Privacy policy

This policy explains how Holluxa (holluxa.com), operated by ARA Group LTD, handles your personal data under the UK GDPR and the Data Protection Act 2018. We are the data controller. You can contact us at any time at hello@holluxa.com.

What we collect

When you place an order we collect your name, email, phone number, delivery address and order details. Payments are processed by Stripe; we never see or store your full card details, only the payment confirmation. If you sign up to our newsletter we store your email address and where you signed up.

How we use it and why

We use your order details to process and deliver your order (our contract with you), to keep tax and accounting records (legal obligation), and to keep the site secure and improve it (legitimate interests). We send marketing emails only where you have opted in (consent), and you can unsubscribe at any time. We do not sell your data.

Who we share it with

We share your data only with the processors we need to run the store: Stripe for payments, Resend for transactional and marketing email, CJ Dropshipping and its suppliers for fulfilment (they receive your name and delivery address to dispatch your order), and Vercel for hosting. Some of these process data outside the UK; where they do, we rely on appropriate safeguards such as adequacy regulations or standard contractual clauses.

How long we keep it

Order and payment records are kept for up to 6 years to meet tax and legal obligations. Newsletter data is kept until you unsubscribe or ask us to delete it.

Your rights

You can ask us at any time to access, correct, delete or restrict your data, to port it to another service, or to object to processing. Where we rely on consent you can withdraw it at any time. Email hello@holluxa.com and we will respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).