VictoriaEva Privacy Policy

Last updated 30 September 2026

This Privacy Policy explains how MOVE by VICTORIAEVA LTD collects and uses personal data when you visit victoriaeva.shop, create an account, contact us, or place an order. It applies to our online beauty, personal care, fragrance, home, car, pet and related product shop. We process personal data under the EU General Data Protection Regulation (GDPR) and applicable Cyprus data protection law, including Law 125(I)/2018.

1. Who is responsible for your personal data

The controller is MOVE by VICTORIAEVA LTD ("VictoriaEva", "we", "us" or "our").

Business contact address: 187, Arch. Makariou III Avenue, Shop 4, CY-3030, Limassol, Cyprus. Email: welcome@victoriaeva.com. Telephone: +357 99 949403.

For privacy questions or to exercise your rights, contact us at welcome@victoriaeva.com.

2. Personal data we collect

The information we collect depends on how you use the shop. It may include:

  • Contact and delivery information, such as your name, email address, telephone number, billing address and delivery address.
  • Order and account information, such as products viewed or purchased, order history, account details, saved preferences, gift voucher details, returns and customer service communications.
  • Marketing preferences, such as whether you have agreed to receive marketing messages and, if you choose to provide it, your date of birth for birthday offers.
  • Payment and transaction information, such as payment status, transaction references and refund details. Payments are handled through the payment service selected at checkout; we do not ask you to send your full card number or security code by email or message.
  • Technical and usage information, such as IP address, device and browser details, approximate location derived from your device or IP address, pages visited, referral source and cookie or similar technology identifiers.
  • Information you choose to provide when you contact us, including the content of your message and any attachments.

Please do not send us personal data about another person unless you are authorised to do so. If you provide another person’s delivery details, you are responsible for making sure they know that you have provided them to us.

3. How and why we use personal data

We use personal data for the purposes below and rely on the corresponding legal basis under Article 6 GDPR:

  • To operate the shop, manage your account, accept and fulfil orders, arrange delivery, process returns and refunds, and respond to order questions. Legal basis: steps taken at your request and performance of our contract with you (Article 6(1)(b)).
  • To take payment, prevent payment abuse, protect the shop and investigate suspected fraud or security incidents. Legal basis: performance of a contract and, where appropriate, our legitimate interests in securing our business and customers (Articles 6(1)(b) and 6(1)(f)).
  • To keep accounting, tax and other records and respond to lawful requests from public authorities. Legal basis: compliance with legal obligations (Article 6(1)(c)).
  • To answer general enquiries, manage complaints and maintain business records. Legal basis: our legitimate interests in responding to customers and managing our business (Article 6(1)(f)), or steps taken at your request where relevant.
  • To keep the shop working and secure, for example to remember your basket, run checkout and protect the website, using strictly necessary cookies and similar technologies. Legal basis: our legitimate interests in operating a secure, functioning shop (Article 6(1)(f)). These technologies do not require your consent.
  • To understand how the shop is used, improve it and measure the performance of our advertising, using analytics and advertising cookies and similar technologies. We use these only if you accept them through our cookie banner. Legal basis: your consent (Article 6(1)(a)).
  • To send you news about special offers, events and birthday offers by email or other electronic channels, where you have ticked the marketing consent box when creating an account, at checkout or when signing up. The box is unticked by default and you do not need to tick it to buy from us. Legal basis: your consent (Article 6(1)(a)). We use your date of birth only to send birthday offers, and only if you choose to give it. You can unsubscribe at any time using the link in each message or by contacting welcome@victoriaeva.com.

You can withdraw consent at any time where we rely on it. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. If we rely on legitimate interests, you may object as described below.

4. Special category data, including health information

Beauty and personal care products may relate to a person’s wellbeing, but a product purchase by itself does not necessarily mean that we process health data. If you choose to tell us information about your health in a message or enquiry—for example, an allergy, skin or scalp condition, product sensitivity, pregnancy, or another health concern—we will treat that information as special category personal data where it reveals information about your health.

We will use such information only to respond to the specific enquiry or provide the product information you requested. It is optional: please do not include health information unless it is needed for your question. We will process it only where we have both a lawful basis under Article 6 GDPR and a valid condition under Article 9 GDPR. For this limited customer-support purpose, we intend to rely on your separate, explicit consent under Articles 6(1)(a) and 9(2)(a), collected through a clear, unticked consent choice before the information is processed.

How we collect this consent depends on how you contact us:

  • Contact form: the form includes a separate, unticked box asking for your explicit consent to our use of any health information you include. If you do not tick it, we will not use that information to tailor our answer.
  • Email, social media messages, chat or telephone: if you share health information without having given explicit consent, we will not use it to tailor our answer. We will either answer your question in general terms or ask you to confirm your explicit consent in writing, for example by replying to our consent request, before we use it. If you do not give consent, we will delete the health information within 30 days after your enquiry is closed, unless we need to keep it to establish, exercise or defend legal claims.

We keep a record of each consent, including when and how it was given, so that we can demonstrate it.

We will not use health information for marketing, targeted advertising, or automated product profiling. You may withdraw explicit consent by contacting welcome@victoriaeva.com. We will then stop this processing and erase the information unless another legal exception allows us to retain it for a specific purpose, such as establishing, exercising or defending legal claims. If you do not provide the information or consent, we may still answer general questions without tailoring the response to health information.

5. Cookies and similar technologies

Our Shopify-powered shop and its apps use cookies and similar technologies, grouped as follows:

  • Strictly necessary: needed for security, your shopping basket, checkout and remembering your cookie choice. These are always active and do not require consent.
  • Preferences, analytics and marketing: used to remember your settings, understand how the shop is used, and measure or personalise advertising. These are placed only after you actively accept them through our cookie banner. No non-essential category is pre-selected, and rejecting them is as easy as accepting them.

You can change or withdraw your choice at any time using contact details indicated in this Policy. Withdrawing consent stops future use but does not affect use before withdrawal. We store your cookie choice for 12 months and then ask you again. Information about Shopify's cookies is available at https://www.shopify.com/legal/cookies. You can also control cookies through your browser; blocking strictly necessary cookies may stop parts of the shop from working.

6. Who receives personal data

We share personal data only where needed for the purposes in this policy. Recipients may include:

  • Shopify International Limited (Ireland) and its affiliates, which provide the ecommerce platform, hosting, customer accounts and checkout. For these services, Shopify processes personal data on our behalf as our processor.
  • The payment service provider you select at checkout, to process payments, refunds and fraud checks.
  • Courier and delivery providers, to deliver orders and provide tracking.
  • Technology, website support, email, customer service, analytics and marketing providers that act on our instructions where applicable.
  • Professional advisers, auditors, insurers, banks and public authorities where needed for our business, legal obligations or legal claims.

These providers may process personal data on our behalf under appropriate contractual terms. Some providers may process data as independent controllers for their own services; their own privacy notices will apply to that processing. We do not sell your personal data.


Shopify as an independent controller. For some services, Shopify decides how and why personal data is used and acts as a separate controller, subject to its own Consumer Privacy Policy (https://www.shopify.com/legal/privacy/customers). This includes:

  • Shop Pay and the Shop app, if you choose to use them, for example to save your details for faster checkout across Shopify stores.
  • Shopify's fraud prevention and security services, which may use information from across Shopify stores to detect fraud and protect merchants and buyers.
  • Other Shopify network services, where enabled on our shop, that use data from across Shopify stores to provide and improve Shopify's services.

You can contact Shopify about that processing as described in its Consumer Privacy Policy. You can also contact us and we will help where we can.

7. International transfers

Some service providers may process personal data outside Cyprus or the European Economic Area (EEA). Where personal data is transferred outside the EEA, we will ensure that a lawful transfer mechanism and appropriate safeguards are in place, such as an adequacy decision or Standard Contractual Clauses, together with supplementary measures where required. You can contact us for information about the safeguards relevant to a particular transfer. Shopify stores and processes data in countries including Canada, which benefits from an EU adequacy decision, and the United States, where it relies on lawful transfer mechanisms such as Standard Contractual Clauses.

8. How long we keep personal data

We keep personal data only for as long as needed for the purpose for which it was collected, using the following periods:

  • Orders, invoices, payment and refund records: 6 years from the end of the year in which the transaction took place, to meet Cyprus tax, VAT and accounting requirements.
  • Customer account: while your account is active. If you do not log in or place an order for 3 years, we will notify you by email and then close the account and delete or anonymise its data. You can ask us to close your account at any time. Order records are then kept as described above.
  • Customer service messages and complaints: 2 years after the enquiry or complaint is closed.
  • Marketing: your contact details and, if provided, your date of birth, for as long as your marketing consent remains in place. After you unsubscribe, we keep only your email address on a suppression list so that we do not contact you again, and a record of your consent and its withdrawal for 3 years to demonstrate compliance.
  • Cookie consent records: 12 months from your choice.
  • Technical and security logs: up to 12 months, unless needed to investigate a specific security incident.
  • Legal claims: where information is needed for an actual or potential legal claim, we keep it until the claim is resolved or the applicable limitation period has expired (generally 6 years for contractual claims in Cyprus).

When a retention period ends, we delete or anonymise the information.

For special category data processed with your explicit consent, we will keep it only for as long as needed to answer the specific enquiry and delete it within 30 days after the enquiry is closed, unless we need to keep it to establish, exercise or defend legal claims. Health information received without explicit consent is handled as described in section 4.

9. Your data protection rights

Subject to the conditions and exceptions in the GDPR, you may have the right to:

  • Ask for access to your personal data and information about how it is used.
  • Ask us to correct inaccurate or incomplete data.
  • Ask us to erase data or restrict how it is used.
  • Receive certain data in a portable format or ask us to transmit it to another controller where the right applies.
  • Object to processing based on our legitimate interests, including related profiling. You may object to direct marketing at any time.
  • Withdraw consent at any time where processing is based on consent.

To exercise a right, email welcome@victoriaeva.com. We may need to verify your identity before acting on a request. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus. Information and complaint channels are available at https://www.dataprotection.gov.cy/.

10. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. No website or electronic transmission can be guaranteed to be completely secure. Please use a unique password for your account and contact us promptly if you believe your account or data has been compromised.

11. Automated decisions

We do not make decisions about you solely by automated means that produce legal effects or similarly significant effects. If this changes, we will update this policy and provide any information required by law.

12. Children

Our shop is intended for adults. You must be at least 18 years old to create an account, place an order, sign up for marketing or give any consent described in this policy, and by doing so you confirm that you are 18 or over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact welcome@victoriaeva.com and we will delete it.

13. Changes to this policy

We may update this Privacy Policy to reflect changes to our shop, data processing or legal requirements. The latest version will be published on victoriaeva.shop with its updated date.

14. Contact

For questions or requests about this Privacy Policy or your personal data, contact:

MOVE by VICTORIAEVA LTD
187, Arch. Makariou III Avenue, Shop 4, CY-3030, Limassol, Cyprus
welcome@victoriaeva.com

+357 99 949403

Before publishing

The text is tailored to the live VictoriaEva shop and public contact details, but these operational details are not visible from the supplied screenshots or public storefront. Confirm them in Shopify Admin and remove this checklist from the customer-facing policy page.

  • Confirm the company name and whether the address shown on the Contact page is also the registered office address.
  • List the actual payment providers, courier companies, email/newsletter tools, analytics and advertising services, and installed Shopify apps that receive personal data.
  • Confirm exactly which health or other special category data you collect, where you collect it, and the purpose. If you rely on explicit consent, add a separate, unticked consent step to the relevant form or channel and keep evidence of the choice. Do not publish the health-data wording as implemented unless that consent step exists.
  • Check cookie categories, the cookie banner, consent records and the settings link on the live website; name any non-essential cookie providers.
  • Check whether Shopify Network Intelligence or Enhanced Services are enabled and add the applicable Shopify notices and opt-out link if they are.
  • Confirm your internal retention periods and any appointed Data Protection Officer details.