Privacy policy

Last updated: 16 September 2026

This Privacy Policy explains what personal information CoreLuxo collects, why we collect it, who we share it with, and the choices you have. CoreLuxo, 16 Kineton Rd, Oxford OX1 4PG, United Kingdom, is the controller responsible for your personal information.

If you are in the United Kingdom, we process your personal data under the UK GDPR and the Data Protection Act 2018.

You can reach us at any time at hello@coreluxo.com.

Information we collect

Information you give us. When you place an order, contact us, or sign up for emails, we collect your name, email address, phone number, billing address, delivery address, order contents, and anything you write to us. If you create an account, we also collect your login details.

Payment information. Card payments are processed by our payment providers through Shopify checkout. We never receive or store your full card number. We receive only the outcome of the transaction and limited details such as card type, the last four digits, and the billing address.

Information collected automatically. When you visit the store we collect your IP address, device and browser type, operating system, language and region, referring website, the pages and products you view, what you search for, what you add to your basket, and the dates and times of your visits. This is collected through cookies and similar technologies described below.

Session recordings and heatmaps. We use a session-replay tool that records how visitors interact with our store, including mouse movement, clicks, scrolling, and pages viewed, to find usability problems. The tool is configured to mask text entered into form fields and we do not use it to capture payment details. You can opt out by declining non-essential cookies.

Information from others. We receive order and delivery status information from our fulfilment and shipping partners, fraud-screening signals from Shopify, and aggregated campaign data from advertising and analytics providers.

How we use your information

To process, fulfil, and deliver your orders, and to send order confirmations and delivery updates.
To provide customer support and handle your questions, cancellations, returns, and refunds.
To take payment and to detect and prevent fraud, chargebacks, and abuse of the store.
To operate, secure, and improve the store, including understanding which products and pages people use.
To send marketing emails where you have signed up. Every marketing email has an unsubscribe link.
To show and measure advertising, where you have accepted advertising cookies.
To meet our legal, tax, accounting, and record-keeping obligations.

We do not use your personal information to make decisions about you by automated means that produce legal or similarly significant effects.

Our legal bases

Performance of a contract — to take, fulfil, and deliver your order, and to handle cancellations, returns, and refunds.
Legal obligation — to keep tax and transaction records and to respond to lawful requests.
Legitimate interests — to secure the store, prevent fraud, and improve our products and service, balanced against your rights.
Consent — for marketing emails, advertising and analytics cookies, and session recording. You may withdraw consent at any time, without affecting processing carried out before you withdrew it.

Cookies and similar technologies

We use cookies that are strictly necessary to run the store (keeping your basket, keeping you signed in, and security), and — only where you accept them — cookies for analytics, session recording, and advertising. Under the Privacy and Electronic Communications Regulations we set non-essential cookies only with your consent.

You can change your choices at any time using the Cookie preferences link in the footer of every page, or through your browser settings. We also honour the Global Privacy Control (GPC) signal.

Who we share your information with

We do not sell your personal information. We share it with the following categories of recipient, only as needed to run the store:

Our e-commerce platform. Shopify Inc., which hosts the store, processes checkout, and provides fraud analysis.
Payment providers. Shopify Payments and any accelerated checkout provider you choose, such as Shop Pay, Apple Pay, or Google Pay.
Fulfilment and delivery partners. Third-party fulfilment partners and carriers who pack and deliver your order, and who receive your name, delivery address, phone number, and order contents. Orders may be dispatched from facilities in the United Kingdom or overseas.
Order tracking. ParcelPanel, which matches carrier tracking to your order so you can follow your delivery.
Analytics, advertising, and measurement. Google (including Google Shopping and Google Analytics), Meta, and the session-replay and conversion-tracking tools we use. Sharing for advertising purposes happens only where you have accepted advertising cookies.
Email. The email provider we use to send order notifications and, if you signed up, marketing emails.
Professional advisers and authorities. Where we are legally required to disclose information, or need to establish, exercise, or defend legal claims.
A buyer or successor, if the business is sold, merged, or reorganised.

International transfers

We are based in the United Kingdom. Our partners operate in the United Kingdom, the United States, the European Union, and elsewhere, which means some of your personal information is transferred outside the UK.

Where we make a restricted transfer of UK personal data, we rely on appropriate safeguards recognised under the UK GDPR — the International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses, together with a transfer risk assessment. Some transfers are instead necessary to perform our contract with you. You can ask us for details of the safeguards used by emailing hello@coreluxo.com.

How long we keep your information

Order and transaction records: for as long as needed to complete the order, then for the period required by tax and accounting law — generally six to seven years.
Customer support messages: up to three years after the enquiry is resolved.
Marketing subscriptions: until you unsubscribe, plus a suppression record so we do not email you again.
Analytics, advertising, and session-recording data: typically up to 26 months, and less where the provider's default is shorter.
Account details: until you ask us to delete your account.

Your rights

If you are in the United Kingdom, you have the right to:

be informed about how we use your personal data;
access the personal data we hold about you, and receive a copy;
have inaccurate data corrected;
have your data erased, in the circumstances the law allows;
restrict or object to how we process your data, including objecting to direct marketing at any time;
receive your data in a portable format and have it transmitted to another controller; and
withdraw consent at any time, where we rely on consent.

To exercise any of these, email hello@coreluxo.com. We will respond within one month. We may ask you to confirm your identity before we act. Exercising your rights is free.

If you are unhappy with how we have handled your personal data, you have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO) — ico.org.uk/make-a-complaint, helpline 0303 123 1113. We would appreciate the chance to address your concerns first.

If you are outside the UK

We sell and deliver only within the United Kingdom, but the store may be viewed from elsewhere. Depending on where you live you may have additional rights — for example, residents of certain US states may have the right to know what personal information we collect, to obtain a copy, to correct or delete it, to opt out of targeted advertising and of the "sale" or "sharing" of personal information, and not to be treated differently for exercising those rights. Sharing data with advertising and analytics partners can count as "sale" or "sharing" under those laws even though no money changes hands. To opt out, use the Cookie preferences link in our footer, enable Global Privacy Control in your browser, or email us.

Children

The store is not directed at children and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, email hello@coreluxo.com and we will delete it.

Security

We use administrative and technical measures to protect your personal information, and our checkout runs over an encrypted connection. Payment card details are handled by our payment providers and never stored by us. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. When we do, we will post the revised version here and change the "Last updated" date at the top. Where a change is significant, we will take reasonable steps to tell you.