Privacy Policy

01 · WHO WE ARE

Who Is Responsible for Your Information?

Efi & Co is a jewelry brand operated by ECOPHILIA COMPANY LIMITED. For the purposes of applicable data protection laws, we act as the data controller or data user for personal information that we determine how and why to process.

02 · INFORMATION WE COLLECT

What Personal Information We Collect

The information we collect depends on how you interact with us. It may include:

How We Obtain Information

We receive information directly from you, automatically when you use our website, and from service providers involved in your transaction, such as Shopify, payment providers, delivery providers, fraud-prevention providers and marketing or analytics services.

03 · HOW WE USE INFORMATION

Why We Use Your Personal Information

04 · LEGAL BASES

Our Legal Bases for Processing

Where UK or European data protection law applies, we rely on one or more lawful bases depending on the activity:

05 · SHARING

Who We May Share Personal Information With

We share personal information only where reasonably necessary for the purposes described in this policy. Categories of recipients may include:

• Shopify, which hosts and powers our online store and provides commerce services.
• Payment providers used to process your transaction.
• Couriers and logistics providers used to deliver and track orders.
• Jewelry workshops and production partners where necessary to manufacture, personalise, inspect or repair your order.
• IT, hosting, security and fraud-prevention providers that support store operations.
• Email, customer-service, analytics and marketing providers used to communicate with customers and measure or improve our services.
• Professional advisers, such as accountants, insurers, legal advisers and auditors.
• Authorities or other parties where disclosure is required by law, legal process, regulation or to protect rights and safety.
• Business transaction parties in connection with a merger, financing, acquisition, restructuring or sale of all or part of a business, subject to appropriate safeguards.

For custom or personalised jewelry, design materials or order details may be shared with the production partner responsible for making or servicing your piece. We aim to share only information reasonably required for that purpose.

06 · SHOPIFY

Our Store Is Powered by Shopify

Our online store is hosted on Shopify. Shopify may process personal information when you browse, purchase from or otherwise interact with our store, including information relating to your device, browsing activity, account, checkout and transaction.

Shopify may also process information for its own services in accordance with its own privacy terms. You can learn more about Shopify's practices and exercise certain Shopify-specific privacy choices using:

07 · COOKIES & ADVERTISING

Cookies, Analytics & Targeted Advertising

We and our service providers, including Shopify, may use cookies, pixels and similar technologies to operate the store, remember preferences, analyse website use, measure marketing and, where permitted, personalise content or advertising.

In regions where consent is required, non-essential cookies and similar technologies should be used according to the choices you make through our cookie banner or privacy controls.

Depending on the technologies enabled on our store and the law where you live, certain advertising or analytics activities may be considered “sale,” “sharing” or “targeted advertising.” Where applicable, you may opt out using the Your Privacy Choices or data-sharing opt-out control made available through our store.

You can also revisit cookie preferences using the cookie-preference control displayed by the store where available.

08 · INTERNATIONAL DATA

International Transfers

We operate internationally and use service providers, production partners and technology platforms located in different countries. Your personal information may therefore be processed outside the country where you live.

Where required by applicable data-protection law, we use legally recognised safeguards for international transfers, such as contractual protections, recognised adequacy mechanisms or other permitted transfer arrangements.

09 · RETENTION

How Long We Keep Information

We keep personal information only for as long as reasonably necessary for the purposes described in this policy, including to fulfil orders, provide aftercare, maintain business and accounting records, resolve disputes, prevent fraud and comply with legal obligations.

Retention periods vary depending on the type of information, the nature of our relationship with you, applicable legal requirements and whether information is needed to establish, exercise or defend legal claims.

10 · YOUR RIGHTS

Your Privacy Rights & Choices

Your rights depend on where you live and which privacy laws apply. Subject to applicable exceptions, you may have some or all of the following rights.

Hong Kong

Under Hong Kong's Personal Data (Privacy) Ordinance, you may request access to and correction of your personal data. You may also opt out of direct marketing at any time.

UK / EEA

Where UK GDPR or EU GDPR applies, you may have rights including access, correction, erasure, restriction, objection, portability and withdrawal of consent. You may also have the right to complain to the relevant supervisory authority in your country.

California & Certain US States

Where applicable, state privacy laws may provide rights to know or access personal information, correct inaccuracies, request deletion, obtain a copy of information, and opt out of certain sale, sharing, profiling or targeted advertising. We will not discriminate against you for exercising rights provided by applicable law.

11 · SECURITY

How We Protect Information

We use reasonable administrative, technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. We also rely on service providers to maintain appropriate security for the systems they operate.

No method of internet transmission or electronic storage can be guaranteed completely secure, so we cannot promise absolute security.

12 · CHILDREN

Children's Privacy

Our store is intended for adult customers and is not directed to children. We do not knowingly seek to collect personal information from children in circumstances where parental or guardian consent is legally required. If you believe a child has provided us with personal information improperly, please contact us.

13 · AUTOMATED TOOLS

Fraud Detection & Automated Processing

We and our service providers may use automated systems to help detect fraud, secure transactions, analyse website use or support advertising and personalisation. Where applicable law gives you rights relating to significant automated decisions, you may contact us to exercise those rights.

14 · THIRD-PARTY LINKS

Third-Party Websites & Services

Our website may link to third-party websites, social platforms or services. We do not control their privacy practices. When you leave our website or interact directly with another provider, review that provider's privacy information.

15 · CHANGES

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, technology, service providers, legal requirements or privacy practices. The latest version will be posted on this page with an updated date.