This Policy was last updated on 13 July, 2026

Your privacy is important to Orveda Ltd (“Orveda”, “we”, “our” or “us”) and we are committed to protecting your personal information.

Orveda Ltd is a company registered in England and Wales with its registered office at: 10 New Street, London EC2M 4TP, United Kingdom.

This Privacy Policy (“Policy”) relates to our use of your personal information when you:

• •         Use our website, microsites or mobile applications and provide us with your personal information, for example by signing up for our newsletters or messages or leaving a review; 
  •         Register for our rewards programme;
  •         Purchase products directly from our website;
  •         Use our consultation services;
  •         Interact with us through social media, advertisements or content on third-party websites;
  •         Interact with us in person by attending an Orveda event;
  •         Apply for employment with us; and/or
  •         Otherwise engage with us, including by contacting our customer service team.

 

This Policy explains who we are, what personal information we collect about you, how we use it, including who we share it with, and your rights and choices regarding your personal information.

For the purposes of applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Orveda Ltd is the data controller responsible for the personal information described in this Policy.

If you have any questions or concerns about our use of your personal information, please contact us using the details set out in Article 11, Contact.

1 – Collected Information

1.1

Orveda Ltd may collect and process the following categories of personal data:

• •         Information provided when creating an account on the Website;
  •         Records of correspondence exchanged with us by telephone, email, live chat or otherwise;
  •         Details of transactions carried out through the Website;
  •         Information provided when interacting with us through social media platforms;
  •         Information relating to participation in events, consultations, promotions or loyalty programmes;
  •         Details of visits to the Website, including technical and usage information.
  •         Information provided to us in the course of any application for employment with us.

 

1.2

The personal data we collect may include:

• •         Title;
  •         First name and surname;
  •         Telephone number;
  •         Email address;
  •         Billing and delivery addresses;
  •         Country and location information;
  •         Date of birth;
  •         Gender;
  •         Photographs and images voluntarily provided by you;
  •         Product preferences and beauty profile information;
  •         Social media account information where you choose to interact with us through social media;
  •         Payment and transaction information;
  •         IP address;
  •         Browser type and device information;
  •         Website usage, traffic and analytics data;
  •         Marketing preferences; and
  •         Other information you voluntarily provide to us.

 

1.3

Orveda Ltd will only process personal data where there is a lawful basis for doing so, including:

• •         The performance of a contract with you or otherwise at your request;
  •         Compliance with a legal obligation;
  •         Our legitimate business interests; or
  •         Your consent, where required by law.

 

1.4

Where the provision of personal data is necessary to enter into or perform a contract, certain information will be mandatory. Failure to provide such information may prevent Orveda Ltd from processing orders, providing services or responding to requests.

Article 2 – Use of User’s Personal Data

2.1

Orveda Ltd uses your personal data for the following purposes:

• •         To create and manage your customer account;
  •         To process and fulfil orders placed through the Website;
  •         To process payments and prevent fraudulent transactions;
  •         To deliver products and services requested by you;
  •         To provide customer support and respond to enquiries;
  •         To administer consultations, events, promotions and loyalty programmes;
  •         To personalise your experience and provide product recommendations;
  •         To send service-related communications concerning your account or orders;
  •         To send marketing communications where permitted by law or where you have provided your consent;
  •         To improve our products, services and Website;
  •         To conduct analytics, reporting and market research;
  •         To maintain the security of our Website, systems and users;
  •         To review any job application submitted by you; and
  •         To comply with legal, regulatory and reporting obligations.

 

2.2

We may use automated technologies, including analytics and profiling tools, to better understand customer preferences, improve our services and personalise communications and product recommendations.

2.3

Marketing communications may be sent by email, SMS, post or other electronic means where permitted by applicable law. You may unsubscribe from marketing communications at any time by using the unsubscribe link included in such communications or by contacting us at concierge@orveda.com.

 

2.4

Where we rely on our legitimate interests as a lawful basis for processing, we will ensure that our interests are balanced against your rights and freedoms and that such processing is carried out in a fair, transparent and proportionate manner.

3 – Data Sharing and Disclosure

3.1

Orveda Ltd may share your personal data with trusted third parties where necessary for the purposes described in this Privacy Policy, including:

• •         Shopify, our e-commerce platform provider;
  •         Payment service providers and payment processors;
  •         Logistics, fulfilment and delivery partners;
  •         Customer service and support providers;
  •         Information technology, hosting and cloud service providers;
  •         Marketing, advertising and analytics service providers;
  •         Professional advisers, including legal, accounting and audit advisers;
  •         Regulatory authorities, government bodies and law enforcement agencies where required by law.

 

3.2

All third-party service providers are required to process personal data only in accordance with our instructions and applicable data protection laws and are subject to appropriate confidentiality and security obligations.

3.3

Orveda Ltd does not sell personal data to third parties.

3.4

As Orveda operates internationally, personal data may be transferred to and processed in countries outside the United Kingdom. Where personal data is transferred outside the United Kingdom, Orveda Ltd will implement appropriate safeguards as required by applicable data protection laws, including:

• •         Adequacy regulations approved by the UK Government;
  •         International Data Transfer Agreements (IDTAs);
  •         UK Addendums to Standard Contractual Clauses; or
  •         Other legally recognised transfer mechanisms.

 

3.5

In the event of a merger, acquisition, corporate restructuring, sale of assets or similar transaction, personal data may be transferred to the relevant successor entity, subject to applicable legal requirements.

3.6

We may disclose personal data where necessary to:

•         Comply with legal obligations;
•         Protect and enforce our legal rights;
•         Prevent fraud or security incidents; or
•         Protect the rights, property or safety of Orveda Ltd, our customers or third parties.

 

4 – Cookies

4.1

The Website uses cookies and similar technologies to distinguish you from other users, improve your browsing experience, analyse Website traffic and support the operation and security of our services.

4.2

Cookies are small text files placed on your device when you visit a website. They enable websites to recognise your device and store certain information about your preferences or actions.

4.3

We may use the following categories of cookies:

Cookie Type	Description
Strictly Necessary Cookies	These cookies are required for the operation of the Website and cannot be switched off. They include cookies used for security, authentication, shopping cart functionality and website administration.
Performance and Analytics Cookies	These cookies help us understand how visitors interact with the Website by collecting information anonymously. This information allows us to improve the performance and functionality of the Website.
Functionality Cookies	These cookies allow the Website to remember choices you make, such as language preferences, location settings and account information, to provide enhanced functionality.
Advertising and Marketing Cookies	These cookies may be used by Orveda Ltd and selected third-party partners to deliver relevant advertising, measure campaign effectiveness and personalise marketing communications.

 

4.4

Orveda Ltd may use cookies provided by third parties, including Shopify and analytics, advertising and social media partners.

4.5

Where required by law, non-essential cookies will only be placed on your device after you have provided your consent through our cookie consent management platform.

4.6

You may manage or withdraw your cookie preferences at any time through the Website’s cookie settings tool or through your browser settings. Please note that disabling certain cookies may affect the functionality of the Website.

4.7

Further information regarding the cookies used on the Website may be provided in our Cookie Policy or Cookie Preference Centre.

5 – Customer’s Rights and Choices

5.1

Orveda Ltd respects your rights regarding your personal data and is committed to ensuring that you can exercise those rights in accordance with applicable data protection laws. You may contact us at any time regarding your personal data by writing to:

Orveda Ltd, 10 New Street, London EC2M 4TP, United Kingdom

Email: concierge@orveda.com

5.2 Right of Access

You have the right to request confirmation of whether we process your personal data and, where applicable, to obtain access to that personal data and information regarding how it is processed.

5.3 Right to Rectification

You have the right to request that inaccurate or incomplete personal data concerning you be corrected or updated.

5.4 Right to Erasure

In certain circumstances, you have the right to request the deletion of your personal data, for example where the data is no longer necessary for the purposes for which it was collected or where you withdraw consent and no other lawful basis applies.

5.5 Right to Restrict Processing

You have the right to request that we restrict the processing of your personal data in certain circumstances, including where you contest the accuracy of the data or object to its processing.

5.6 Right to Data Portability

Where processing is based on consent or the performance of a contract and carried out by automated means, you have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to have that data transmitted to another organisation.

5.7 Right to Object

You have the right to object to the processing of your personal data where processing is based on our legitimate interests.

You also have the right to object at any time to the processing of your personal data for direct marketing purposes.

5.8 Right to Withdraw Consent

Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal of consent shall not affect the lawfulness of processing carried out before the withdrawal.

5.9 Marketing Preferences

You may opt out of marketing communications at any time by:

•         Clicking the unsubscribe link included in marketing emails;
•        Adjusting your communication preferences within your account, where available; or
•        Contacting us at concierge@orveda.com.

 

5.10 Geolocation Services

Where our Website or applications use geolocation services, you may disable location sharing at any time through your device settings. Please note that certain features may not function correctly if location services are disabled.

6 – Time Limits for Storing the User’s Personal Data

6.1

Orveda Ltd will retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying legal, regulatory, tax, accounting and reporting requirements.

6.2  Customer Accounts

Personal data associated with a customer account will generally be retained for as long as the account remains active.

Where an account becomes inactive, Orveda Ltd may retain the associated personal data for up to three (3) years following the last interaction, purchase or account activity, unless a longer retention period is required by law or legitimate business needs.

6.3  Order and Transaction Records

Personal data relating to purchases, orders, invoices, payments and refunds may be retained for up to six (6) years following the end of the relevant financial year in order to comply with accounting, tax and legal obligations.

6.4  Marketing Information

Where you have consented to receive marketing communications, your contact details and marketing preferences may be retained until:

• •         You withdraw your consent;
  •         You unsubscribe from marketing communications; or
  •         Orveda Ltd determines that the information is no longer required.

We may retain a limited record of your marketing preferences and unsubscribe requests to ensure that your preferences are respected in the future.

6.5  Customer Service Enquiries

Information relating to customer service enquiries, complaints and correspondence may be retained for up to three (3) years following the resolution of the matter.

6.6  Payment Information

Orveda Ltd does not store complete payment card details.

Payment information is processed through authorised payment service providers and retained only for as long as necessary to complete transactions, manage refunds, prevent fraud and comply with legal obligations.

6.7  Cookies and Similar Technologies

Cookies and similar technologies are retained for the periods specified in our Cookie Policy and cookie preference tools. Unless otherwise required by law, cookies will generally remain active for no longer than thirteen (13) months from the date they are placed on your device.

6.8  Legal Claims and Regulatory Requirements

Orveda Ltd may retain personal data for longer periods where necessary to:

• •         Establish, exercise or defend legal claims;
  •         Comply with legal or regulatory obligations;
  •         Resolve disputes; or
  •         Enforce our agreements and policies.

 

6.9  Deletion and Anonymisation

When personal data is no longer required, Orveda Ltd will securely delete, anonymise or otherwise dispose of the information in accordance with applicable laws and internal retention procedures.

7 – Security

7.1

Users are responsible for maintaining the confidentiality of any passwords, login credentials or other authentication information used to access their account on the Website.

Users should not share their account credentials with any third party and should notify Orveda Ltd immediately if they believe their account has been compromised.

7.2

Orveda Ltd implements appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access or other unlawful forms of processing. Such measures may include:

• •         Access controls and authentication procedures;
  •         Secure hosting environments;
  •         Encryption technologies where appropriate;
  •         Network and system monitoring;
  •         Employee confidentiality obligations; and
  •         Procedures for managing security incidents.

 

7.3

While Orveda Ltd takes reasonable steps to protect personal data, no method of transmission over the internet or electronic storage system can be guaranteed to be completely secure.

Accordingly, although we strive to protect your personal data, we cannot guarantee the absolute security of information transmitted to or from the Website.

7.4

Where Orveda Ltd becomes aware of a personal data breach that presents a risk to individuals’ rights and freedoms, we will take appropriate steps in accordance with applicable data protection laws, including notifying relevant authorities and affected individuals where required.

7.5

Users should ensure that their devices, internet connections and software are appropriately protected against viruses, malware and other security threats when accessing the Website.

8 – Complaint

8.1

If you have any concerns regarding the way Orveda Ltd collects, uses, stores or otherwise processes your personal data, we encourage you to contact us first so that we may investigate and attempt to resolve the matter.

Orveda Ltd, 10 New Street, London EC2M 4TP, United Kingdom

Email: concierge@orveda.com

We will acknowledge receipt of your complaint within 30 days of receipt.

8.2

If you are dissatisfied with our response, or believe that your personal data has been processed in a manner that does not comply with applicable data protection laws, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom

Website: www.ico.org.uk

Telephone: 0303 123 1113

8.3

The right to lodge a complaint with the ICO does not affect any other legal rights or remedies that may be available to you under applicable law.

9 – Updates of Privacy Policy

9.1

Orveda Ltd may update this Privacy Policy from time to time to reflect changes in:

•        Applicable laws and regulations;

•        Regulatory guidance;

• •         Our business operations;
  •         Our products and services;
  •         Our data processing activities; or
  •         Technological developments.

 

9.2

Any updated version of this Privacy Policy will be published on the Website and will become effective upon publication unless otherwise stated.

9.3

Where required by applicable law, Orveda Ltd will provide notice of material changes to this Privacy Policy by appropriate means, which may include:

• •         Publication of a notice on the Website;
  •         Email notification; or
  •         Other forms of communication reasonably designed to bring the changes to your attention.

 

9.4

The “Last Updated” date displayed at the beginning of this Privacy Policy indicates when this Privacy Policy was most recently revised.

9.5

Your continued use of the Website, products or services following the publication of an updated Privacy Policy constitutes acknowledgement of the updated terms to the extent permitted by applicable law.

10 – Contact

10.1

Orveda Ltd is the data controller responsible for the collection, use, storage and protection of personal data described in this Privacy Policy.

10.2

If you have any questions, comments or requests regarding this Privacy Policy or the processing of your personal data, please contact us at:

Orveda Ltd

10 New Street, London EC2M 4TP, United Kingdom

Email: concierge@orveda.com

10.3

Orveda Ltd will endeavour to respond to privacy-related enquiries and requests within the timeframes required by applicable data protection laws.

10.4

Where Orveda Ltd receives a request concerning the exercise of data protection rights, we may request additional information to verify the identity of the individual making the request before responding.

10.5

Nothing in this Privacy Policy affects any rights that individuals may have under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

11 - California Consumer Privacy Act

As a UK‑based brand serving customers in the United States, we offer California‑specific rights and information on a voluntary basis to support transparency. You can view the full details in our  on our Orveda California Privacy Rights. page.