Privacy policy
1. Who we are
Last updated: November 7, 2026
Vasanti Cosmetics Inc. ("Vasanti", "we", "us") runs vasanticosmetics.co.uk (the "Service"). We are the controller of your personal data. This policy explains what we collect, why, who we share it with, and your rights under the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations ("PECR"). If you live in the European Economic Area, the EU GDPR gives you the same rights.
Contact for privacy: Ketan Patel, VP of Growth, Vasanti Cosmetics Inc., Attn: Privacy, 32 Cranfield Road, Unit 1306, Toronto, Ontario M4B 3H3, Canada, privacy@vasanticosmetics.com
2. What we collect
| Type | Examples | How we get it |
|---|---|---|
| Contact and account | Name, email, phone, delivery and billing address, account login | You give it when you order, create an account or sign up |
| Orders | Products bought, order value, discount or gift card codes, returns | Created when you order |
| Payment | Card details | Handled by Shopify Payments and other payment providers; we never see or store full card numbers |
| Communications | Messages to us, reviews, quiz answers (such as shade matching) | You give it |
| Device and usage | IP address, browser and device, pages viewed, time on page, referring site, approximate location | Cookies and similar technologies, only as you allow (section 4) |
| Marketing choices | Email and SMS opt-ins and opt-outs, with the date and time | You give it; recorded automatically |
We do not knowingly collect special category data, such as health information.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Take, deliver and return orders; customer service; your account | Contract |
| Order and delivery messages | Contract |
| Rewards, gift cards and discount codes | Contract |
| Marketing emails and texts; cart reminders | Consent (you can withdraw it at any time) |
| Statistics, advertising and preference cookies | Consent |
| Keeping the site secure, preventing fraud and bots | Legitimate interests (protecting our customers and business) |
| Tax, accounting and legal duties | Legal obligation |
4. Cookies
Cookies are small files a website stores in your browser. Only necessary cookies run until you make a choice. Everything else stays off unless you allow it in the cookie banner.
| Category | What it does | Providers |
|---|---|---|
| Necessary (always on) | Cart, checkout, security, bot protection, remembering your cookie choice | Shopify, Shop Pay, Consentmo |
| Statistics | How visitors use the site, including session recordings, so we can improve it | Shopify Analytics, Google Analytics, Hotjar, Hue (using Mixpanel and Statsig) |
| Marketing | Relevant ads on other sites, measuring ads, email and SMS cart reminders | Meta (Facebook and Instagram), Google, Pinterest, Klaviyo |
| Preferences | Region, currency, recently viewed products and recommendations | Shopify, Rebuy |
You can change your choice at any time with Cookie preferences in the footer of every page. You can also block or delete cookies in your browser, though the cart may then stop working.
5. Email and text marketing
We send marketing only if you opt in. Emails and texts are sent through Klaviyo. Unsubscribe with the link in any email, or reply STOP to any text. Message and data rates may apply. We do not share your text-message opt-in with anyone for their own marketing. Opting out does not stop order and delivery messages.
6. Who we share it with
We do not sell your personal data. We share it only with providers who help us run the Service:
- Store, checkout and payments: Shopify.
- Warehouse and delivery: Huboo (our UK warehouse) and the carriers that deliver your order.
- Email and SMS: Klaviyo.
- Analytics: Google Analytics, Hotjar, Lifetimely, Hue (using Mixpanel and Statsig).
- Advertising: Meta, Google, Pinterest, Shopify Collabs.
- Reviews, rewards, recommendations: Okendo, Smile.io, Rebuy.
- Shade matching and video reviews: Hue.
- Consent management and accessibility: Consentmo.
These providers act on our instructions and are bound by contract to protect your data. Advertising partners such as Meta, Google and Pinterest may also use data from our site for their own purposes, under their own privacy policies. We may also disclose data where the law requires it, to protect our rights or others' safety, or if our business is sold or reorganized.
International transfers. We are based in Canada, and many providers store data in the United States and elsewhere. The UK recognizes Canada as giving adequate protection. For other countries, we rely on UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
7. How long we keep it, and security
- Order and payment records: 7 years, for tax and accounting.
- Account: until you close it or ask us to delete it, except records we must keep by law.
- Marketing: while you are subscribed. After you unsubscribe we keep a record of the opt-out so we don't contact you again.
- Analytics: as set by each provider. Google Analytics keeps event data for 2 months and user data for 14 months.
We use encrypted connections and limit access to people who need it. No system is completely secure. If a breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
8. Your rights
You can ask us to: access your data; correct it; delete it; restrict how we use it; object to our use of it (including any direct marketing, at any time); move it to another organization (portability); withdraw consent at any time (this doesn't affect anything we did before).
We do not make decisions about you based solely on automated processing.
How to ask: use our Your privacy rights page or email privacy@vasanticosmetics.com. We may need to confirm your identity first. We reply within one month.
Complaints: please contact us first. You can also complain to the Information Commissioner's Office (0303 123 1113) or, in the EEA, your local data protection authority.
9. Children, changes and contact
The Service is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has given us data, contact us and we will delete it.
We may update this policy. We'll post the new version here with a new date, and tell you more prominently about significant changes.
Questions: Ketan Patel, Vasanti Cosmetics Inc., Attn: Privacy, 32 Cranfield Road, Unit 1306, Toronto, Ontario M4B 3H3, Canada, privacy@vasanticosmetics.com