Privacy and Cookie Policy

Your information helps us deliver your order, answer your questions and keep our shop working.

Last updated: 30 September 2026

Who we are

VELUGI LTD is responsible for the personal information we use to run this shop. We are registered in England and Wales, company number 17483061. Our registered office is 34 White Woman Lane, Norwich, NR6 7JB, United Kingdom.

For privacy questions or requests, email support@velugi.com or write to us at that address.

Information we use

When you place an order, we receive your name, contact details, billing and delivery addresses, products ordered and transaction information. We also keep correspondence about enquiries, deliveries, returns and refunds. If you create an account, we hold the account details you provide. Newsletter records include your email address and subscription status.

Payment details are processed by our payment providers. They send us information needed to identify payments and handle refunds and disputes. Fulfilment partners and carriers provide delivery updates. Technical information, such as IP addresses, browser information and request logs, helps operate and secure the shop.

Please do not include unnecessary sensitive information in messages or public product reviews.

How and why we use it

Your orders and account: we use the necessary information to process orders, arrange delivery, provide an account you request and handle contractual customer service. This is to perform our contract with you or take steps you request before entering one.

Our legal responsibilities: we retain relevant financial records and make disclosures required by accounting, tax and other applicable laws.

Operating a safe shop: we use relevant information to answer general enquiries, maintain security, investigate misuse and resolve disputes. Our basis is our legitimate interest in providing a reliable service and protecting customers and our business, balanced against your rights.

Marketing emails: we use your consent for our optional newsletter. You do not have to subscribe to shop with us. Required checkout details are needed to process and deliver an order.

Optional analytics: with your consent, we use Google Analytics 4 to understand visits and purchases and improve our shop. Analytics is optional and you can shop without accepting it. You can withdraw consent at any time using Cookie settings.

Who we share information with

Our launch services include:

Amazon Web Services: hosting and transactional email delivery through Amazon SES.
Microsoft 365: business email and customer correspondence.
Stripe, and PayPal if you choose that payment method: payment processing, authentication, fraud prevention and related payment support. Checkout can load payment-provider assets and security checks before you submit an order; see the cookies section below.
Avasam, fulfilment suppliers and delivery carriers: order fulfilment and delivery. A supplier may dispatch your parcel directly; we share the delivery and order information needed for that service. VELUGI remains your contact for order enquiries.
Google Analytics 4: website usage and purchase measurement, only when you accept analytics. See Optional analytics below for the information involved and your choices.

Payment providers may also use information for their own regulatory and fraud-prevention responsibilities. Their privacy notices explain this use: Stripe and PayPal. Information may also be disclosed where legally required or necessary for legal claims.

International processing

Our providers operate internationally, so information may be processed outside the UK, including in the United States. Their published data-protection terms describe the transfer arrangements for their services. Depending on the provider and destination, these include UK-recognised adequacy arrangements or contractual safeguards such as standard contractual clauses with the UK international data transfer addendum.

You can read the published arrangements for AWS, Microsoft, Stripe and Avasam and Google. Contact us if you would like information about the safeguards relevant to your information.

How long we keep information

Retention depends on the reason for keeping the information, outstanding orders or enquiries, applicable legal obligations and any unresolved dispute.

Company accounting and tax records normally need to be retained for six years from the end of the financial year they relate to, and longer in some circumstances. This does not mean every piece of customer information needs to be kept for that period.

For account and support records, we consider whether the account or enquiry remains active, whether the information is still needed for the requested service, and whether a related order or legal obligation requires continued retention. For technical logs and backups, we consider security investigations and recovery needs. Removal from a live system may precede expiry from backups.

Newsletter information is used while you remain subscribed. After you unsubscribe, a limited record may be retained to respect your choice and demonstrate how consent was obtained. Contact us about deletion or any retention question.

Analytics: our Google Analytics settings use two-month retention for user-level and event-level data, with the reset on new user activity switched off. Data reaching this limit is removed through Google's monthly deletion process. These settings do not limit how long standard aggregated reports remain available. Browser-cookie lifetimes are separate and are explained below.

Your newsletter choices

Our newsletter offers new arrivals, seasonal ideas and occasional offers. We ask you to confirm your email address before activating your subscription.

Withdraw consent at any time using the unsubscribe link in our marketing emails or by emailing support@velugi.com. Withdrawal does not affect earlier lawful use. Essential messages about an order are separate from marketing.

Your right to object

You can object to direct marketing at any time. You can also object to use based on legitimate interests, subject to the applicable legal conditions.

Your information rights

Depending on the circumstances, you can ask to access, correct or delete information, restrict its use, or receive a portable copy. Some records may need to be kept to comply with the law or handle claims. We may need proportionate information to confirm your identity.

Requests are normally free, and we normally respond within one month, subject to the timing provisions and extensions permitted by law. Email support@velugi.com to make a request.

You can raise a concern with us or complain to the Information Commissioner's Office.

Payment security checks

Payment services use automated security and fraud checks which can affect whether a payment is accepted or needs additional authentication. Their privacy notices explain their processing. If you have difficulty placing an order, contact us for help.

Cookies and similar storage

We use cookies and browser storage to keep your session, basket and checkout working, show relevant shop information and support security checks. Cookies have an expiry date; session storage normally ends when you close the tab, while local storage can remain until the shop or your browser clears it.

Payment and security services can connect when checkout opens, before you submit an order. These connections can send technical information such as your IP address, browser details and device signals, even when no cookie appears in your browser.

Shop cookies and storage

VELUGI uses Magento to provide these functions. Our session cookie normally lasts around one hour and our form-security cookie around 24 hours. Activity can renew cookies. Some cache and product-history cookies also last around one hour; this does not mean that corresponding local-storage records are deleted after one hour.

Names and purposes of shop storage

Session and form security: PHPSESSID maintains your session; form_key helps protect form submissions.

Basket, customer sections and messages: mage-cache-sessid, mage-cache-storage, mage-cache-storage-section-invalidation, mage-cache-timeout, mage-customer-login, private_content_version, section_data_ids and mage-messages help keep displayed information current and show service messages. Some names appear in more than one storage type.

Product history and comparison: product_data_storage, recently_viewed_product, recently_viewed_product_previous, recently_compared_product and recently_compared_product_previous support recently viewed products and product comparison.

Local storage has no automatic browser expiry. The shop can refresh or remove records as you use it; you can also delete them through your browser's site-data settings.

Optional analytics

We use Google Analytics 4 only after you choose Accept analytics. It helps us understand which pages people visit and which products are purchased, so we can improve the shop. Rejecting analytics does not prevent you from browsing, creating an account or placing an order.

With your permission, Google receives page visits, referring-page information, browser and device information, approximate location, and identifiers used to distinguish browsers and sessions. Purchase measurement includes the order reference, purchased products, amounts, tax, delivery charges and currency. Our integration does not deliberately send your name, email address, postal address or payment-card details in analytics events. We disable Google signals and advertising personalisation in this integration.

Google processes this information to provide the analytics service. Processing can take place outside the UK, including in the United States; see International processing above. Read how Google uses information from sites using its services and Google's Privacy Policy.

Your choice: use Cookie settings on the shop to accept or reject analytics at any time. Choosing Reject analytics stops future analytics collection by this integration in that browser and clears the Google Analytics cookies it can access. Withdrawal does not affect earlier lawful processing or automatically delete information already collected. Contact support@velugi.com about your information rights. Different browsers or devices have separate choices.

Analytics and preference storage

Analytics cookies: _ga distinguishes browsers and _ga_<container-id> maintains session information. Our integration sets these to last up to 180 days, and visits after consent can refresh their expiry. Your browser may shorten this period.

Your saved choice: velugi_analytics_choice_v1 records whether you accepted or rejected analytics for up to 180 days from your choice. user_allowed_save_cookie keeps Magento's cookie preference in step with that choice and can be refreshed as you browse. These preference cookies are used for both acceptance and rejection.

Purchase reporting: after consent, a session-storage entry whose name begins velugi_ga4_purchase_ records that a particular order has already been reported from that tab, helping prevent duplicate reporting. Session storage normally ends when the tab closes.

Payment and bot-protection services

Google reCAPTCHA: our contact form uses reCAPTCHA v3 to help prevent automated spam. Google processes technical information and interaction signals to assess requests, and reCAPTCHA sets the _GRECAPTCHA cookie for risk analysis. Google services can connect when you open the contact page. See Google’s Privacy Policy and Terms of Service. If you prefer, contact us directly at support@velugi.com.

Stripe: provides payment features and collects technical signals for authentication, fraud prevention and operation of its services. Its scripts and related requests can load from Stripe domains when checkout opens.

Stripe may use __stripe_mid (published lifetime: one year) and __stripe_sid (30 minutes) for fraud prevention, together with session storage and device signals. What is stored depends on the payment flow and browser protections. See Stripe's Privacy Centre and cookie information.

hCaptcha and Cloudflare: Stripe can use hCaptcha, supplied by Intuition Machines, to help distinguish people from automated abuse. This can involve browser features and certain hashed identifiers processed on Stripe's behalf. The hCaptcha service can also set Cloudflare's __cf_bm bot-protection cookie, which Cloudflare says expires after 30 minutes of continuous inactivity. See hCaptcha's privacy notice and Cloudflare's cookie information.

PayPal: checkout can load PayPal-branded assets. If you choose PayPal, its payment service can use additional cookies and storage for authentication, security and your payment. Its privacy notice explains its processing.

Your browser choices

You can inspect, block or delete cookies and other stored information through your browser's privacy settings. Clearing site data can sign you out or remove basket information; blocking payment or security services can affect checkout. These browser settings are separate from newsletter consent. See our cookie help, or email support@velugi.com if you need assistance.