Privacy Policy

Last updated: 1 July 2026

This Privacy Policy explains how Cecily York (“we”, “our”, or “us”) collects, uses, shares, stores, and protects your personal information when you visit our website, place an order, contact our customer support team, or otherwise interact with our store.

This Privacy Policy applies to the Cecily York website and purchases made through our online store, including purchases by customers in the United States.

Cecily York is operated by Outlight Systems, a business registered in the Netherlands. Outlight Systems is the data controller responsible for the personal information processed through Cecily York.

Full business and contact details are provided at the end of this Privacy Policy.

1. Information We Collect

We collect personal information that is reasonably necessary to operate our store, process and deliver orders, provide customer support, improve our website, prevent fraud, conduct marketing where permitted, and comply with legal obligations.

Information You Provide Directly

This may include:

• Full name

• Email address

• Telephone number, if provided

• Shipping address

• Billing address

• Order details and purchase history

• Customer service communications

• Return and refund requests

• Reviews or other information you choose to submit

• Account information, if you create an account

• Marketing preferences

Information Collected Automatically

When you visit or interact with our website, we may automatically collect information such as:

• IP address

• Browser type

• Browser language

• Operating system

• Device type and device information

• Pages viewed

• Time spent on our website

• Referral source

• Approximate location based on IP address

• Shopping cart and checkout activity

• Cookies, pixels, and similar technologies

• Information about how you interact with our website

Payment Information

We do not store complete credit card, debit card, or bank account details on our own servers.

Payments are processed through third-party payment service providers.

We may receive limited payment-related information, such as:

• Payment method

• Transaction reference

• Payment status

• Billing information

• Partial or masked card information where made available by the payment provider

This information may be used for order management, fraud prevention, refunds, accounting, and record-keeping.

2. How We Use Your Information

We may use personal information for the following purposes:

• Order fulfillment: to process your purchase, verify payment, prepare your order, arrange shipment, and provide tracking and delivery information.

• Customer service: to respond to questions, process returns and refunds, investigate delivery issues, and handle complaints.

• Account management: to create and maintain your customer account where applicable.

• Payment processing: to facilitate payments, refunds, payment verification, and transaction records.

• Fraud prevention and security: to identify, prevent, and investigate fraudulent, suspicious, or unauthorized activity.

• Website functionality: to operate shopping carts, checkout, account features, preferences, and other website functions.

• Website improvement and analytics: to understand how visitors interact with our website and improve performance and customer experience.

• Marketing and advertising: to provide newsletters, promotions, product recommendations, or advertising where permitted by law and in accordance with your preferences.

• Legal and regulatory compliance: to comply with applicable tax, accounting, consumer protection, privacy, fraud-prevention, and other legal obligations.

• Protection of legal rights: to establish, exercise, or defend legal claims and protect our business, customers, and service providers.

We do not use personal information for purposes that are materially incompatible with the purposes for which it was collected unless permitted by applicable law.

3. Legal Basis for Processing

Because Outlight Systems is established in the Netherlands, European data protection requirements, including the General Data Protection Regulation (“GDPR”), may apply to certain processing activities.

Where a legal basis is required, we may process personal information on the basis of:

• Performance of a contract: where processing is necessary to process, fulfill, deliver, return, or refund your order.

• Consent: where you have provided consent for activities such as certain marketing communications or non-essential cookies.

• Legitimate interests: where reasonably necessary for fraud prevention, website security, business analytics, improving our services, customer service, or protecting our legal rights, provided those interests are not overridden by your rights.

• Legal obligation: where processing is required for tax, accounting, regulatory, legal, or compliance purposes.

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

4. Who We Share Personal Information With

We may share personal information with third parties where reasonably necessary to operate our business and provide our services.

These parties may include:

• Payment processors to process payments, refunds, and payment verification.

• Shipping carriers and delivery partners to deliver orders and provide tracking information.

• Fulfillment partners, suppliers, and warehouses to prepare, package, and ship orders.

• E-commerce and website providers used to operate and maintain our online store.

• Hosting and technology providers that support our website and systems.

• Email and customer service platforms used to communicate with customers and provide support.

• Analytics providers that help us understand website traffic and performance.

• Marketing and advertising platforms, including services such as Google or Meta, where permitted by applicable law.

• Fraud prevention and security providers that help identify suspicious or unauthorized transactions.

• Professional advisers, such as accountants, legal advisers, and tax professionals.

• Government, regulatory, law enforcement, or other authorities where disclosure is required or permitted by law.

We only provide service providers with information reasonably necessary for the services they perform.

Our service providers may process information under their own privacy terms or under contractual arrangements with us.

5. Advertising, Sale, and Sharing of Personal Information

Cecily York does not sell personal information for money.

However, certain privacy laws in the United States define terms such as “sale,” “sharing,” or “targeted advertising” more broadly than an ordinary monetary sale.

For example, the use of certain advertising cookies, pixels, analytics technologies, or advertising platforms may be treated as “sharing,” “sale,” or targeted advertising under the laws of certain U.S. states.

Where applicable law gives you the right to opt out of these activities, we will provide an appropriate method to exercise that right, such as through our cookie preference tools or by contacting us.

You can also manage certain cookie and tracking preferences through your browser or our cookie banner where available.

6. International Data Transfers

Cecily York is operated by a company located in the Netherlands and works with service providers and fulfillment partners in multiple countries.

As a result, personal information belonging to customers in the United States may be transferred to, stored in, or processed in:

• The United States

• The Netherlands

• Other countries within the European Economic Area

• Countries in which our fulfillment, technology, payment, shipping, analytics, or support partners operate

Privacy and data protection laws may differ between countries.

Where required by applicable law, we take reasonable steps to protect personal information transferred internationally.

These safeguards may include:

• Standard Contractual Clauses approved by the European Commission

• Adequacy decisions

• Recognized international data-transfer frameworks

• Contractual data protection obligations

• Appropriate technical and organizational safeguards

• Limiting transferred information to what is reasonably necessary

For order fulfillment, this may include sharing your name, address, telephone number, email address, and relevant order information with shipping and fulfillment partners.

7. How Long We Keep Your Information

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy or as required by applicable law.

Typical retention periods may include:

• Order and transaction records: up to 7 years where needed for accounting, tax, or legal purposes.

• Return and refund records: up to 7 years where required for accounting, tax, legal, or fraud-prevention purposes.

• Customer service communications: generally up to 3 years after the most recent interaction.

• Marketing consent and opt-out records: for as long as reasonably necessary to demonstrate consent or honor your preferences.

• Customer account information: while your account remains active and for an appropriate period afterward, unless earlier deletion is requested and legally permitted.

• Website analytics: according to the applicable analytics service and our configured retention settings.

• Cookies and similar technologies: according to their purpose, expiration period, and the information provided through our cookie tools.

Information may be retained longer where reasonably necessary to resolve disputes, prevent fraud, enforce agreements, or comply with legal obligations.

After the applicable retention period, personal information may be deleted, anonymized, or securely archived where legally required.

8. Your Privacy Rights

Depending on where you live and the laws that apply to you, you may have certain rights regarding your personal information.

These rights may include:

• Right to access: request information about the personal data we hold about you.

• Right to correction: request correction of inaccurate personal information.

• Right to deletion: request deletion of certain personal information.

• Right to data portability: request a portable copy of certain personal information.

• Right to restriction: request limitations on certain processing where applicable.

• Right to object: object to certain forms of processing where applicable.

• Right to withdraw consent: withdraw consent where processing depends on your consent.

• Right to opt out of direct marketing: unsubscribe from promotional communications.

• Right to opt out of certain targeted advertising: where provided by applicable law.

• Right to opt out of the sale or sharing of personal information: where those rights apply under applicable state law.

• Right to non-discrimination: where applicable, you will not receive unlawful discriminatory treatment for exercising a privacy right.

• Right to appeal: residents of certain U.S. states may have the right to appeal a decision relating to a privacy request.

These rights are not absolute and may be subject to legal exceptions.

Exercising Your Rights

To submit a privacy request, contact us at:

support@cecily-york.com

Please clearly describe your request and provide sufficient information for us to identify the relevant records.

We may need to verify your identity before completing certain requests.

We will respond within the period required by applicable law.

Where no specific statutory response period applies, we aim to respond to privacy inquiries as quickly as reasonably possible.

Authorized Agents

Where permitted by applicable U.S. state privacy law, you may be able to designate an authorized agent to submit a privacy request on your behalf.

We may require reasonable proof that the agent is authorized to act for you and may separately verify your identity where permitted by law.

9. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our website, remember preferences, analyze website performance, improve the shopping experience, prevent fraud, and support advertising where permitted.

Cookies are small files that may be stored on your device when you visit a website.

We may use the following types of cookies:

• Strictly necessary cookies: required for essential website functions such as shopping cart, checkout, security, login, and fraud prevention.

• Functional cookies: used to remember choices such as region, language, or other preferences.

• Analytics cookies: used to understand how visitors interact with our website and measure performance.

• Advertising and marketing cookies: used to measure advertising effectiveness, personalize marketing, or support targeted advertising where permitted.

You may be able to manage non-essential cookies through our cookie banner or privacy preference tools where available.

You can also control cookies through your browser settings.

Disabling certain cookies may affect how some website features function.

For additional information, please see our Cookie Policy where available.

10. Marketing Communications

We may send marketing emails, promotions, newsletters, or product updates where you have opted in or where otherwise permitted by applicable law.

You may unsubscribe from marketing emails at any time by:

• Clicking the unsubscribe link contained in a marketing email; or

• Contacting us at support@cecily-york.com

Your unsubscribe request will not prevent us from sending necessary transactional communications relating to your purchases.

Transactional communications may include:

• Order confirmations

• Payment confirmations

• Shipping notifications

• Tracking updates

• Delivery notifications

• Return communications

• Refund notifications

• Customer service responses

• Important account or security notices

11. Data Security

We take reasonable administrative, technical, and organizational measures designed to protect personal information from unauthorized access, loss, misuse, alteration, disclosure, or destruction.

These measures may include:

• HTTPS/TLS encryption for information transmitted through our website

• Secure third-party payment processing

• Access controls

• Authentication and account security measures

• Security tools provided by our hosting and e-commerce platforms

• Fraud monitoring

• Limiting access to personal information to people and service providers who reasonably require it

• Reviewing our operational and security practices

No website, database, electronic transmission, or storage system can be guaranteed to be completely secure.

If we become aware of a data security incident involving personal information, we will take appropriate steps and provide notifications where required by applicable law.

12. Children's Privacy

Our store is intended for a general adult audience and is not directed to children under the age of 13.

We do not knowingly collect personal information online from children under 13.

If you are a parent or legal guardian and believe that a child under 13 has provided personal information to us, please contact:

support@cecily-york.com

We will review the request and take appropriate action.

13. Third-Party Websites and Services

Our website may contain links to websites or services operated by third parties, including:

• Payment providers

• Shipping carriers

• Social media platforms

• Buy-now-pay-later providers

• Other external services

We do not control third-party websites and are not responsible for their privacy practices, security, or content.

We encourage you to review the privacy policies of third-party services before providing personal information to them.

14. Do Not Track and Browser Privacy Signals

Some browsers allow users to send “Do Not Track” signals or other privacy preference signals.

Because there is not a single uniform standard governing all such signals, our response may depend on applicable law and the technical capabilities of our website and service providers.

Where applicable law requires us to recognize a legally valid browser-based opt-out preference signal, we will take reasonable steps to honor it as required.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

• Our business practices

• Website functionality

• Service providers

• Privacy practices

• Technology

• Applicable laws or regulations

When this Privacy Policy is updated, we will revise the “Last updated” date at the top of this page.

Where required by law, we may provide additional notice of significant changes.

The revised Privacy Policy will apply from the effective date stated in the updated version, subject to applicable law.

16. Governing Law

This Privacy Policy is governed by the laws of the Netherlands to the extent legally applicable, because Outlight Systems is established in the Netherlands.

However, this does not limit any mandatory privacy or consumer protection rights available to you under applicable law in your place of residence.

If you are located in the United States, you may have additional privacy rights under applicable federal or state law.

Where those laws provide mandatory rights that cannot legally be waived, those rights remain unaffected by this Privacy Policy.

17. European Data Protection Rights

Because Outlight Systems is established in the Netherlands, certain processing may also be subject to the GDPR.

Where the GDPR applies, you may have rights including:

• Access to your personal data

• Correction of inaccurate data

• Deletion of personal data in certain circumstances

• Restriction of processing

• Data portability

• Objection to certain processing

• Withdrawal of consent

• The right to lodge a complaint with an applicable supervisory authority

The supervisory authority in the Netherlands is the Autoriteit Persoonsgegevens.

These GDPR rights exist in addition to any mandatory privacy rights you may have under applicable U.S. law.

18. Who We Are

Brand name:
Cecily York

Operating company and legal owner:
Outlight Systems

Data controller:
Outlight Systems

Registered office:
Hendrik Soeteboomstraat 4
1035 NX Amsterdam
The Netherlands

Dutch Chamber of Commerce registration number (KvK):
42045311

VAT number:
NL869455904B01

Telephone number:
+31 6 11407132

19. Contact Us

For questions, privacy requests, or complaints regarding this Privacy Policy or your personal information, please contact us:

Email:
support@cecily-york.com

Postal address:
Outlight Systems / Cecily York
Hendrik Soeteboomstraat 4
1035 NX Amsterdam
The Netherlands

Telephone number:
+31 6 11407132

We aim to respond to privacy-related inquiries as quickly as reasonably possible and within any timeframe required by applicable privacy law.