Privacy policy

PRIVACY POLICY

Last updated: 17 August 2026

OVERVIEW

Carried in Grace (“we”, “us” and “our”) operates this website and online store, including the related information, content, features, tools, products and services (collectively, the “Services”). Our store is hosted by Shopify, which provides the ecommerce platform that enables us to offer the Services.

This Privacy Policy explains how we collect, use, disclose and otherwise process personal information when you visit or use the Services, place an order, create an account, subscribe to marketing or communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy concerning personal information, this Privacy Policy applies.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood how personal information is handled as described below.

1. WHO IS RESPONSIBLE FOR YOUR INFORMATION

For the purposes of applicable data-protection law, Carried in Grace is the controller of the personal information described in this Privacy Policy, except where another organisation acts as an independent controller as explained below.

You can contact us about privacy matters at:

Trading name: Carried in Grace
Email: info@carriedingrace.com
Contact form: https://carriedingrace.com/pages/contact

Please do not include payment-card details, passwords or other highly sensitive information in ordinary email or contact-form messages.

2. PERSONAL INFORMATION WE COLLECT

“Personal information” means information that identifies you or can reasonably be linked to you. It does not include information that has been made anonymous so that it can no longer reasonably identify you.

Depending on how you interact with the Services, we may process:

• Contact information, such as your name, email address, telephone number, billing address and shipping address.
• Order and transaction information, such as products viewed, added to a cart or wishlist, purchased, returned, exchanged or cancelled; order numbers; transaction dates; payment status; delivery information and order history.
• Payment-related information. Payments are processed by Shopify and the selected payment provider. We generally receive payment status and limited transaction details rather than complete payment-card numbers.
• Account information, such as login details, preferences and account settings.
• Communications, including information you provide when contacting customer service, requesting a return or submitting a review.
• Device and technical information, such as IP address, browser type, device identifiers, operating system and network information.
• Usage information, such as pages viewed, interactions with the Services, referring pages, approximate location derived from an IP address and timestamps.
• Marketing and consent information, such as newsletter preferences, cookie choices and advertising consent where applicable.
• Fraud-prevention and security information, such as signals used to identify suspicious orders, account misuse or unlawful activity.

Please provide personal information about another person, such as a gift recipient, only if you are authorised to do so.

3. HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information:

• Directly from you when you browse the store, place an order, create an account, contact us, submit a review, request a return or subscribe to marketing.
• Automatically through cookies and similar technologies when you use the Services, subject to your consent choices where required.
• From Shopify and other service providers that help us operate the store, process payments, prevent fraud, provide analytics, deliver orders or support customers.
• From advertising, social-media or business partners where permitted by law and consistent with your privacy choices.

4. HOW AND WHY WE USE PERSONAL INFORMATION

We use personal information for the following purposes and, where the GDPR or similar law applies, on the following legal bases:

Providing the Services and performing our contract with you

We process information to operate the store, process payments and orders, deliver products, provide order and account updates, handle returns and refunds, respond to customer-service requests and maintain your account. This processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.

Security and fraud prevention

We use information to authenticate accounts, secure payments, prevent fraud, detect malicious or unlawful activity and protect customers, our business and the Services. We rely on our legitimate interests in operating a secure business and, where applicable, compliance with legal obligations.

Customer service and business communications

We use information to answer questions, investigate delivery or product issues and maintain our relationship with you. Depending on the communication, we rely on performance of a contract, steps requested by you or our legitimate interest in providing effective customer service.

Marketing and advertising

Where permitted, we may use information to send marketing communications and measure or personalise advertising. We rely on consent where it is required, including for non-essential cookies and certain electronic marketing. Where permitted without consent, we may rely on our legitimate interest in responsibly promoting our products. You can unsubscribe from promotional emails at any time using the link in the message.

Analytics and improvement

We may analyse how customers use the Services to understand performance, improve navigation, develop products and measure campaigns. We rely on consent for non-essential analytics cookies where required and otherwise on our legitimate interest in improving the Services.

Legal compliance and claims

We process information when necessary to comply with tax, accounting, consumer-protection, product-safety, fraud-prevention or other legal obligations; respond to lawful government requests; enforce our terms; resolve disputes; and establish, exercise or defend legal claims.

If we ask for information that is required to enter into or perform a contract, failure to provide it may mean that we cannot process an order, deliver a product or provide the requested service.

5. COOKIES AND SIMILAR TECHNOLOGIES

We and our service providers use cookies and similar technologies to operate the website, remember choices, protect checkout, understand usage and, where enabled, support advertising.

Essential technologies are used where necessary to provide the Services and secure the website. We request consent for non-essential analytics, personalisation or advertising technologies where required by law.

You can manage available choices through the cookie banner or privacy settings shown on the website. You can also adjust browser settings, although blocking essential cookies may prevent parts of the Services from working correctly.

6. HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information where reasonably necessary to:

• Shopify, which hosts and supports the ecommerce platform.
• Payment providers, banks and fraud-prevention services that process and secure payments.
• Fulfilment, warehouse, shipping and delivery providers that deliver orders.
• Technology, hosting, analytics, customer-support, email and cloud-service providers that act on our behalf.
• Marketing and advertising partners, subject to applicable law and your consent or opt-out choices.
• Professional advisers, insurers, auditors, courts, regulators and public authorities where necessary for legal compliance or claims.
• A prospective purchaser or successor in connection with a merger, financing, reorganisation or sale of all or part of our business, subject to appropriate confidentiality and legal safeguards.
• Other parties when you direct us to disclose information or provide consent.

Service providers may process personal information only for the services they provide to us and under appropriate contractual or legal obligations. Some partners, including Shopify in certain circumstances, may act as independent controllers and apply their own privacy notices.

We do not disclose personal information merely in exchange for money. Certain privacy laws define “sale”, “sharing” or “targeted advertising” more broadly. Where those laws apply, you may use the “Your Privacy Choices” option in our website footer or contact us to exercise available opt-out rights.

7. RELATIONSHIP WITH SHOPIFY

The Services are hosted by Shopify. Shopify collects and processes personal information about access to and use of the Services to provide and improve its platform and related services. Information submitted through the store is transmitted to Shopify and may be shared with authorised service providers in countries other than your own.

If Shopify Network Intelligence or Enhanced Services are enabled, Shopify may also process information from interactions with our store, other merchants and Shopify to provide more personalised experiences, advertising measurement, relevant advertising, analytics, security and service improvements. Shopify may act as an independent controller for some of this processing.

You can learn more in the Shopify Consumer Privacy Policy and exercise rights relating to Shopify’s independent processing through the Shopify Privacy Portal:

https://privacy.shopify.com

Your cookie and privacy choices made through our properly configured Shopify privacy tools may also be communicated to Shopify as described in Shopify’s privacy documentation.

8. THIRD-PARTY WEBSITES

The Services may link to websites or platforms operated by third parties. Their privacy and security practices are governed by their own notices. We are not responsible for websites that we do not own or control. Please review their policies before providing personal information.

Information you post in public or semi-public areas, including social-media platforms, may be visible and used by other people. Consider this before making information public.

9. CHILDREN’S INFORMATION

The Services are not directed to children, and we do not knowingly collect personal information from children who are below the age at which they can lawfully consent to the relevant processing in their jurisdiction.

If you are a parent or guardian and believe a child has provided personal information to us, contact us so that we can investigate and, where appropriate, delete it.

We do not knowingly sell or share, as those terms are defined by applicable law, personal information of individuals under 16 years of age.

10. SECURITY

We use reasonable technical and organisational measures designed to protect personal information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Do not send passwords, complete payment-card details or other highly sensitive information through ordinary email or the contact form. You are responsible for keeping your account credentials confidential.

11. RETENTION

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing the Services, maintaining accounts, complying with tax and accounting obligations, resolving disputes, preventing fraud and enforcing agreements.

Retention periods depend on the type of information, the nature of our relationship, legal limitation periods and applicable record-keeping requirements. When information is no longer required, we delete or anonymise it in accordance with applicable law and our operational processes.

12. YOUR RIGHTS AND CHOICES

Depending on where you live and subject to applicable exceptions, you may have the right to:

• Request access to and a copy of personal information we hold about you.
• Request correction of inaccurate or incomplete information.
• Request deletion of personal information.
• Request restriction of certain processing.
• Object to processing based on legitimate interests, including certain profiling.
• Receive certain information in a portable format and request its transfer where technically feasible.
• Withdraw consent at any time where processing is based on consent. Withdrawal does not affect processing carried out before consent was withdrawn.
• Opt out of certain sale, sharing or targeted advertising as defined by applicable privacy law.
• Lodge a complaint with a competent data-protection authority.

To exercise a right, email info@carriedingrace.com or use https://carriedingrace.com/pages/contact. Describe your request and provide enough information for us to identify the relevant account or transaction.

We may need to verify your identity before completing a request. You may authorise another person to submit a request where permitted by law, but we may ask for evidence of that authority. We will not discriminate against you for exercising an applicable privacy right and will respond within the period required by law.

You may unsubscribe from promotional emails at any time through the unsubscribe link in the email. Even if you unsubscribe from marketing, we may continue to send non-promotional messages relating to your account, orders or legal notices.

If your request concerns processing for which Shopify acts independently, you can also use https://privacy.shopify.com.

13. AUTOMATED DECISION-MAKING

We and our providers may use automated tools to identify suspicious transactions, protect accounts and prevent fraud. These tools may flag or temporarily block a transaction for review.

We do not intentionally make decisions based solely on automated processing that produce legal or similarly significant effects for you, except where permitted by law, necessary to enter into or perform a contract, or based on explicit consent with the safeguards required by law.

14. INTERNATIONAL TRANSFERS

Shopify and other providers may process personal information outside the European Economic Area, the United Kingdom or your country of residence.

Where required, international transfers are protected through an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or another legally recognised transfer mechanism, together with supplementary safeguards where appropriate.

15. COMPLAINTS

If you have a concern about how we process personal information, please contact us first at info@carriedingrace.com or through https://carriedingrace.com/pages/contact so that we can investigate.

You also have the right to lodge a complaint with the data-protection authority in the country where you live or work, or where you believe an infringement occurred. In the Netherlands, the supervisory authority is the Autoriteit Persoonsgegevens:

https://autoriteitpersoonsgegevens.nl

16. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy to reflect changes to our Services, providers, privacy settings, business practices or legal obligations. We will publish the revised version on this website, update the “Last updated” date and provide additional notice where required by law.

17. CONTACT

For questions about this Privacy Policy, our privacy practices or your privacy rights, contact:

Carried in Grace
Email: info@carriedingrace.com
Contact form: https://carriedingrace.com/pages/contact

For the purposes of applicable data-protection law, Carried in Grace is the controller of the personal information described in this Privacy Policy, except where another party is identified as an independent controller.