Privacy policy

Last updated: August 2026

Loft & Stone is a trading name of LJC COMMERCE LIMITED. We are committed to protecting your personal information and being transparent about how we use it. This policy explains what data we collect, why we collect it, and your rights in relation to it.

1. Who We Are

LJC COMMERCE LIMITED operates the online store at loftandstone.com. When we refer to "we", "us" or "our" in this policy, we mean LJC COMMERCE LIMITED trading as Loft & Stone. You can contact us at support@loftandstone.com.

2. Information We Collect

We collect information when you browse our store, place an order, create an account, sign up to our mailing list, or contact us. This includes:

Identity & contact data — name, email address, phone number, billing and shipping address.
Transaction data — products purchased, order value, payment method (we do not store full card details — these are handled securely by our payment processor).
Account data — username and password if you create an account.
Usage & technical data — IP address, browser type, pages visited, referring URLs, device identifiers, and browsing behaviour collected via cookies and similar technologies.
Marketing preferences — whether you have opted in to receive emails or SMS from us.
Communications data — messages you send us via email, contact forms, or customer support.

3. How We Use Your Information

We use your personal data to:

Process and fulfil your orders and send order confirmations, shipping updates, and delivery notifications.
Manage your customer account.
Respond to your enquiries and provide customer support.
Send you marketing emails, SMS messages, or promotions where you have opted in or where we have a legitimate interest in doing so (you can opt out at any time).
Personalise your experience on our site, including product recommendations and targeted advertising.
Detect and prevent fraud, chargebacks, and other prohibited activities.
Comply with legal obligations.
Improve our website and services through analytics.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data on the following legal bases:

Contract — processing necessary to fulfil your order or manage your account.
Legitimate interests — fraud prevention, site security, and direct marketing to existing customers.
Consent — where you have opted in to receive marketing communications.
Legal obligation — where we are required by law to process your data.

5. Sharing Your Information

We do not sell your personal data. We share it only with trusted third parties who help us operate our store, including:

Shopify — our ecommerce platform (see Shopify's privacy policy at shopify.com/legal/privacy).
Payment processors — such as Stripe and PayPal, to handle transactions securely.
Shipping and fulfilment partners — to dispatch and deliver your order.
Email & SMS marketing platforms — such as Klaviyo, to send you communications you have opted in to.
Analytics providers — such as Google Analytics and Meta Pixel, to help us understand site performance.
Customer service tools — to manage support enquiries.

All third parties are contractually required to handle your data securely and only for the purposes we specify. We may also disclose your data if required to do so by law or in response to a valid legal request.

6. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to operate our store and deliver a personalised experience. These include:

Essential cookies — required for the store to function (e.g. your shopping cart and login session).
Analytics cookies — to understand how visitors use our site (e.g. Google Analytics).
Marketing & retargeting cookies — to show you relevant ads on other platforms (e.g. Meta, Google Ads, TikTok).

You can control cookies through your browser settings. Disabling certain cookies may affect the functionality of our store.

7. Marketing Communications

If you have opted in, we may contact you by email or SMS with promotions, new arrivals, and exclusive offers. You can unsubscribe at any time by clicking the "Unsubscribe" link in any email, replying STOP to any SMS, or contacting us directly. We will process your opt-out promptly.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes set out in this policy, or as required by law. Order data is typically retained for 7 years for tax and accounting purposes. Marketing data is retained until you opt out. You may request deletion of your data at any time (see Your Rights below).

9. International Data Transfers

Our business operates internationally and some of our service providers are located outside your country. Where we transfer personal data outside the EEA or Australia, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent mechanisms, to protect your data.

10. Your Rights

Depending on where you are located, you may have the following rights regarding your personal data:

Access — request a copy of the personal data we hold about you.
Correction — request that we correct inaccurate or incomplete data.
Deletion — request that we delete your personal data (subject to legal obligations).
Restriction — request that we restrict how we use your data.
Portability — request a copy of your data in a machine-readable format.
Objection — object to processing based on legitimate interests or for direct marketing.
Withdraw consent — where processing is based on consent, withdraw it at any time.

To exercise any of these rights, please contact us at support@loftandstone.com. We will respond within 30 days. If you are unhappy with how we handle your request, you have the right to lodge a complaint with your relevant data protection authority.

11. Security

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. Our store is hosted on Shopify, which maintains PCI-DSS compliance for payment data. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

12. Children's Privacy

Our store is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

13. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their policies before providing any personal data.

14. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with the revised date. We encourage you to review this policy periodically.