Data controller: Joseph Harris, trading as Cara + Lila. Contact: caraandlila@gmail.com.
1. Who is responsible for your data?
The data controller for personal data processed through this website is:
Joseph Harris
Trading as Cara + Lila
Email: caraandlila@gmail.com
This notice applies to personal data collected through caraandlila.com. Third-party sites you reach through our links have their own privacy notices and may act as separate data controllers.
2. What personal data may we process?
Because the site is currently a static creator storefront, we aim to collect as little personal data as possible. Depending on how you use the site, this can include:
- technical information made available to the hosting service when you request a page, such as IP address, browser/device information and request logs;
- information you choose to send to us by email, such as your name, email address and the contents of your enquiry;
- your browser's necessary storage entry used to remember that you have dismissed our privacy notice.
We do not currently run user accounts, checkout, a mailing list, behavioural advertising or analytics on the site.
3. Why do we use personal data?
We use personal data only for purposes connected with operating the website, keeping it secure, responding to enquiries, understanding and resolving technical problems, and complying with legal obligations where applicable.
Where we process data because you contact us, the lawful basis will normally be our legitimate interests in responding to your request and managing our communications. Security and technical logging are generally processed on the basis of legitimate interests in operating a secure website. Where the law requires consent for a specific processing activity, such as optional online tracking, we will request consent before using it.
4. Hosting and service providers
The website is hosted using Vercel. Hosting and infrastructure providers may process technical information, including IP addresses and request information, as part of delivering and securing the site. We select providers appropriate to the services we use and require appropriate handling of personal data where applicable.
We may also use email, domain, security or other service providers where necessary to operate the website. We will update this notice when material changes to our processing require it.
5. Third-party destinations
Our site links to services including TikTok, Instagram, YouTube and product or affiliate destinations. Clicking a link can send you to a different service where that provider may collect information under its own privacy notice, cookies policy and terms. We do not receive or control all information collected by those services.
6. Affiliate links
When you follow an affiliate or commissionable product link, the destination or affiliate network may use its own tracking technology to attribute a purchase or qualifying action. That tracking is controlled by the relevant third party and is not a Cara + Lila cookie. The third party's own privacy and cookie information applies once you leave our website.
7. How long do we keep information?
We keep personal data only for as long as it is reasonably necessary for the purpose for which it was collected, including any period required for security, accounting, legal or dispute-resolution purposes. Routine technical logs are retained according to our hosting and security configuration and are not kept longer than necessary for those purposes.
8. Your rights
Under applicable UK data protection law, you may have rights including access to your personal data, correction of inaccurate data, deletion, restriction, objection to certain processing and data portability in applicable circumstances. Where processing relies on consent, you can withdraw that consent for future processing.
To exercise a right or ask a privacy question, email privacy@caraandlila.com. We may need to verify your identity before completing a request.
9. Complaints
You can contact us first so we can try to resolve your concern. You also have the right to complain to the UK's Information Commissioner's Office (ICO). The ICO website is ico.org.uk.
10. International transfers
Some technology providers we use may process personal data outside the United Kingdom. Where a restricted transfer applies, we will use an appropriate legal safeguard required by applicable data protection law.
11. Children
This site is intended for a general audience and is not directed specifically at children. We do not knowingly ask children to provide personal data through the website.
12. Changes to this privacy notice
We may update this notice when our processing changes or when applicable law or regulatory guidance changes. The date at the top shows when this version took effect.