GRAUVE — PRIVACY POLICY

Last updated: 22 September 2026

GRAUVE operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). GRAUVE is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use or make a purchase or other transaction using the Services, or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use and disclosure of your information as described in this Privacy Policy.

Personal Information We Collect or Process

When we use the term "personal information," we are referring to information that identifies or can reasonably be linked to you or another person.

Personal information does not include information that is collected anonymously or that has been de-identified so that it cannot identify or reasonably be linked to you.

We may collect or process the following categories of personal information, depending on how you interact with the Services, where you live, and as permitted or required by applicable law:

• Contact details, including your name, address, billing address, shipping address, phone number and email address.
• Financial information, including payment information, transaction details, form of payment, payment confirmation and other payment details.
• Account information, including your username, password, security questions, preferences and settings.
• Transaction information, including the items you view, put in your cart, add to your wishlist, purchase, return, exchange or cancel, and your past transactions.
• Communications with us, including information you provide when contacting us, for example when making a customer-support enquiry.
• Device information, including information about your device, browser or network connection, your IP address and other unique identifiers.
• Usage information, including information regarding your interaction with the Services, including how and when you interact with or navigate the Services.

Personal Information Sources

We may collect personal information from the following sources:

• Directly from you, including when you create an account, visit or use the Services, communicate with us, place an order or otherwise provide us with your personal information.
• Automatically through the Services, including from your device when you use our Services or visit our website, and through the use of cookies and similar technologies.
• From our service providers, including when we engage them to provide technology, payment processing, fulfilment, delivery or other services and they collect or process personal information on our behalf.
• From our partners or other third parties, where permitted by applicable law.

How We Use Your Personal Information

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

Providing, Tailoring and Improving the Services

We use your personal information to provide the Services, including to perform our contract with you, process payments, fulfil orders, remember preferences and items you are interested in, send notifications relating to your account or orders, process purchases, returns and other transactions, create and manage your account, arrange shipping, facilitate returns, enable reviews where available, and improve your shopping experience.

Marketing and Advertising

Where permitted by applicable law, we may use personal information for marketing and promotional purposes, including sending marketing or promotional communications by email and displaying advertisements for GRAUVE products or services.

Where consent is required for a particular form of marketing, we will obtain it as required by applicable law.

You can unsubscribe from promotional emails at any time using the unsubscribe option included in those communications.

Security and Fraud Prevention

We use personal information to authenticate accounts, provide a secure payment and shopping experience, detect, investigate and respond to potentially fraudulent, illegal, unsafe or malicious activity, and protect our Services, customers and business.

If you create an account, you are responsible for keeping your account credentials secure. You should not share your username, password or other access details with anyone else.

Communicating With You

We use your personal information to provide customer support, respond to enquiries, communicate with you regarding your orders and provide our Services.

Legal Reasons

We may use personal information to comply with applicable law, respond to valid legal processes or requests from authorities, establish, exercise or defend legal claims, and enforce or investigate potential violations of our terms or policies.

How We Disclose Personal Information

In certain circumstances, we may disclose personal information to third parties for legitimate purposes and subject to this Privacy Policy.

This may include:

• Shopify, service providers and vendors that perform services on our behalf, including ecommerce hosting, IT services, payment processing, data analytics, customer support, cloud storage, manufacturing, printing, fulfilment and shipping.
• Business and marketing partners, where we use their services for marketing or advertising and where permitted by applicable law.
• Third parties where you direct, request or consent to the disclosure, such as where information needs to be provided to deliver your products or where you use third-party integrations.
• Authorities, advisers or other relevant parties where legally necessary, including to comply with legal obligations, respond to valid legal requests, enforce our Terms of Service or policies, establish or defend legal claims, or protect GRAUVE, our customers or others.
• Parties involved in a business transaction, should GRAUVE undergo a sale, transfer, restructuring or similar transaction in the future.

Relationship With Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services.

Information you submit through the Services may be transmitted to and shared with Shopify and other service providers, some of which may be located in countries other than the country in which you reside.

We may also use Shopify features that use information obtained from your interactions with our store and, where applicable, interactions with Shopify and other merchants.

In circumstances where Shopify independently determines the purposes and means of processing personal information, Shopify is responsible for that processing and for responding to applicable requests concerning that processing.

For more information, please see Shopify's Consumer Privacy Policy and Privacy Portal.

Third-Party Websites and Links

The Services may provide links to websites or online platforms operated by third parties.

If you follow links to websites that are not operated or controlled by us, you should review their privacy and security policies and other applicable terms.

We are not responsible for the privacy, security, content or operation of third-party websites or platforms that we do not control.

Information you provide in public or semi-public areas, including on third-party social-media platforms, may also be visible to other users of those platforms.

The inclusion of a link on our website does not, by itself, imply endorsement of the third-party website, its content, owners or operators.

Children's Data

The Services are not intended for use by children, and we do not knowingly collect personal information about children under the age of majority in their jurisdiction.

If you are the parent or guardian of a child who has provided personal information to us, you may contact us using the details below to request its deletion where applicable.

As of the effective date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell", as those terms may be defined under applicable law, personal information of individuals under 16 years of age.

Security and Retention of Your Information

We take appropriate measures to protect personal information. However, no security measures are perfect or impenetrable and we cannot guarantee absolute security.

Information transmitted over the internet may not always be completely secure while in transit. You should avoid using insecure channels to send sensitive or confidential information to us.

How long we retain personal information depends on factors including whether we need the information to provide the Services, maintain your account, process transactions, comply with legal obligations, resolve disputes or enforce contracts and policies.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected or as otherwise required or permitted by applicable law.

Your Rights and Choices

Depending on where you live, you may have some or all of the following rights regarding your personal information.

These rights are not absolute and may apply only in certain circumstances.

Right to Access

You may have the right to request access to personal information that we hold about you.

Right to Delete

You may have the right to request deletion of personal information we maintain about you, subject to applicable legal exceptions.

Right to Correct

You may have the right to request correction of inaccurate personal information we maintain about you.

Right to Data Portability

You may have the right to receive a copy of certain personal information we hold about you and, in certain circumstances, request that it be transferred to a third party.

Managing Communication Preferences

You may opt out of promotional emails at any time by using the unsubscribe option included in our emails.

If you opt out of marketing communications, we may still send non-promotional communications, such as information relating to your account, purchases, returns or orders.

Additional UK and EEA Rights

If you reside in the United Kingdom or European Economic Area, subject to applicable exceptions and limitations, you may also have rights including:

• The right to object to processing of your personal information in certain circumstances.
• The right to restrict processing of your personal information in certain circumstances.
• The right to withdraw consent where we rely on your consent to process personal information. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

You may exercise applicable rights by contacting us using the details provided below.

We may need to verify your identity before processing a request, where permitted or required by law.

We will not discriminate against you for exercising your applicable privacy rights.

We will respond to requests within the timeframes required by applicable law.

Complaints

If you have a complaint about how we process your personal information, please contact us using the contact details below so that we can attempt to resolve your concern.

If you are in the United Kingdom and are not satisfied with our response, you may also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator.

If you are located in the European Economic Area, you may have the right to lodge a complaint with the relevant data protection supervisory authority in your country.

International Transfers

We, Shopify and our other service providers may transfer, store or process personal information outside the country in which you live.

Where personal information is transferred outside the United Kingdom or European Economic Area, appropriate safeguards will be used where required by applicable data protection law.

These may include applicable adequacy regulations or decisions, standard contractual clauses or other legally recognised transfer mechanisms.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices, Services or applicable legal or regulatory requirements.

We will post the revised Privacy Policy on this website, update the "Last updated" date and provide any additional notice required by applicable law.

Contact

If you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of your applicable data protection rights, please contact us:

GRAUVE
Operated by Douglas Hagno, sole trader
Email: douglas@grauve.com
Business address: GRAUVE, 3F1 Third Floor, 3 Hill Street, Edinburgh, EH2 3JP, United Kingdom

You may also contact us through Instagram at @grauve.co.

For the purposes of applicable data protection law, Douglas Hagno, trading as GRAUVE, is the data controller responsible for your personal information.

This version preserves the substance of your original Shopify policy while making the business identity and contact section consistent with your Terms and removing the irrelevant “corporate group” language. Your original policy identified GRAUVE only generically as the controller at the end, so the new wording makes that relationship explicit.