Privacy policy

Privacy Policy

This Privacy Policy describes how ROYA LTD, trading as Royalin (registered office: 59 Elmbank Street, Glasgow, Scotland, G2 4PQ; store address: 13 Brewer Street, Soho, London, W1F 0RH, United Kingdom), collects, processes and protects your personal data when you visit our website royalin.shop or shop with us.

1. Data We Collect

Contact details: name, e-mail address, telephone number, delivery address
Order data: order history, encrypted payment information
Device data: IP address, browser type, operating system
Usage data: pages visited, click behaviour, referrer URLs
Cookies (see section 4)

2. Purposes of Processing

Processing and delivering orders
Customer communication and support
Fraud prevention and security
Improving our website and services
Marketing communication (only with your express consent)

3. Sharing with Third Parties

Data is shared only with the following categories of recipients, to the extent necessary to fulfil the contract:

Payment processing: Stripe (our payment processor for Visa, Mastercard, American Express, Apple Pay and Google Pay transactions)
Delivery services: Royal Mail and partner courier services
Order tracking: ParcelPanel (shipment tracking notifications using your order number and delivery status)
Hosting services: Shopify Inc. (platform and data storage)
Analytics services: anonymised website analytics (IP anonymisation active)

All third parties are contractually required to comply with applicable data protection laws.

4. Cookies and Consent

We use cookies. When you first visit our website, a cookie consent banner (provided by Pandectes GDPR Compliance) appears, allowing you to accept or decline non-essential cookies. You can adjust or withdraw your consent at any time via the floating “Change your consent” cookie widget on our website, or manage and delete cookies through your browser settings; blocking strictly necessary cookies may prevent parts of the shop (such as the basket and checkout) from working.

We use cookies in the following four categories:

Strictly necessary cookies: required for the shop to work correctly (basket, session, security). These cookies cannot be disabled — no consent is required.
Functional cookies: enable enhanced functionality and personalisation (for example saved language preferences). Only with your consent.
Performance cookies: anonymous usage statistics that help us improve our website. Only with your consent.
Targeting cookies: set by advertising partners to show personalised advertising on other websites. Only with your consent.

Your consent decision is stored for 365 days. A detailed cookie statement listing all cookies used and their purposes can be found in our Cookie Policy.

5. Data Retention

We store personal data only for as long as necessary or as required by law (as a rule, up to 6 years for accounting records in line with UK tax and company-law requirements).

6. Your Rights under the UK GDPR and the Data Protection Act 2018

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:

Access the personal data we hold about you (right of access)
Rectification of inaccurate data
Erasure of your data ("right to be forgotten", where no legal retention obligations apply)
Restriction of processing
Data portability in a commonly used electronic format
Object to certain processing activities
Withdraw consent you have given, at any time
Lodge a complaint with the supervisory authority

Supervisory authority (United Kingdom): Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk, helpline 0303 123 1113.

Legal bases for processing (Article 6 UK GDPR):

Art. 6(1)(b) – performance of a contract (order processing)
Art. 6(1)(f) – legitimate interests (fraud prevention, security)
Art. 6(1)(a) – consent (marketing cookies, promotional e-mails)

EU customers: if you are located in an EU member state, the equivalent rights under the EU GDPR (Regulation (EU) 2016/679) apply, and you may complain to the data protection authority of your member state.

International data transfers: for transfers of personal data to the USA (for example Shopify), we rely on the UK International Data Transfer Agreement/Addendum and standard contractual clauses approved for use in the UK, as well as the UK Extension to the EU-U.S. Data Privacy Framework.

7. Data Security

Our website uses SSL/TLS encryption for all data transfers (HTTPS protocol). We perform regular security reviews and apply industry-standard safeguards.

8. Contact for Privacy Requests

To exercise your rights or for any questions about data protection, please contact:

Store name: Royalin
Company name: ROYA LTD (Company No. SC729321)
Registered office address: 59 Elmbank Street, Glasgow, Scotland, G2 4PQ
Store address: 13 Brewer Street, Soho, London, W1F 0RH, United Kingdom
E-mail: contact@royalin.shop
Phone: +447429317242

Customer service hours (GMT)
Monday to Friday: 09:00 – 18:00
Saturday and Sunday: 10:00 – 16:00

We aim to respond to all enquiries within 24 hours.

We respond to privacy requests within 30 days, and aim to respond to all other enquiries within 24 hours.