ for US orders);
  • currency;
  • payment status;
  • technical transaction data;
  • any further information required for payment verification.

The relevant payment service provider may, in part, process payment data under its own data protection responsibility.
We generally do not receive full credit card or bank details, only information on whether a payment was successful, declined, or is still pending.

"For UK customers, the legal basis is Article 6(1)(b) UK GDPR. Where processing is carried out to prevent fraud or payment default, it may additionally be based on Article 6(1)(f) UK GDPR. For U.S. customers, this processing is carried out to fulfil your payment as part of the purchase contract."

8. Shipping and Delivery
To deliver your order, we share the necessary data with shipping, logistics, and fulfilment service providers.
This may include:

  • name;
  • delivery address;
  • email address;
  • phone number, where required for delivery;
  • order or shipment number;
  • information on the size, weight, and contents of the shipment;
  • customs information, where required.

"For UK customers, this processing takes place under Article 6(1)(b) UK GDPR to perform the contract. For U.S. customers, this data is shared with carriers as part of fulfilling your order."

Shipping providers may send you their own notifications about shipment status, where necessary for delivery or where you have consented to this.

9. Contact and Customer Service
If you contact us by email or through a contact form, we process the information you submit.
This may include:

  • name;
  • email address;
  • order number;
  • content of your inquiry;
  • attachments, photos, or videos;
  • time and history of communication.

"For UK customers, where your inquiry relates to a contract or order, processing takes place under Article 6(1)(b) UK GDPR. For general inquiries, processing is based on our legitimate interest in proper customer communication, under Article 6(1)(f) UK GDPR. For U.S. customers, this data is processed to respond to your inquiry as part of our ordinary customer service."

10. Newsletter and Marketing Emails
If you have expressly consented to receive a newsletter or other marketing emails, we use your email address to send you information about Sorelyne's products, offers, and promotions.

"For UK customers, the legal basis is your consent under Article 6(1)(a) UK GDPR. For U.S. customers, this is based on your opt-in consent and/or applicable state marketing-communication requirements (such as CAN-SPAM at the federal level)."

Where legally permitted, we may inform existing customers by email about similar products of our own. You may object to this use at any time, free of charge beyond the basic transmission costs.
You may withdraw your consent at any time via the unsubscribe link in the relevant message, or by email to contact@sorelyne.com.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

11. Cookies and Similar Technologies
Our online shop uses cookies and similar technologies.
Strictly necessary cookies are required to provide basic functions of the shop, in particular:

  • shopping cart functionality;
  • checkout;
  • login;
  • language settings;
  • fraud prevention;
  • security;
  • storing your privacy preferences.

"For UK customers, the processing of strictly necessary technical information is based on applicable legal requirements and, where personal data is involved, on Article 6(1)(b) or (f) UK GDPR. For U.S. customers, this processing takes place under applicable state cookie/tracking-technology requirements, where they apply."

Non-essential cookies, in particular for statistics, analytics, personalisation, or marketing, are only used if you have previously consented via the cookie banner.

"For UK customers, the legal basis for any resulting processing of personal data is Article 6(1)(a) UK GDPR. For U.S. customers, this processing is subject to your cookie preferences and, where applicable, your right to opt out of the sale or sharing of personal information under state law."

You can withdraw or change your consent at any time via the cookie settings available in the online shop.

12. Analytics and Marketing Services
Where you have consented, analytics and marketing technologies may be used to:

  • evaluate use of the shop;
  • measure reach and conversions;
  • personalise advertising;
  • build audiences for advertising campaigns;
  • measure the effectiveness of ads;
  • recognise users across devices or websites.

This may involve processing, in particular, IP address, cookie identifiers, device information, usage behaviour, shopping cart contents, and order events.

"For UK customers, this processing takes place strictly to the extent of your consent under Article 6(1)(a) UK GDPR. For U.S. customers, this processing is subject to your right to opt out of targeted advertising and the 'sale' or 'sharing' of personal information under applicable state law."

Which services are actually used depends on the apps, integrations, and marketing channels enabled in the online shop.

13. Recipients of Personal Data
Personal data may, where necessary, be shared with the following categories of recipients:

  • Shopify and connected technical service providers;
  • hosting and IT service providers;
  • payment service providers;
  • banks and financial service providers;
  • shipping, logistics, and fulfilment companies;
  • customer service and communication providers;
  • analytics and marketing providers, where consent has been given;
  • accounting, tax, and legal advisors;
  • authorities, courts, or other public bodies, where there is a legal obligation to do so.

Service providers who process personal data on our behalf are contractually bound in accordance with applicable legal requirements.

14. Transfers Outside the UK or the US
Some service providers may process personal data in countries outside the United Kingdom (for UK customers) or may process data across state or national lines within, or in connection with, the United States (for US customers).

"For UK customers, such a transfer only takes place if the legal requirements are met. This may include: a UK adequacy regulation; appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; binding corporate rules; or a statutory exception under Article 49 UK GDPR / the applicable UK provisions. Despite appropriate safeguards, processing in certain third countries may involve a level of data protection that differs from that in the UK."

"For U.S. customers, this section instead reflects our use of service providers who may operate or store data outside your state of residence. Where applicable state law gives you the right to know about, or opt out of, the 'sale' or 'sharing' of your personal information with third parties, you can exercise that right as described in Section 16."

15. Storage Period
We store personal data only for as long as necessary for the relevant processing purpose or for as long as required by applicable statutory retention obligations.
Order, invoice, and payment information may be stored in accordance with applicable commercial and tax retention obligations (for example, under UK company and tax law, or applicable U.S. federal and state recordkeeping and tax requirements).
Customer service inquiries are stored for as long as necessary to handle them and for any follow-up questions or legal claims.
Data processed on the basis of consent is generally stored until the consent is withdrawn, unless another legal basis or statutory retention obligation applies.
Once the purpose of processing no longer applies, the data is deleted or blocked.

16. Your Data Protection Rights

"UK customers: Under the UK GDPR and the Data Protection Act 2018, you have, in particular, the following rights, which you can exercise by contacting us at contact@sorelyne.com:"

  • right of access to your personal data;
  • right to rectification of inaccurate or incomplete data;
  • right to erasure;
  • right to restriction of processing;
  • right to data portability;
  • right to object to certain processing;
  • right to withdraw consent given;
  • right not to be subject to a decision based solely on automated processing, where the legal requirements are met;
  • right to lodge a complaint with a data protection supervisory authority.

"U.S. customers: Depending on your state of residence, applicable state privacy law (for example, in California, Colorado, Connecticut, Virginia, or other states with a comprehensive privacy law) may give you similar, though not identical, rights — typically including the right to know what personal information is collected, the right to request deletion, the right to correct inaccurate information, and the right to opt out of the sale or sharing of your personal information and of targeted advertising. These rights work on an opt-out basis rather than the UK's consent/legal-basis model. To exercise any available right, please contact us at contact@sorelyne.com."

17. Right to Object

"For UK customers: " where personal data is processed under Article 6(1)(e) or (f) UK GDPR, you have the right to object at any time, on grounds relating to your particular situation, to that processing.
Where personal data is processed for direct marketing purposes, you may object to that processing at any time, without giving any reason.

18. Withdrawal of Consent
You may withdraw any consent given at any time, with future effect.
Withdrawal does not affect the lawfulness of processing carried out on the basis of your consent before the withdrawal.

19. Right to Complain

"UK customers may lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection, if they believe that the processing of their personal data infringes data protection law."

"There is no direct U.S. equivalent to the ICO. U.S. customers who believe their state privacy rights have been infringed may raise a complaint with their state Attorney General's office, where applicable state law provides for this."

20. Data Security
We and our technical service providers implement appropriate technical and organisational security measures to protect personal data against loss, alteration, unauthorised access, and other unlawful processing.
Data transmission within the online shop is generally encrypted.
However, fully risk-free data transmission over the internet cannot be guaranteed.

21. Changes to This Privacy Policy
We may amend this privacy policy if legal requirements, technical functions, service providers used, or our data processing activities change.
The version published in the online shop at any given time applies.
Last updated: 6 August 2026

Contact
For questions about data protection or to exercise your rights, you can reach Sorelyne at:
Email: contact@sorelyne.com