Privacy Policy

Last updated: August 15th 2026

Lucy & Joe operates this store and website, including all related information, content, features, tools, products, and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Lucy & Joe is powered by Shopify, which enables us to provide these Services to you. This Privacy Policy explains how we collect, use, and disclose your personal information when you visit, use, make a purchase, or otherwise communicate with us.

Lucy & Joe (operated by Yusuf Agir LLC) is the data controller for the personal information described in this policy. Because our customers are primarily based in the United Kingdom, we process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, in addition to applicable US state privacy laws.

Personal Information We Collect or Process

"Personal information" refers to information that identifies or can reasonably be linked to you or another individual. Depending on your interactions with the Services, your location, and applicable law, we may collect the following types of personal information:

Contact details: name, billing address, delivery address, phone number, and email address.
Financial information: payment card details, payment confirmations, and transaction metadata.
Account information: username, password, security questions, preferences, and account settings.
Transaction information: items viewed, added to your basket or wishlist, purchased, returned, exchanged, or cancelled.
Communications: information and inquiries provided via customer support or direct correspondence.
Device information: device, browser, network connection data, IP address, and unique identifiers.
Usage information: how and when you interact with or navigate our website and Services.

Sources of Personal Information

We collect personal information through the following channels:

Directly from you: when you create an account, place an order, or communicate with our support team.
Automatically: via cookies, pixels, and similar tracking technologies deployed across your device and browser, including Meta (Facebook/Instagram) Pixel, Google Analytics, and Google Ads [— add any others you actually run, e.g. TikTok Pixel, Pinterest Tag, Klaviyo]. Non-essential cookies are only set with your consent, gathered via the cookie banner on our site, in line with the UK Privacy and Electronic Communications Regulations (PECR).
From service providers: engaged to run our technology infrastructure, cloud storage, and payment gateways.

Legal Bases for Processing (UK GDPR)

We process your personal data on the following legal bases: performance of a contract (to fulfil your order), consent (for marketing communications and non-essential cookies), legitimate interests (to improve our Services and prevent fraud, balanced against your rights), and legal obligation (for tax, accounting, and regulatory compliance).

How We Use Your Personal Information

We use your personal information for legitimate business and operational purposes, including to:

Provide and Improve Services: fulfil orders, process secure payments, manage accounts, arrange logistics, and facilitate returns.
Marketing and Advertising: send promotional communications via email or SMS (with your consent) and display targeted online ads.
Security and Fraud Prevention: authenticate accounts, monitor secure transactions, and protect against malicious activity.
Customer Support: maintain business relationships and respond to your inquiries.
Legal Compliance: respond to lawful requests, enforce our Terms of Service, and comply with regulatory obligations, including UK tax and consumer protection law.

How We Disclose Personal Information

We may share your information with trusted third parties under strict operational guidelines, including:

Shopify and related cloud hosting, IT management, data analytics, and fulfillment vendors.
Payment processors to secure financial transactions.
Professional marketing partners to manage targeted campaigns in compliance with privacy laws.
Corporate affiliates or in connection with business transactions such as mergers or restructuring.

Relationship with Shopify

Our store is hosted by Shopify, which collects and processes personal information to power our online storefront. You can review the Shopify Privacy Policy for more details.

Third-Party Websites and Links

Our Services may contain links to external third-party sites. We are not responsible for the privacy practices of external platforms, and we encourage you to review their respective privacy policies.

Children's Data

Our Services are not intended for individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact us for immediate deletion.

Security and Retention

While we implement administrative, technical, and physical safeguards to protect your data, no security system is completely impenetrable. We retain personal information only as long as necessary to fulfil the purposes described in this policy, including any legal, accounting, or reporting requirements.

Your Rights and Choices (UK GDPR)

As a UK-based individual, you have the right to:

Access: request a copy of the personal information we hold about you.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your personal data, subject to legal exceptions.
Restriction: request that we limit how we use your data in certain circumstances.
Portability: receive your data in a structured, machine-readable format.
Object: object to processing based on legitimate interests or for direct marketing.
Withdraw consent: at any time, where processing is based on consent, without affecting processing carried out before withdrawal.

You may manage email subscriptions using the unsubscribe link in our messages. To exercise any of these rights, contact us using the details below. If you're unsatisfied with our response, you have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

SMS Communications

By providing your phone number and opting into SMS checkout or marketing updates, you consent to receive recurring text messages regarding promotions, cart reminders, and order notifications.

Message frequency varies.
Consent is not a condition of purchase.
Standard message and data rates may apply.
You can opt out at any time by replying STOP to any message or contacting support.

International Transfers

Lucy & Joe is operated by a US company, and our fulfillment partner is based outside the UK. This means your personal data may be transferred to, and processed in, the United States and other countries outside the UK. Where this happens, we rely on legally recognised transfer mechanisms, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, to ensure your data receives an equivalent standard of protection.

Changes to This Privacy Policy

We may update this policy periodically to reflect operational, legal, or regulatory adjustments. Revisions will be published directly on this page with an updated revision date.

Contact Information

Store name: Lucy & Joe

Company name: Yusuf Agir LLC

Registration Number: 42-3392831

Business Address: 34 Amanda Rd, Sudbury MA, 01776 United States.

Warehouse Address: 35 Parkfield Ave, Bootle L30 1PG, UK

Email: info@lucyandjo.com

Phone: +44 1507 309327

Customer Service Hours:

Monday to Friday: 9am - 6pm (BST)

Saturday and Sunday: Closed