Privacy Policy
Last updated: 1 July 2026
This Privacy Policy explains how Cecily York (“we”, “our”, or “us”) collects, uses, shares, and protects your personal information when you visit our website, place an order, contact our customer support team, or otherwise interact with our store.
This Privacy Policy applies to the Cecily York website and to all purchases made through our online store.
Cecily York is operated by Outlight Systems, a business registered in the Netherlands. Outlight Systems is the data controller responsible for your personal data. Full business and contact details are provided at the end of this Privacy Policy.
1. Information We Collect
We collect only the personal information necessary to operate our store, process orders, provide customer support, improve our website, and comply with legal obligations.
Information you provide directly may include:
- Full name
- Email address
- Phone number, if provided
- Shipping address
- Billing address
- Order details and purchase history
- Customer service communications, including emails, messages, return requests, and refund requests
- Account details, if you create an account on our website
Information collected automatically when you visit our website may include:
- IP address
- Browser type, language, operating system, and device information
- Pages visited and time spent on our website
- Referral source
- Approximate location based on your IP address
- Cookies and similar tracking technologies, as explained in Section 8
Payment Information
We do not store full credit card, debit card, or bank account details on our own servers.
Payments are processed securely by our payment service providers. We may receive limited payment-related information, such as the payment method used, transaction reference, payment status, and partial card details where available, for order management and record-keeping purposes.
2. How We Use Your Information
We use your personal information for the following purposes:
- Order fulfilment: to process your order, confirm your payment, prepare your items, arrange delivery, and send order and tracking updates.
- Customer service: to respond to enquiries, process returns and refunds, handle complaints, and provide support.
- Account management: to manage your customer account if you create one.
- Fraud prevention and security: to detect, prevent, and investigate fraudulent, suspicious, or unauthorised activity.
- Marketing communications: to send newsletters, promotions, or product updates only where you have given consent. You can unsubscribe at any time.
- Website improvement: to understand how visitors use our website and improve our products, website performance, and customer experience.
- Legal compliance: to comply with applicable consumer protection laws, tax laws, accounting obligations, GDPR, UK GDPR where applicable, and other legal requirements.
We do not sell your personal information.
3. Legal Basis for Processing
Where the GDPR, UK GDPR, or similar data protection laws apply, we process your personal data on the following legal bases:
- Performance of a contract: when processing and delivering your order, providing customer support, and handling returns or refunds.
- Consent: for marketing communications and non-essential cookies.
- Legitimate interests: for fraud prevention, website security, business analytics, improving our services, and protecting our legal rights.
- Legal obligation: for accounting, tax record retention, responding to lawful requests, and complying with applicable laws.
You may withdraw your consent at any time where processing is based on consent.
4. Who We Share Your Information With
We share personal information only where necessary to operate our business and provide our services.
We may share relevant information with:
- Payment service providers, to securely process payments.
- Shipping carriers and delivery partners, to deliver orders and provide tracking.
- Fulfilment partners, suppliers, and warehouses, to prepare and ship your order.
- Email and customer support platforms, to send transactional emails and manage customer enquiries.
- Website, hosting, and e-commerce service providers, including platforms used to operate our online store.
- Analytics providers, to understand website performance and improve our services.
- Marketing platforms, such as Google or Meta, only where permitted by law and, where required, with your consent.
- Legal, tax, accounting, and regulatory authorities, where required by law or necessary to protect our legal rights.
We require our service providers to handle personal information securely and only for the purposes for which it was shared.
5. International Data Transfers
Some of our service providers, fulfilment partners, shipping partners, analytics providers, or marketing platforms may process personal information outside the European Economic Area, the United Kingdom, or your country of residence.
Where personal information is transferred internationally, we take appropriate steps to protect it in accordance with applicable data protection laws. These safeguards may include:
- An adequacy decision by the European Commission or the UK government, where applicable;
- Standard Contractual Clauses approved by the European Commission or relevant UK transfer mechanisms;
- Certification under recognised data transfer frameworks where applicable;
- Sharing only the minimum personal information necessary to provide the relevant service.
For order fulfilment and delivery, we may share only the information necessary to ship your order, such as your name, shipping address, contact details, and order details.
6. How Long We Keep Your Information
We keep personal information only for as long as necessary for the purposes described in this Privacy Policy, unless a longer retention period is required by law.
Typical retention periods include:
- Order and transaction records: up to 7 years, where required for tax and accounting purposes.
- Customer service communications: up to 3 years after the last contact.
- Return and refund documentation: up to 7 years, where required for tax or accounting purposes.
- Marketing consent and unsubscribe records: for as long as needed to prove consent or respect your unsubscribe request.
- Account information: until you delete your account, unless retention is required for legal or business purposes.
- Website analytics data: according to the retention settings of the analytics tools we use.
- Cookie data: as described in our Cookie Policy and cookie banner.
After these periods, your information will be deleted, anonymised, or securely archived where legally required.
7. Your Privacy Rights
Depending on your location and applicable data protection laws, you may have the following rights:
- Right of access: to request a copy of the personal data we hold about you.
- Right to rectification: to request correction of inaccurate or incomplete data.
- Right to erasure: to request deletion of your personal data, subject to legal retention obligations.
- Right to restriction: to request that we limit how we process your data.
- Right to data portability: to receive your data in a structured, commonly used, machine-readable format.
- Right to object: to object to processing based on legitimate interests or direct marketing.
- Right to withdraw consent: where processing is based on consent.
- Right to lodge a complaint: with a supervisory authority.
To exercise your rights, contact us at:
We aim to respond to privacy requests within 5 business days, and no later than one month where required by applicable law.
If you are located in the European Union, you may contact your local data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens.
If you are located in the United Kingdom, you may contact the Information Commissioner’s Office.
8. Cookies and Tracking Technologies
We use cookies and similar technologies to operate our website, improve your shopping experience, analyse website performance, and, where you consent, support marketing and advertising.
Cookies are small text files stored on your device when you visit a website.
We may use the following categories of cookies:
- Strictly necessary cookies: required for the website to function, including shopping cart, checkout, login, security, and fraud prevention. These cookies are always active.
- Functional cookies: used to remember preferences such as language, region, or currency.
- Analytics cookies: used to understand how visitors interact with our website and improve performance.
- Marketing cookies: used to personalise advertising and measure marketing performance.
Non-essential cookies are used only where permitted by law and, where required, with your consent.
You can manage your cookie preferences through our cookie banner, where available, or through your browser settings. Disabling non-essential cookies will not prevent you from using our website, but some features may not work as intended.
For more information, please see our Cookie Policy.
9. Marketing Communications
We only send marketing emails, such as newsletters, promotions, and product updates, where you have opted in or where otherwise permitted by law.
Every marketing email includes an unsubscribe link. You may also unsubscribe at any time by contacting:
Transactional emails, including order confirmations, shipping updates, delivery updates, return confirmations, and refund notifications, are necessary to fulfil your order and are not considered marketing emails.
10. Data Security
We take reasonable technical and organisational measures to protect your personal information against unauthorised access, loss, misuse, alteration, or disclosure.
These measures may include:
- HTTPS/TLS encryption for data transmitted through our website
- Secure payment processing through payment service providers
- Access controls limiting access to personal information
- Security measures used by our e-commerce, hosting, and payment providers
- Regular review of our website and operational processes
No website, system, or method of transmission is completely secure. If we become aware of a personal data breach affecting your information, we will take appropriate action and notify affected individuals and relevant authorities where required by applicable law.
11. Children’s Privacy
Our website is not intended for children under the age of 16. We do not knowingly collect personal information from children under 16.
If you are a parent or guardian and believe that a child has provided us with personal information without your consent, please contact us at support@cecily-york.com, and we will take appropriate steps to delete the information.
12. Third-Party Links
Our website may contain links to third-party websites, including social media platforms, payment providers, shipping carriers, or other external services.
We are not responsible for the privacy practices, content, or security of third-party websites. We encourage you to read their privacy policies before sharing personal information with them.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our business, website, legal requirements, or privacy practices.
When we update this Privacy Policy, we will change the “Last updated” date at the top of this page. Where required by law, we will provide additional notice of significant changes.
Your continued use of our website after an updated Privacy Policy is posted means the updated version applies from that date onward.
14. Governing Law
This Privacy Policy is governed by the laws of the Netherlands, unless mandatory consumer protection or data protection laws in your country of residence provide otherwise.
If you are a consumer located in the United Kingdom or another country, you may have additional mandatory rights under the laws of your country of residence.
15. Who We Are
Brand name:
Cecily York
Operating company and legal owner:
Outlight Systems
Data controller:
Outlight Systems
Registered office:
Hendrik Soeteboomstraat 4
1035 NX Amsterdam
The Netherlands
Chamber of Commerce number (KvK):
42045311
VAT number:
NL869455904B01
Telephone number:
+31 6 11407132
16. Contact Us
For privacy-related questions, requests, or complaints, you can contact us at:
Email:
support@cecily-york.com
Postal address:
Outlight Systems / Cecily York
Hendrik Soeteboomstraat 4
1035 NX Amsterdam
The Netherlands
Telephone number:
+31 6 11407132
We aim to respond to all privacy-related enquiries within 5 business days, and no later than one month where required by applicable data protection law.