Privacy Policy

Last updated: 23 September 2026

LULLA ("LULLA", "we", "us" or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains what information we collect when you visit or make a purchase on lullauk.com (the "Site"), how we use it, and what rights you have.

LULLA is operated by Zentra Global LLC, a company registered in the United States. When we offer products to customers in the United Kingdom and the European Economic Area, we process your personal information in accordance with the UK GDPR (Data Protection Act 2018) and, where applicable, the EU General Data Protection Regulation (GDPR), as well as other applicable privacy laws such as the CCPA (California) and PIPEDA (Canada).

1. Data Controller and UK/EU Representative

Data Controller: Zentra Global LLC (LULLA), based in the United States.
UK/EU Representative: [Pending appointment — this section will be updated with the name, address and contact details of our representative in accordance with UK GDPR and, where applicable, Article 27 of the EU GDPR].

You can exercise your rights by contacting us directly at help@lullauk.com.

2. Information We Collect

When you use our Site or place an order, we may collect:

Name, email address and phone number
Shipping and billing address
Payment information (processed securely through Shopify and our payment processors; we do not store your full card details)
IP address, browser type and device information
Approximate location (general region)
Order history and browsing activity on the Site
Marketing preferences and consent status

We also collect information through cookies and tracking technologies, such as Google Analytics, the Meta (Facebook) Pixel and the TikTok Pixel — only with your prior consent where required by applicable law.

3. Legal Basis for Processing

We process your personal information on the following legal bases:

Performance of a contract — to process and deliver your orders
Your consent — for non-essential cookies and marketing communications
Legitimate interest — to improve our services, prevent fraud and maintain security
Legal obligation — where required by applicable tax or accounting regulations

4. How We Share Your Information

We share personal information only where necessary, with:

Shopify — our e-commerce platform
Payment processors — PCI-DSS certified providers
Shipping and logistics partners — to deliver your orders
Marketing and analytics providers — such as Meta, Google and TikTok

International transfers: some of your information may be processed in the United States. Where this occurs, we apply safeguards recognised under UK and EU data protection law, such as Standard Contractual Clauses (SCCs), to protect your information.

We do not sell your personal information for money.

5. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this policy, including applicable tax and accounting obligations. Order data is retained for as long as you have an active relationship with us, and afterwards for the period required by tax law.

6. Data Security

We apply industry-standard security measures to protect your personal information. Payment data is encrypted and processed through PCI-DSS certified systems. No method of transmission over the internet is 100% secure, so we cannot guarantee absolute security.

7. Cookies and Tracking Technologies

We use cookies to keep your basket working, analyse Site usage and show relevant advertising. Non-essential cookies are only activated with your prior consent, which you can manage at any time through our cookie settings panel or your browser settings.

8. Your Rights (UK GDPR / EU GDPR)

If you are based in the United Kingdom or the European Economic Area, you have the right to:

Access your personal information
Correct inaccurate data
Request deletion of your data ("right to be forgotten")
Request restriction of processing
Object to processing based on legitimate interest
Request data portability
Withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal
Lodge a complaint with the UK Information Commissioner's Office (ICO) — ico.org.uk, or, if you are based in the EU, with your local data protection authority

Residents of California (CCPA/CPRA) and Canada (PIPEDA) retain the rights described under their respective jurisdictions.

To exercise any of these rights, please write to us at help@lullauk.com.

9. Marketing Communications

We will only send you marketing communications if you have given your express consent. You can withdraw it at any time using the link included in each email, or by writing to us at help@lullauk.com.

10. Children's Privacy

Our Site is intended for use by adults. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will remove it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be published on this page along with a revised "Last updated" date.

12. Contact

LULLA (operated by Zentra Global LLC)
Email: help@lullauk.com