Privacy Policy

Effective date: 3 May 2026 Last updated: 3 May 2026

About this policy

This Privacy Policy explains how HTS LLC ("we", "us", "our") collects, uses and protects your personal data when you use our site, place an order, sign up for our newsletter or contact us in any other way.

We take privacy seriously. This document is our way of telling you plainly what we do with your data and what you can do about it.

The policy applies to everyone, but the specific rights available to you depend on where you live. We have flagged this clearly below.

1. Who we are (data controller)

The controller of your personal data is a company registered in the United States:

• Legal name: HTS LLC
• Registered address: 501 Silverside Rd, Ste 105, No 5494, Wilmington, DE 19809, USA
• Privacy contact: hello@ellemania.com

📌 Note for users in the European Union (EU) and the United Kingdom: HTS LLC is established outside the European Economic Area and has no branch, office or physical representative within the EU. For all matters relating to the processing of your data and the exercise of your rights under the GDPR, please contact us directly by email at the address above.

2. What data we collect

2.1 Data you give us

• Account and contact details: name and surname, email address, phone number, billing address and delivery address;
• Order details: products ordered, prices, payment method (we do not store full card numbers – these go directly to the payment provider);
• Correspondence: messages you send us (email, contact form, chat);
• Reviews and user content: anything you post publicly (along with your username or initials);
• Marketing preferences: newsletter sign-up, consents given;
• Optional profile information: date of birth, skin type, cosmetic preferences (only if you choose to provide them).

2.2 Data collected automatically

• Device and browser information: IP address, browser type, operating system, device identifiers;
• Site usage data: pages visited, time spent on the site, products viewed, products added to the cart, click paths;
• Cookies and similar technologies: see our Cookie Policy for details;
• Location data: approximate location based on IP address (for currency, shipping and tax purposes).

2.3 Data from third parties

• Payment providers (Stripe, PayPal, P24): payment confirmation, anti-fraud screening results;
• Couriers: delivery status updates;
• Social login providers (if you log in via Google, Apple or Facebook): basic profile data you consent to share;
• Analytics and advertising partners: aggregated data on how users reach our site and how they use it.

2.4 Sensitive data

We do not intentionally collect sensitive data (relating to health, religion, ethnic origin, etc.). If you voluntarily choose to disclose health-related information – for example, allergies when reporting an adverse reaction to a cosmetic product – we treat it with particular care and use it solely to handle your report.

3. Why we collect data (purposes and legal bases)

Under the GDPR and the UK GDPR, every use of your data must have a legal basis. Here is what we do and why:

• Processing and delivering orders — Performance of a contract (Art. 6(1)(b))
• Operating your account — Performance of a contract (Art. 6(1)(b))
• Handling payments and preventing fraud — Contract + legitimate interest (Art. 6(1)(b), (f))
• Meeting tax and accounting obligations — Legal obligation (Art. 6(1)(c))
• Responding to questions and complaints — Contract + legitimate interest (Art. 6(1)(b), (f))
• Sending the newsletter — Consent (Art. 6(1)(a)) – you can withdraw it at any time
• Personalising product recommendations — Consent or legitimate interest (Art. 6(1)(a) or (f))
• Analytics to improve the site — Consent (cookies) or legitimate interest
• Targeted advertising — Consent (Art. 6(1)(a))
• Defending against claims — Legitimate interest (Art. 6(1)(f))
• Cosmetovigilance reports — Legal obligation (EU Regulation 1223/2009)

4. Who we share your data with

We do not sell your personal data. We share it only with parties essential to running our business:

• Payment providers – Stripe, Inc., PayPal, Przelewy24 and other providers available at checkout. Each processes payment data under its own privacy policy.
• Couriers and logistics companies – DPD, InPost and other carriers handling international and domestic delivery.
• Order fulfilment and warehousing – our warehouse partner in the USA (Long Island City, NY).
• E-commerce platform – Shopify (Canada/Ireland) hosts our site and stores order data.
• Email and marketing tools – Mailchimp (USA), a company owned by Intuit.
• Analytics and advertising – Google Analytics 4, Shopify Analytics, Google Ads.
• Professional advisers – accountants, lawyers and auditors, strictly as necessary.
• Public authorities – where required by law (tax authorities, courts, regulators).

If HTS LLC is sold or merged, your data may be transferred to the new owner, who will be bound by this Policy.

5. International data transfers

We are a US company, so data belonging to EU/UK users is transferred to and processed in the United States. We safeguard international transfers using:

• Standard Contractual Clauses (SCCs) approved by the European Commission;
• The UK International Data Transfer Addendum for transfers from the United Kingdom;
• Additional technical and organisational safeguards (data encryption, access controls).

For transfers to the USA we rely on Standard Contractual Clauses, supplemented by the EU-US Data Privacy Framework where our providers (e.g. Shopify, Google) hold an active certification. You can obtain a copy of the safeguards we use by writing to hello@ellemania.com.

6. How long we keep your data

We do not keep your data longer than necessary. Typical retention periods:

• Order and invoice records — 6 years (tax and accounting requirements)
• Account data — for as long as the account is active + 3 years after closure
• Marketing data — until consent is withdrawn + 30 days for removal from our systems
• Customer service correspondence — 3 years
• Cookies and analytics data — see our Cookie Policy
• Cosmetovigilance reports — at least 10 years (EU Regulation 1223/2009)
• Legal and litigation records — the duration of the dispute + the applicable limitation period

After these periods, we delete the data or irreversibly anonymise it.

7. Your rights

7.1 If you live in the EU, the UK, the EEA or Switzerland

Under the GDPR and the UK GDPR you have the right to:

• Access – receive a copy of the personal data we hold about you;
• Rectification – correct inaccurate or incomplete data;
• Erasure – request deletion of your data (the "right to be forgotten") in certain circumstances;
• Restriction of processing – limit how we process your data;
• Data portability – receive your data in a structured, machine-readable format;
• Object – to processing based on legitimate interest and to direct marketing;
• Withdraw consent – at any time, without affecting the lawfulness of processing carried out beforehand.

To exercise your rights, write to us directly at hello@ellemania.com. We will respond to your request within 30 days.

7.2 Right to lodge a complaint

You have the right to lodge a complaint with the data protection authority in your country.

• In Poland: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw | https://uodo.gov.pl
• In the UK: Information Commissioner's Office (ICO) | https://ico.org.uk

7.3 If you live in California (CCPA/CPRA)

California residents have the right to know what data is collected, to have it deleted, to have it corrected, to opt out of its "sharing" (for behavioural advertising purposes), and not to be discriminated against. We do not sell data for money; however, the use of advertising cookies may be considered "sharing" under the CPRA. To opt out, write to hello@ellemania.com. We respond within 45 days.

7.4 If you live in another US state

Residents of states such as Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others with comprehensive state privacy laws have similar privacy rights. Contact: hello@ellemania.com.

8. Security

We apply appropriate technical and organisational measures to protect your data: encrypted connections (HTTPS/TLS), secure data storage, access controls, and data processing agreements with our sub-processors. In the event of a data breach, we will notify you and the relevant authorities in accordance with applicable law.

9. Children

Our site is not directed at children under the age of 16 and we do not knowingly collect their data. If you become aware that a child has provided us with data without parental consent, write to hello@ellemania.com and we will delete it promptly. For US residents under the age of 13, we comply with COPPA.

10. Cookies

We use cookies to make the site work properly, for analytics purposes and to personalise advertising. Detailed information on how to manage your cookie preferences can be found in our dedicated Cookie Policy available on the site.

11. Changes to this policy

We may update this Policy. Each new version will be published on this page with a new "Last updated" date. We will notify you of material changes by email or by a prominent notice on the site 14 days before the changes take effect.

12. Contact

For all matters concerning privacy, the exercise of your rights, enquiries or complaints, please contact us:

• Email: hello@ellemania.com
• Returns address: Details of the returns procedure and the address for EU customers can be found in our Returns Policy / Store Terms & Conditions.