Privacy Policy

Last updated: October 22, 2026

1) Information about the collection of personal data and contact details of the controller

1.1 We are pleased that you are visiting our website and thank you for your interest. Below we explain how we handle your personal data when you use our website. Personal data is any data that can be used to identify you personally.

1.2 The party responsible for data processing on this website (the "controller") is:

Ell-Products&More, operating the online store Grace & Evelyn Naples
15311 Vantage Parkway West, Atrium I
Houston, TX 77032
United States
Email: info@grace-evelyn-naples.com

The controller is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

1.3 For security reasons and to protect the transmission of personal data and other confidential content (for example orders or inquiries to the controller), this website uses SSL/TLS encryption. You can recognize an encrypted connection by the "https://" at the start of the address and the lock symbol in your browser bar.

2) Data collected when you visit our website

When you use our website for information only, meaning you do not register or otherwise send us information, we only collect the data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary to display the website to you:

  • The page you visited on our website
  • Date and time of access
  • Amount of data sent in bytes
  • The source/referrer from which you reached the page
  • The browser used
  • The operating system used
  • The IP address used (where applicable, in anonymized form)

We process this data based on our legitimate interest in improving the stability and functionality of our website (for visitors from the EU/EEA: Art. 6(1)(f) GDPR). The data is not shared or used for any other purpose. However, we reserve the right to review the server log files afterwards if there are concrete indications of unlawful use.

3) Cookies

To make visiting our website more pleasant and to enable certain functions, we use so-called cookies on various pages. Cookies are small text files that are stored on your device. Some of the cookies we use are deleted at the end of your browser session, i.e. when you close your browser (session cookies). Other cookies remain on your device and allow us or our partners (third-party cookies) to recognize your browser on your next visit (persistent cookies). When cookies are set, they collect and process certain user information such as browser and location data and IP address values. Persistent cookies are deleted automatically after a set period, which can differ per cookie.

Some cookies make the ordering process easier by saving settings (for example, remembering the contents of your shopping cart for a later visit). Where individual cookies process personal data, this is done either to perform the contract (Art. 6(1)(b) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR), or on the basis of our legitimate interest in the best possible functionality of the website and a customer-friendly, effective website visit (Art. 6(1)(f) GDPR).

We may work with advertising partners who help us make our online offering more interesting for you. In that case, cookies from these partner companies are also stored on your device when you visit our website (third-party cookies). Where we work with such partners, we inform you individually and separately about the use of these cookies and the scope of the information collected in the sections below.

You can set your browser so that you are informed when cookies are set, decide individually whether to accept them, or refuse cookies in certain cases or in general. Every browser manages cookie settings differently. This is described in each browser's help menu, which explains how to change your cookie settings:

Please note that if you do not accept cookies, the functionality of our website may be limited.

4) Contacting us

When you contact us (for example via our contact form or by email), we collect personal data. Which data is collected through a contact form can be seen in the form itself. We store and use this data only to answer your request or to contact you, and for the related technical administration. The legal basis is our legitimate interest in answering your request (Art. 6(1)(f) GDPR). If your inquiry aims at concluding a contract, the additional legal basis is Art. 6(1)(b) GDPR. Your data is deleted once your request has been fully handled, i.e. when the circumstances show that the matter has been finally resolved, unless legal retention obligations apply.

5) Data processing when opening a customer account and for contract processing

We collect and process personal data when you provide it to us to perform a contract or when opening a customer account (Art. 6(1)(b) GDPR). Which data is collected can be seen in the relevant input forms. You can delete your customer account at any time by sending a message to the controller at the address above. We store and use the data you provide to process the contract. After the contract has been fully processed or your customer account has been deleted, your data is blocked in view of tax and commercial retention periods and deleted after these periods expire, unless you have expressly consented to further use of your data or we have reserved a legally permitted further use, about which we inform you below.

6) Use of your data for direct marketing

6.1 Subscribing to our email newsletter

If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. Providing any other data is voluntary and is used to address you personally. We use the so-called double opt-in procedure: we only send you the newsletter after you have expressly confirmed that you want to receive it. We send you a confirmation email asking you to confirm by clicking a link that you want to receive the newsletter in the future.

By clicking the confirmation link, you give us your consent to use your personal data (Art. 6(1)(a) GDPR). When you subscribe, we store the IP address assigned by your internet service provider (ISP) and the date and time of registration, so that we can trace any possible misuse of your email address at a later time. The data we collect when you subscribe is used only to send you promotional content through the newsletter. You can unsubscribe at any time via the link provided in each newsletter or by sending a message to the controller named above. After you unsubscribe, your email address is removed from our mailing list immediately, unless you have expressly consented to further use of your data or we have reserved a legally permitted further use, about which we inform you in this policy.

6.2 Sending the newsletter to existing customers

If you have given us your email address when buying goods, we reserve the right to regularly send you offers by email for goods similar to those you have already bought from our range. In this case, the processing is based on our legitimate interest in personalized direct marketing (Art. 6(1)(f) GDPR). If you objected to this use of your email address at the start, we will not send you any emails. You may object to the use of your email address for this purpose at any time with effect for the future, by notifying the controller named above or via the unsubscribe link in each email. After we receive your objection, we will stop using your email address for marketing purposes immediately.

7) Data processing for order handling

7.1 Where necessary to deliver your order, we pass the personal data we collect to the shipping company commissioned with the delivery. As part of payment processing, we pass your payment data to the payment service provider, insofar as this is necessary to process the payment. The legal basis for passing on the data is Art. 6(1)(b) GDPR.

7.2 Our store platform and payment providers

Shopify
Our online store runs on the Shopify platform, operated by Shopify Inc., 151 O'Connor Street, Ground Floor, Ottawa, ON K2P 2L8, Canada, and, for customers in the EU/EEA, by Shopify International Limited, 2nd Floor Victoria Buildings, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). Shopify stores and processes the data needed to run our store, such as your order, contact and delivery details, on our behalf. More information: https://www.shopify.com/legal/privacy

Shopify Payments (credit and debit cards)
We accept payment by Visa, Mastercard, American Express, Maestro and UnionPay through Shopify Payments. Card payments are processed by Shopify together with its payment processor Stripe. Your payment details are entered on a secure checkout page and are not stored by us. The data is passed on in accordance with Art. 6(1)(b) GDPR and only as far as necessary to process the payment. More information: https://www.shopify.com/legal/privacy and https://stripe.com/privacy

Shop Pay
If you choose Shop Pay, your payment is processed by Shopify. Shop Pay can save your email address, phone number, delivery address and payment details so that you can check out faster in stores that use Shopify. Shopify is responsible for this data under its own privacy policy: https://www.shopify.com/legal/privacy

Apple Pay
If you choose Apple Pay, the payment is processed through Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA ("Apple"). Apple receives the payment information you have stored in your Apple Wallet. More information: https://www.apple.com/legal/privacy/

Google Pay
If you choose Google Pay, the payment is processed through Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google receives the payment information you have stored in your Google account. More information: https://policies.google.com/privacy

8) Social media

Our website may contain links to our pages on social networks such as Facebook and Instagram (operated by Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA, and for the EU/EEA by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland). These are simple links. No data is sent to these networks until you click a link. When you click one, the social network's page opens in a new window, where you can interact with it (after logging in, if needed). For the purpose and scope of data collection by these networks and your rights there, please see their privacy policies: https://www.facebook.com/privacy/policy/ and https://privacycenter.instagram.com/policy/

9) Online marketing

9.1 Google Ads conversion tracking

This website uses the online advertising program Google Ads and, within it, conversion tracking by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and for the EU/EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). We use Google Ads to draw attention to our offers on external websites. We can see how successful each advertising measure is. Our interest is to show you advertising that is relevant to you, make our website more interesting, and calculate advertising costs fairly.

The conversion tracking cookie is set when a user clicks on an ad served by Google. These cookies usually expire after 30 days and are not used to identify you personally. If you visit certain pages of this website and the cookie has not yet expired, Google and we can see that you clicked the ad and were taken to this page. The information collected with the conversion cookie is used to create conversion statistics. We only learn the total number of users who clicked our ads and reached a page with a conversion tag; we do not receive information that identifies users personally. For visitors from the EU/EEA, we use Google Ads only with your consent (Art. 6(1)(a) GDPR).

You can block conversion tracking by deactivating the Google conversion tracking cookie in your browser settings, or permanently disable personalized ads here: https://adssettings.google.com. More information: https://policies.google.com/privacy

9.2 Google Ads remarketing

Our website uses Google Ads remarketing to show ads for this website in Google search results and on third-party websites. For this purpose, Google sets a cookie in your browser which, using a pseudonymous cookie ID and based on the pages you visited, enables interest-based advertising. If you have agreed with Google that your web and app browsing history is linked to your Google account, Google may use this data together with Google Analytics data to create audience lists for cross-device remarketing. You can disable these cookies permanently here: https://adssettings.google.com, or manage your choices via the Digital Advertising Alliance at https://www.aboutads.info/choices/.

10) Web analytics: Google Analytics 4

This website uses Google Analytics 4, a web analytics service of Google (see section 9.1 for contact details). Google Analytics uses cookies that allow your use of the website to be analyzed. The information generated about your use of this website is usually transferred to a Google server in the USA and stored there. Google Analytics 4 does not log or store IP addresses. On our behalf, Google uses this information to evaluate your use of the website, compile reports on website activity, and provide us with other services related to website and internet use. For visitors from the EU/EEA, we use Google Analytics only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time with effect for the future.

You can prevent cookies from being stored by changing your browser settings. You can also prevent Google from collecting and processing the data generated by the cookie by installing the browser add-on available here: https://tools.google.com/dlpage/gaoptout. More information: https://support.google.com/analytics/answer/6004245

11) Retargeting: Meta Pixel

This website uses the Meta Pixel of Meta Platforms, Inc. (see section 8). If you have given your consent where required, this allows us to track the behavior of users after they have seen or clicked a Facebook or Instagram ad. This helps us measure the effectiveness of our ads for statistical and market research purposes and improve future advertising.

The data collected is anonymous to us and does not allow us to identify users. However, Meta stores and processes the data, so a connection to your user profile is possible, and Meta may use the data for its own advertising purposes in accordance with its data policy (https://www.facebook.com/privacy/policy/). For visitors from the EU/EEA, this processing takes place only with your express consent (Art. 6(1)(a) GDPR). Only users aged 13 or older may consent to the use of the Meta Pixel; if you are younger, please ask your parent or guardian for permission.

You can set your browser to block cookies in the future or delete existing cookies; turning off all cookies may mean that some functions of our website no longer work. You can also opt out of interest-based advertising by third parties such as Meta via the Digital Advertising Alliance: https://www.aboutads.info/choices/, or adjust your ad settings directly in your Facebook or Instagram account.

12) International data transfers

We are based in the United States, and some of our service providers (such as Shopify, Google and Meta) process data in the United States, Canada or other countries. If you visit our website from the EU/EEA, the UK or Switzerland, your data will therefore be transferred to these countries. Where required, these transfers are based on an adequacy decision, such as the EU-U.S. Data Privacy Framework for certified U.S. companies, or on standard contractual clauses approved by the European Commission.

13) Your rights

13.1 Rights for visitors from the EU/EEA, UK and Switzerland

Under applicable data protection law (in particular the GDPR), you have the following rights with regard to the processing of your personal data:

  • Right of access (Art. 15 GDPR): you can request information about your personal data that we process, including the purposes of processing, the categories of data, the recipients, the planned storage period, the source of your data, and the existence of automated decision-making.
  • Right to rectification (Art. 16 GDPR): you can ask us to correct inaccurate data or complete incomplete data without delay.
  • Right to erasure (Art. 17 GDPR): you can ask us to delete your personal data, unless processing is necessary for exercising freedom of expression, for complying with a legal obligation, for reasons of public interest, or for establishing, exercising or defending legal claims.
  • Right to restriction of processing (Art. 18 GDPR): you can ask us to restrict processing while the accuracy of your data is being checked, if processing is unlawful but you do not want the data deleted, if you need the data for legal claims, or while it is being determined whether our legitimate grounds override yours.
  • Right to notification (Art. 19 GDPR): if you have exercised your right to rectification, erasure or restriction, we will inform all recipients of your data, unless this is impossible or involves disproportionate effort. You have the right to be informed about these recipients.
  • Right to data portability (Art. 20 GDPR): you can receive the data you have provided to us in a structured, commonly used and machine-readable format, or ask us to transfer it to another controller, where technically feasible.
  • Right to withdraw consent (Art. 7(3) GDPR): you can withdraw your consent at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
  • Right to lodge a complaint (Art. 77 GDPR): if you believe that the processing of your data violates the GDPR, you can complain to a supervisory authority, in particular in the country where you live, work, or where the alleged violation took place.

13.2 Right to object

IF WE PROCESS YOUR PERSONAL DATA ON THE BASIS OF OUR OVERRIDING LEGITIMATE INTEREST, YOU HAVE THE RIGHT TO OBJECT TO THIS PROCESSING AT ANY TIME, WITH EFFECT FOR THE FUTURE, ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION.

IF YOU OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED, UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENSE OF LEGAL CLAIMS.

IF WE PROCESS YOUR PERSONAL DATA FOR DIRECT MARKETING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR DATA FOR SUCH MARKETING. IF YOU OBJECT, WE WILL STOP PROCESSING THE DATA CONCERNED FOR DIRECT MARKETING PURPOSES.

13.3 Rights for U.S. residents

Depending on the state you live in (for example California, Colorado, Connecticut, Virginia, Texas and other states with consumer privacy laws), you may have the right to:

  • know which personal information we collect, use and disclose, and request a copy of it;
  • request correction of inaccurate personal information;
  • request deletion of your personal information;
  • opt out of the "sale" or "sharing" of your personal information for targeted (cross-context behavioral) advertising, and of profiling;
  • not be discriminated against for exercising these rights.

We do not sell your personal information for money. However, using advertising cookies and pixels (such as Google Ads and the Meta Pixel) may count as "sharing" or "selling" under some state laws. You can opt out by emailing us at info@grace-evelyn-naples.com, through the cookie settings on our website, or by using a Global Privacy Control (GPC) signal in your browser, which we honor. To exercise your rights, contact us at the email address above. We may need to verify your identity before handling your request. You may also use an authorized agent. If we deny your request, you may appeal by replying to our decision.

California residents: in the last 12 months we have collected the following categories of personal information: identifiers (such as name, email, postal address, IP address), commercial information (such as order history), internet activity (such as browsing behavior on our website), and approximate geolocation. We collect this for the purposes described in this policy and share it only with the service providers named here.

14) Children

Our website is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

15) How long we keep your personal data

How long we store personal data depends on the applicable legal retention period (for example commercial and tax retention periods). After this period expires, the data is routinely deleted, unless it is still needed to fulfill or enter into a contract and/or we have a continuing legitimate interest in storing it.

16) Changes to this privacy policy

We may update this privacy policy from time to time, for example when we add new services or when the law changes. The current version is always available on this page, with the date of the last update at the top.

17) Contact

If you have questions about this privacy policy or want to exercise your rights, please contact us at:

Ell-Products&More – Grace & Evelyn Naples
15311 Vantage Parkway West, Atrium I
Houston, TX 77032
United States
Email: info@grace-evelyn-naples.com