Privacy Policy
Cinderella-Me
Website: www.cinderella-me.co.uk
Last updated: 14 May 2026
This Privacy Policy explains how Cinderella-Me collects, uses, stores and protects your personal information when you visit our website, contact us, create an account, place an order, join our mailing list or otherwise interact with us.
Cinderella-Me is owned and operated by ZypherLock LLC.
For the purposes of UK data protection law, including the UK GDPR and the Data Protection Act 2018, the data controller is:
ZypherLock LLC
Trading as Cinderella-Me
Company jurisdiction: Delaware, United States
Website: www.cinderella-me.co.uk
If ZypherLock LLC appoints a UK representative or UK contact for data protection matters, the details will be published here:
UK Representative / UK Contact: Contact
1. Information we collect
We may collect and process the following types of personal information:
1.1 Information you provide to us
This may include:
- your name;
- email address;
- billing address;
- delivery address;
- telephone number;
- account login details;
- order details;
- payment-related information;
- messages you send to us;
- returns, refund or customer service information;
- marketing preferences.
1.2 Information collected when you use our website
When you visit www.cinderella-me.co.uk, we may collect:
- IP address;
- browser type and version;
- device type;
- operating system;
- pages visited;
- referring website;
- date and time of visits;
- website usage and analytics data;
- cookie and tracking preference data.
1.3 Payment information
Payments may be processed by third-party payment providers. We do not intend to store your full card details on our own systems. Payment providers may process your payment details securely in accordance with their own legal and regulatory obligations.
2. How we use your personal information
We use your personal information for the following purposes:
2.1 To process and deliver orders
We use your name, contact details, delivery address and order information to process purchases, take payment, deliver products, deal with returns and provide customer support.
Lawful basis: Contract.
2.2 To manage your account
If you create an account, we use your information to allow you to log in, view orders, manage details and use account features.
Lawful basis: Contract and legitimate interests.
2.3 To respond to enquiries
If you contact us, we use your details to reply and deal with your request.
Lawful basis: Legitimate interests.
2.4 To provide customer service, returns and refunds
We may use your order and contact details to handle returns, refunds, complaints, delivery problems and disputes.
Lawful basis: Contract, legal obligation and legitimate interests.
2.5 To comply with legal, tax and accounting obligations
We may retain order, invoice and transaction information where required for tax, accounting, audit, fraud prevention or legal purposes.
Lawful basis: Legal obligation and legitimate interests.
2.6 To protect our website and business
We may process technical data, logs and security information to detect fraud, prevent misuse, protect customer accounts and keep the website secure.
Lawful basis: Legitimate interests.
2.7 To improve the website
We may use analytics and website usage data to understand how visitors use our site, improve performance, improve products and develop better customer experiences.
Lawful basis: Consent where required for cookies; otherwise legitimate interests.
2.8 To send marketing communications
If you sign up to our mailing list or consent to marketing, we may send you news, offers, product updates and promotional messages.
You can unsubscribe at any time using the unsubscribe link in our emails or by contacting us.
Lawful basis: Consent, or legitimate interests where the law allows soft opt-in marketing to existing customers.
3. Cookies
Our website may use cookies and similar technologies.
Cookies are small files placed on your device. They help the website function, remember your preferences, improve performance and understand how visitors use the site.
We may use:
- strictly necessary cookies — required for the website to work, including basket, checkout, login and security features;
- performance and analytics cookies — used to understand how visitors use the website;
- functionality cookies — used to remember preferences;
- marketing cookies — used to support advertising, retargeting or promotional activity, only where applicable.
Where required by law, we will ask for your consent before placing non-essential cookies.
You can manage or block cookies through your browser settings. Blocking some cookies may affect how the website works, especially basket, checkout or account features.
A separate Cookie Policy may be provided on the website.
4. Who we share your information with
We do not sell your personal information.
We may share personal information where necessary with:
- website hosting providers;
- payment processors;
- delivery and courier companies;
- email and communication providers;
- analytics providers;
- IT support and security providers;
- customer service systems;
- professional advisers, including accountants and lawyers;
- fraud prevention and chargeback services;
- regulators, law enforcement or public authorities where legally required;
- buyers or prospective buyers if the business or assets are sold, transferred or reorganised.
We only share personal information where necessary and where there is a lawful basis to do so.
5. International transfers
ZypherLock LLC is based in the United States. This means your personal information may be transferred to, stored in or accessed from countries outside the United Kingdom and European Economic Area.
Where personal information is transferred internationally, we will take steps required by data protection law to protect it. This may include using appropriate contractual safeguards, data processing agreements, transfer risk assessments or other lawful transfer mechanisms.
6. How long we keep your information
We keep personal information only for as long as reasonably necessary for the purpose it was collected, including legal, accounting, tax, fraud prevention and dispute-resolution requirements.
Typical retention periods are:
| Type of information | Typical retention period |
|---|---|
| Customer account details | While the account remains active, then up to 1 year after closure unless needed longer |
| Order, invoice and transaction records | Up to 6 years where required for tax/accounting/legal records |
| Delivery information | As long as needed to fulfil the order and handle returns or disputes |
| Customer service messages | Up to 2 years, or longer if needed for a dispute |
| Marketing consent records | Until you unsubscribe or withdraw consent, plus a record of suppression/unsubscribe |
| Website security logs | Usually up to 12 months unless needed for investigation |
| Cookie and analytics data | According to the cookie duration or analytics provider settings |
Where information is no longer needed, we will delete it, anonymise it or securely archive it.
7. Security
We take reasonable technical and organisational steps to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure.
These measures may include:
- secure hosting;
- SSL/TLS encryption;
- access controls;
- password protection;
- secure payment processing;
- system monitoring;
- malware and security checks;
- staff or contractor access restrictions where applicable.
No internet transmission is completely secure. You are responsible for keeping your account password confidential and for logging out when using shared devices.
8. Your rights
Under data protection law, you may have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your personal information;
- ask us to restrict how we use your information;
- object to certain uses of your information;
- withdraw consent where we rely on consent;
- ask for your information in a portable format;
- complain to the Information Commissioner’s Office.
Some rights may not apply in all circumstances, for example where we must keep information for legal, tax, accounting, fraud prevention or dispute purposes.
To exercise your rights, contact us at:
[INSERT PRIVACY EMAIL ADDRESS]
We may need to verify your identity before responding.
9. Marketing preferences
You can opt out of marketing at any time by:
- clicking the unsubscribe link in our emails;
- changing your account preferences, where available;
- contacting us at Contact
We may still send service messages about orders, delivery, payments, returns, security or account administration.
10. Third-party links
Our website may contain links to third-party websites, including payment providers, social media platforms, couriers or other services.
We are not responsible for the privacy practices, content or security of third-party websites. You should read their privacy policies before providing personal information to them.
11. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
The latest version will always be published on www.cinderella-me.co.uk. The “Last updated” date at the top of this policy will show when it was last changed.
12. Contact us
For questions, requests or concerns about this Privacy Policy or how your personal information is handled, contact:
ZypherLock LLC trading as Cinderella-Me
Contact: Contact
Address: Delaware
You also have the right to complain to the Information Commissioner’s Office if you are unhappy with how your personal information has been handled. The ICO is the UK supervisory authority for data protection matters.