Privacy Policy
Privacy Policy
A Quiet Promise
Your privacy is not a checkbox — it is the foundation of trust between us. This policy explains, in plain words, what information we collect, why we collect it, and how we protect it. Nothing here is hidden in fine print.
1. Who We Are
This website is operated by TuteVeta. We are the data controller responsible for your personal information. If you have any questions about this policy, write to us at hello@tuteveta.co.
2. What Information We Collect
Information you give us
When you make a purchase or create an account, we collect:
-
Your name, email address, and shipping address
-
Your phone number (if provided)
-
Payment information (processed securely — we never store full card details)
-
Order history and preferences
Information we collect automatically
When you browse our site, we automatically receive:
-
Your IP address and approximate location (country and city)
-
Browser type, operating system, and device information
-
Pages visited and time spent on site
-
Referring website or source
We use this to understand how our site is used and to improve your experience.
Currency preference
When you visit our site, we detect your country to display prices in your local currency where available. This preference is stored in a temporary session cookie that is removed when you close your browser. You may change your currency at any time using the selector at the bottom of the page.
3. Why We Collect It (Legal Basis)
We process your personal data only where we have a lawful basis to do so:
| Purpose | Legal Basis |
|---|---|
| Fulfilling your order and providing customer service | Contractual necessity |
| Sending order confirmations and shipping updates | Contractual necessity |
| Processing payments and preventing fraud | Legitimate interest |
| Email marketing (with your consent, via Klaviyo) | Consent |
| Improving our website and analysing usage | Legitimate interest |
| Complying with legal obligations | Legal obligation |
4. How We Share It
We share your information only with trusted partners who help us operate our store:
Shopify
Our store is hosted by Shopify Inc. Your data is stored on Shopify's secure servers. Learn more: Shopify Privacy Policy
Payment Processors
We accept payments via PayPal, credit and debit cards, Apple Pay, and Google Pay. All payment processing complies with PCI-DSS standards. Your payment details are encrypted and never stored on our servers. Please review:
Email Marketing
With your consent, we use Klaviyo to send you emails about new collections, stories, and quiet moments worth sharing. Klaviyo processes your name, email address, and interactions with our emails (opens, clicks) to help us send messages that feel personal. You can unsubscribe at any time — every email includes a one-click link.
Shipping Partners
We share your name, shipping address, and contact details with our shipping carriers to deliver your order.
Legal Requirements
We may disclose your information if required to do so by law, court order, or governmental authority, or if we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.
We do not sell, rent, or trade your personal information. Ever.
5. International Data Transfers
We are based in Hong Kong (adjust to your actual location), and our service providers (Shopify, Klaviyo) operate globally. Your data may be transferred to and processed in countries outside your own, including the United States and Hong Kong.
Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission. By using our site, you consent to these transfers.
6. Data Retention
We retain your personal information only for as long as necessary:
-
Order information: Retained for legal and accounting purposes, typically 7 years
-
Marketing data: Retained until you withdraw consent or unsubscribe
-
Analytics data: Retained for 26 months
-
Inactive accounts: Deleted after 3 years of inactivity
You may request deletion of your data at any time. See Section 8 for your rights.
7. Cookies
Our site uses cookies — small text files placed on your device — to function properly and improve your experience.
| Cookie Type | Purpose | Duration |
|---|---|---|
| Essential | Keep items in your cart, maintain login | Session to 1 year |
| Functionality | Remember language and currency preferences | Session |
| Analytics | Understand site usage and performance | Up to 2 years |
| Marketing | Deliver relevant ads (third-party) | Up to 90 days |
By using our site, you consent to essential and functionality cookies. For analytics and marketing cookies, we ask for your consent via our cookie banner. You can adjust your preferences at any time by clicking "Cookie Settings" in the footer.
Most browsers allow you to refuse or delete cookies. Please note that disabling essential cookies may affect the functionality of our store.
8. Your Rights
If you are located in the European Economic Area (EEA), the United Kingdom, or a jurisdiction with similar data protection laws, you have the following rights:
| Right | What It Means |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Correct any inaccurate or incomplete data |
| Erasure | Request deletion of your data ("right to be forgotten") |
| Restriction | Request that we limit how we process your data |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing for direct marketing |
| Withdraw Consent | Withdraw consent at any time where processing is based on consent |
To exercise any of these rights, contact us at hello@tuteveta.co. We will respond within 30 days. We may ask you to verify your identity before processing your request.
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.
9. Data Breach
In the unlikely event of a personal data breach, we will notify affected users and relevant supervisory authorities within 72 hours, as required by applicable law.
10. Age of Consent
By using this site, you confirm that you are at least the age of majority in your country or state of residence. We do not knowingly collect personal information from children under the age of digital consent. If we learn that a minor has provided us with personal data, we will delete it promptly.
11. Third-Party Links
Our site may contain links to external websites. We are not responsible for their privacy practices. We encourage you to read the privacy policies of any third-party sites you visit.
12. Changes to This Policy
We may update this policy from time to time. Changes will take effect immediately upon posting. If the changes are material, we will notify you here and, where appropriate, by email. We encourage you to review this page periodically.
13. Contact Us
For any questions about this Privacy Policy, or to exercise your rights, write to us at:
hello@tuteveta.co
We reply personally, with care.