This Policy was last updated on 13 July, 2026

This section applies solely to California residents and supplements the information contained in our Privacy Policy. It describes your rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) and explains how to exercise them. As a UK‑based brand serving customers in the United States, we offer these California‑specific disclosures on a voluntary basis to support transparency. This notice additionally outlines practices relevant to those broader US privacy laws.

 

1 - Your Rights

California residents have the following rights regarding their personal information:

• Right to Know You may request that we disclose the categories and specific pieces of personal information we have collected, used, disclosed, sold, or shared.
• Right to Delete You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt‑Out of Sale or Sharing You may direct us not to sell or share your personal information, including for cross‑context behavioural advertising.
• Right to Limit Use of Sensitive Personal Information You may request that we limit our use and disclosure of sensitive personal information to what is necessary to provide our services.
• Right to Non‑Discrimination We will not discriminate against you for exercising any of your privacy rights.

 

2 - Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information as defined by California law, for each category of personal information listed below, we confirm that this information may be shared with service providers for operational purposes, and is not sold:

 

• Identifiers (e.g., name, email address)
• Commercial information (e.g., purchase history)
• Internet or network activity (e.g., browsing behaviour, cookies)
• Geolocation data (approximate location)
• General customer-provided skincare‑related information customers choose to provide, such as:
• Skin issues or concerns
• Skincare goals or preferences
• Product usage patterns
• Inferences drawn from your preferences and interactions
• This information is collected from the following categories of sources:
• The Orveda.com website
• On‑site chat
• Newsletter surveys
• Customer service email communications
• We disclose personal information to the following categories of third parties:
• Payment processors
• Delivery and logistics providers
• Customer relationship management (CRM) platforms
• Email and marketing service providers
• Advertising networks

 

3 - Purposes for Collecting Personal Information

We collect and use personal information for the following purposes:

• To provide, fulfil, and improve our products and services
• To personalise skincare recommendations and user experience
• For analytics, performance, and site optimisation
• For marketing and advertising (with opt‑out options)
• For security, fraud prevention, and legal compliance

 

4 - Sale or Sharing of Personal Information

Orveda Ltd. does not sell personal information but does share it for cross-context behavioural advertising, and consumers may opt out via the “Do Not Sell or Share My Personal Information” link. Orveda Ltd will honor opt-out preference signals such as the Global Privacy Control (GPC) transmitted by a consumer's browser.

 

5 - Retention

We retain personal information, depending on the category of data and our regulatory obligations.

Category of Personal Information	Retention Period / Criteria
Identifiers (name, email address)	Retained for the life of the customer account plus 5 years, or as legally required.
Commercial Information (purchase history)	Retained for 5 years for customer service, warranty, and fraud‑prevention purposes; certain transaction records retained longer if required by tax or accounting law.
Internet or Network Activity (cookies, browsing behaviour)	Retained for up to 2 years, depending on cookie type and user consent; deleted sooner if the user opts out.
Geolocation Data (approximate location)	Retained for up to 2 years for analytics and service optimisation; deleted sooner if the user opts out.
Sensitive Personal Information (skincare conditions, concerns, allergies, preferences)	Retained for the life of the customer account plus 5 years, unless the customer requests deletion sooner.
Inferences (preferences, predicted interests)	Retained for up to 2 years, or until the customer opts out of marketing or profiling.

 

6 - How to Exercise Your Rights

California residents may submit requests by:

• Emailing us at: concierge@orveda.com

We will verify your identity before processing your request. We aim to respond within 45 days, with one possible extension of an additional 45 days when reasonably necessary.

 

7 - Authorized Agents

You may designate an authorized agent to make requests on your behalf. We may require proof of authorization and verification of your identity.

 

8 - Additional US‑Specific Disclosures for Customers Outside California

8.1

Compliance with Other US State Privacy Laws

We comply with other applicable US state privacy laws.

8.2

Federal Trade Commission (FTC) Requirements

We adhere to US Federal Trade Commission (FTC) standards regarding transparency, fairness, and data security. Our privacy practices are designed to avoid unfair or deceptive practices.

 

9 - Children’s Privacy (COPPA)

Our services are intended for adults and are not directed to children. We do not knowingly collect personal information from children under 13.

 

10 - Health‑Related Information (HIPAA Clarification)

We are not a healthcare provider and do not process medical information governed by HIPAA. Customer‑provided skincare information may include health‑adjacent details, and this information is used solely to inform product recommendations and enhance the customer experience.

 

11 - Payment Information

Payment information is processed securely by our third‑party payment providers in accordance with applicable financial data protection standards.