Privacy policy

This policy explains how Lavandela LLC ("Lavandela", "we", "us") collects, uses and shares personal information when you visit lavandela.com, design a piece, contact us, book a consultation, create an account or place an order. Lavandela LLC is a limited liability company formed in Delaware, USA. It is the business responsible for your personal information (the "controller" under European and UK data protection law).

Privacy Officer. The person responsible for privacy at Lavandela is our Privacy Officer. Email marley@lavandela.com with "Privacy" in the subject line, or call or WhatsApp +44 7975 666888. We answer 24 hours a day, 7 days a week.

In brief

We collect the information you give us to answer your questions, make your jewellery and deliver it, plus the technical information needed to run the website securely.
We do not sell your personal information. We do not share it for targeted (cross-context behavioural) advertising. We do not give it to other companies for their own marketing.
Card payments are handled by Stripe, our payment processor. Your card details go to Stripe and never reach us.
We use only essential cookies. We do not use analytics or advertising cookies.
You can ask to see, correct, delete or receive a copy of your information at any time.

Information we collect

Identifiers and contact details. Your name, email address, phone or WhatsApp number, delivery address, city and country. These come from you, through our forms, your account and, when you pay by card, the Stripe checkout page.

Order and purchase information. The pieces and diamonds you order, including grading report numbers, ring size, engraving text, gift message, the name and address of a gift recipient, delivery instructions, order notes, your preferred contact method, order status, the payment amount and status, and refunds. This comes from you and from Stripe.

Account information. Your name, email address and password, which is stored only as a salted one-way hash, never as the password itself. We also keep the designs, orders and consultations linked to your account. Under California law, your account log-in and password are "sensitive personal information". We use them only to give you access to your account.

Designs and preferences. The settings, diamonds, gold colours, sizes and engraving you choose. Also your bag, wishlist, saved designs and diamond comparison list, the 3D preview pictures of your designs and the currency you choose to see prices in. The skin tone you pick for the on-body views is kept only in your browser for the current visit.

Enquiries and consultations. Messages you send through our contact form, by email, by phone or on WhatsApp. For consultation bookings, the service, the time you chose, the video platform you prefer and any notes you add.

Reviews. Your rating, headline, review text, display name and city. We check these against your order reference and email address, and your email address is never published.

Newsletter. Your email address, and the date and page where you signed up.

Internet and device information. Your IP address, browser type, the pages you request, and the date and time, recorded in our server logs. Also a session identifier stored in a cookie.

How you use our website. Our own record of the pages you open, the buttons and links you press, the choices you make in our designers (such as setting, gold colour, size and diamond), what is in your bag, how you reached our website (such as a search engine or a link on another website) and the type of device you use, linked to your session identifier and, if you are signed in, to your account. We keep this ourselves and share it with no one. It is not recorded if your browser sends a Global Privacy Control or Do Not Track signal, or if you choose "Don't record my visits" on our cookie policy page.

Unfinished checkouts. If you type your name, email address, phone number or country into our checkout, we save them as you type, even if you do not send your order, so that we can help you complete it. We tell you this beside the checkout form. We contact you about an unfinished order by email only; we never call, text or WhatsApp you about it.

Information about other people. If you send a piece as a gift, you give us the recipient's name and address. Please do this only if you are entitled to share them.

What you must give us. You must give us your name, email address and delivery details to place an order; without them we cannot make or deliver it. To answer an enquiry or arrange a consultation, we need a way to reply to you. Everything else is optional.

We do not collect card numbers, precise location, biometric information, government identity documents or dates of birth. Our on-body views of necklaces, earrings and rings are rendered models and never use your camera. We do not build profiles of you, beyond remembering the designs you save and our own record of your visits described above, which we do not use to make decisions about you.

How we use it, and our legal bases

The legal bases in brackets apply to customers in the European Union, the United Kingdom and other places whose law requires one.

To take payment, then make, check, insure, deliver and look after your order, including returns, resizing, repairs and warranty claims (performance of our contract with you).
To answer your enquiries and arrange your consultation (steps you ask us to take before a contract, and our legitimate interest in answering you).
To run your account, keep your bag and saved designs, and show your orders (contract).
To send order, delivery and service messages (contract).
To send our newsletter, if you have signed up (your consent, which you can withdraw at any time).
To publish your review with the name and city you choose (your consent).
To understand how our website is used, where visitors find it hard to use, and to improve it, through our own record of visits (our legitimate interest in running and improving our website; you can object at any time, as explained under "How you use our website").
To contact you about an order you started but did not finish, using the details you typed into our checkout (our legitimate interest in helping you complete your purchase). We do this by email only, no more than twice, each email lets you opt out, and you can ask us to stop at any time.
To keep the site secure, limit repeated form submissions and prevent fraud (our legitimate interest in protecting our customers and our business).
To keep tax, accounting, customs and diamond-sourcing records, and to meet anti-money-laundering and sanctions rules (legal obligation).
To deal with complaints, disputes and legal claims (legitimate interest).

We use the phone or WhatsApp number you give us for an order or consultation only for that order or appointment. We do not send marketing calls, texts or WhatsApp messages unless you have agreed to receive them in a separate, unticked box. You can withdraw that agreement at any time by replying STOP or telling us.

We share personal information only as follows.

Stripe processes card payments and screens them for fraud. When you pay by card, it receives your email address, the items in your order (including engraving text and diamond grading report numbers), the amounts, and the details you enter on its checkout page, including your card details, which go to Stripe directly. Stripe's own privacy policy is at stripe.com/privacy.
Our workshop in Dubai, United Arab Emirates makes your piece. It receives what it needs to make and dispatch your order: the order reference, design, diamond, ring size and engraving text, and, where it dispatches the parcel, the delivery name, address and phone number.
Diamond suppliers receive only the identifier of the diamond you are considering or have ordered, so they can confirm its availability and price. Diamond photographs, 360° videos and grading reports on our diamond pages load from the supplier's own servers, which see your IP address and may set their own cookies.
Couriers and customs agents receive the delivery name, address, phone number, contents and value so they can deliver your parcel and clear it through customs.
Our hosting provider hosts our website and stores our records.
Our email provider carries the emails we send and receive.
Video-call services (Zoom, Google Meet or WhatsApp video, whichever you choose) host your consultation under their own terms.
WhatsApp (Meta) handles your messages if you choose to contact us on WhatsApp.
Professional advisers, authorities and buyers of our business. These are our lawyers, accountants and insurers; courts, regulators, tax and customs authorities when the law requires; and a buyer or successor if our business is sold, under this policy.

We require our service providers to keep your information secure and to use it only to provide their service to us.

Sale and sharing. We do not sell personal information, and we have not done so in the past 12 months. We do not share personal information for cross-context behavioural advertising. We do not disclose personal information to third parties for their own direct marketing. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

Categories disclosed for business purposes in the past 12 months: identifiers and contact details, order and purchase information, and account information, to Stripe, our workshop, couriers, customs agents, our hosting provider and our email provider. Internet and device information to our hosting provider.

Cookies, Do Not Track and Global Privacy Control

We use essential cookies to keep your bag, designs and sign-in. We do not use analytics or advertising cookies. Our cookie policy lists every cookie we use. We keep our own record of visits, described under "How you use our website", using the essential session cookie; no other company receives it.

If your browser sends a Global Privacy Control (GPC) or Do Not Track signal, we honour it: we load no analytics or advertising tools, and we do not keep our own record of your visits. Without your consent, no third party collects information through our site about your online activity over time and across other websites. Diamond suppliers' media servers see your IP address when their images and videos load.

How long we keep it

Orders, invoices, payment, customs and diamond-sourcing records: seven years after the order, to meet tax, accounting, customs and trade record-keeping rules.
Accounts: until you ask us to close your account, or three years after your last sign-in, whichever is sooner. Order records are then kept as above.
Enquiries and consultation bookings: two years after our last contact with you, unless they lead to an order.
Bags, wishlists and saved designs not linked to an account: 12 months after your last visit. Unfinished designs in the builders are deleted after 60 days, and 3D preview pictures are deleted once no saved design or order uses them.
Reviews: for as long as the review is published. You can ask us to remove it at any time.
Newsletter: until you unsubscribe. We then keep your email address only on a do-not-email list, so that we do not write to you again.
Our record of visits: 13 months, then deleted.
Contact details from an unfinished checkout: 90 days after you typed them, unless they become part of an order.
Server logs: 90 days. IP addresses used to limit repeated form submissions are held only in memory and cleared within a day.
Backups: we keep a backup copy of our records that is replaced every hour. If our records file is ever damaged, we keep the damaged copy for up to 30 days so that we can recover orders, then delete it. Our hosting provider's recovery copies of the server are deleted within 30 days. Information we delete therefore leaves all backups within 30 days.

How we protect it

The whole site uses encrypted connections (HTTPS). Passwords are stored only as salted one-way hashes. Our owner area is password-protected and used only by our own staff. Card details are handled entirely by Stripe. Repeated sign-in and form attempts are limited. If a security breach affects your personal information, we will tell you and the relevant authorities within the time the law requires.

Your rights and choices

Wherever you live, you can ask us to:

tell you what personal information we hold about you, where it came from, what we use it for and who we share it with, and give you a copy;
correct information that is wrong or incomplete;
delete your information, unless we must keep it, for example the order records described above;
give you a copy of the information you gave us in a commonly used electronic format;
stop sending you marketing, at any time and free of charge;
withdraw any consent you have given, without affecting what we did before;
object to, or restrict, our use of your information where the law gives you that right.

How to make a request. Email marley@lavandela.com with "Privacy request" in the subject line, or call or WhatsApp +44 7975 666888. If you have an account, you can see your details, designs and orders after signing in. To protect you, we confirm your identity by asking you to reply from the email address we hold, or to give the reference of an order you placed. Someone you authorise may make a request for you if they send us your written permission and we can confirm your identity.

When we reply. We confirm receipt within 10 business days and answer within 30 days. If a request is complex, we may extend this as far as your local law allows (up to two further months in the EU and UK, or 45 further days in US states), and we will tell you why. Requests are free.

Appeals. If we decline your request, you can appeal by replying with "Appeal" in the subject line. We will answer within 45 days. If you are still not satisfied, you can contact the attorney general of your state or your local data protection authority.

We will not treat you differently, or charge you a different price, for using any of these rights.

US state privacy rights

Residents of California, Delaware and other US states with consumer privacy laws have the rights above. They also have the right to opt out of the sale of personal information, of its use for targeted advertising, and of profiling that has legal or similarly significant effects. We do none of these things. We honour Global Privacy Control signals as described above. We use sensitive personal information (your account log-in) only to provide your account, so no request to limit its use is needed.

California. In the past 12 months we collected the categories listed under "Information we collect", from the sources and for the purposes described above, and kept them for the periods listed under "How long we keep it". Under California's "Shine the Light" law, California residents may ask us once a year whether we have disclosed personal information to third parties for their own direct marketing. We have not. To ask, email marley@lavandela.com with "Shine the Light" in the subject line.

Financial incentives. We do not offer discounts, prizes or other benefits in return for personal information, such as for signing up to our newsletter, so we run no financial incentive programme.

Nevada. We do not sell covered information as defined by Nevada law. Nevada residents may still send an opt-out request to marley@lavandela.com, and we will reply within 60 days.

Customers in the European Union, the United Kingdom and elsewhere

If you live in the European Union or the United Kingdom, the legal bases above apply. You have the right to complain to the data protection authority where you live or work. In the UK this is the Information Commissioner's Office (ico.org.uk). We would be glad to try to resolve your concern first.

International transfers. Lavandela LLC is based in the United States and our workshop is in the United Arab Emirates. Your information is therefore processed in the United States, the United Arab Emirates and the other countries where our service providers operate, which may not have the same data protection laws as your country. When we send personal information from the EU or the UK to a country without an adequacy decision, we use the European Commission's standard contractual clauses and the UK addendum to them, or rely on the recipient's certification under the EU-US Data Privacy Framework and its UK extension. You can ask us for a copy of these safeguards.

Canada. You may contact our Privacy Officer, the person in charge of personal information at Lavandela, at marley@lavandela.com or on +44 7975 666888. We do not use third-party analytics or advertising tracking. You can switch off our own record of your visits on our cookie policy page.

Australia. We handle your personal information in line with the Australian Privacy Principles. You can ask to see or correct it, or complain, using the contact details below. If you are not satisfied with our answer, you can complain to the Office of the Australian Information Commissioner (oaic.gov.au).

Automated decisions. We do not make decisions about you based solely on automated processing, except that Stripe's automated fraud screening may decline a card payment. If this happens, contact us and a person will review it.

Children

Our website is intended for adults and is not directed to children. You must be 18 or over to place an order. We do not knowingly collect personal information from anyone under 16. If we learn that we have, we will delete it.

Changes to this policy

When we change this policy, we publish the new version here with a new "Last updated" date. If a change is significant, we will also tell account holders and newsletter subscribers by email, and show a notice on the website, before it takes effect. Earlier versions are available on request.

Contact

Lavandela LLC
Address: 16192 Coastal Highway, Lewes, Delaware 19958, USA
Privacy Officer: marley@lavandela.com
Email: marley@lavandela.com (general and privacy questions), orders@lavandela.com (orders)
Phone and WhatsApp: +44 7975 666888, 24 hours a day, 7 days a week