Contents

1. 1. About this policy
2. 2. What cookies and similar technologies are
3. 3. Who is responsible
4. 4. Cookie categories used on our Shopify store
5. 5. Consent and legal exceptions
6. 6. Shopify storefront cookies
7. 7. Apps, pixels and third-party technologies
8. 8. Health and genetic-data safeguards
9. 9. Managing or withdrawing your choices
10. 10. Browser and device controls
11. 11. Cookie duration and retention
12. 12. Changes to cookies and this policy
13. 13. Contact details

1. About this policy

Grace Belgravia is a trading name of LOXA HOLDINGS LTD, company number 14167113. We operate an online store using Shopify.

This policy applies to the Grace Belgravia storefront, checkout, customer-account pages and other online pages that link to it.

It should be read with our Privacy Policy, Terms of Service and Returns, Cancellations and Refunds Policy.

A third-party website, laboratory portal, payment page or embedded service may use its own technologies under its own privacy and cookie information.

2. What cookies and similar technologies are

A cookie is a small text file stored on a browser or device. It can recognise a browser, remember a basket or setting, maintain a secure session or record how a website is used.

The same legal rules can apply to other technologies that store information on, or gain access to information from, a device. These may include:

• browser local storage and session storage;
• pixels, tags and web beacons;
• software development kits;
• device or browser identifiers;
• link decoration and campaign parameters; and
• scripts used for analytics, security, personalisation or advertising.

In this policy, the term cookies includes these similar storage and access technologies unless the context requires otherwise.

3. Who is responsible

LOXA HOLDINGS LTD is responsible for deciding which non-essential technologies Grace Belgravia chooses to use on its store and for configuring the consent choices offered to visitors.

Shopify provides the ecommerce platform, checkout, customer privacy settings and certain platform cookies. Depending on the technology and purpose, Shopify or another provider may act as our processor, service provider or a separate controller.

Installed Shopify apps, payment services, embedded content and marketing integrations may introduce additional cookies. We review these technologies and require them to respect the consent signals applicable to their purpose.

4. Cookie categories used on our Shopify store

5. Consent and legal exceptions

For visitors in the United Kingdom, the Privacy and Electronic Communications Regulations apply to cookies and similar technologies. The UK GDPR also applies where personal data is processed.

We provide clear information and request a positive choice before using non-exempt analytics, marketing, advertising or personalisation technologies. Merely continuing to browse is not treated as consent.

The banner must make it as easy to reject optional technologies as to accept them, and you can revisit your choice later.

Consent is not required for a technology that is strictly necessary to provide an online service you requested, such as maintaining a basket, securing checkout or remembering a cookie choice.

Where consent is the basis, you can withdraw it at any time. Withdrawal applies to future storage, access and related processing. It does not make earlier lawful use unlawful.

6. Shopify storefront cookies

The table below reflects the merchant-storefront cookies currently documented by Shopify at the date this policy was reviewed. A cookie may not appear during every visit. Its use can depend on the feature used, visitor region, consent decision, checkout method, customer account, browser and Shopify configuration.

Session means that the cookie normally expires when the relevant browser session ends. A rolling duration is renewed when the cookie is used.

Shopify may change cookie names, purposes and durations as its platform develops. We review this table when Shopify changes its published storefront list or when our store configuration changes.

7. Apps, pixels and third-party technologies

Shopify apps and optional services can add their own cookies or pixels. Depending on the tools enabled on the store, these may include:

• payment and accelerated-checkout providers;
• website analytics and error monitoring;
• search, recommendations and personalisation;
• email or text-message campaign measurement;
• advertising attribution, conversion measurement and retargeting;
• customer reviews, chat and support tools;
• fraud detection and account security; and
• embedded video, map, social or other hosted content.

Optional providers must receive the relevant Shopify Customer Privacy consent signal or be blocked until the required choice has been made. A custom pixel or app that does not correctly honour consent must not be enabled for UK visitors.

8. Health and genetic-data safeguards

Grace Belgravia provides private health-testing services, so browsing behaviour around particular tests may be sensitive even before a person purchases anything.

We therefore apply the following boundaries:

• identifiable laboratory results, health questionnaires, genetic findings and biological-age reports are not placed into advertising pixels;
• we do not create marketing audiences based on a person's actual test result or diagnosed condition;
• we do not disclose health or genetic data to advertising networks;
• optional marketing technologies are not permitted on secure result pages unless specifically assessed as necessary, lawful and appropriately disclosed;
• payment and order data are kept separate from laboratory result data as far as reasonably practicable; and
• cookie data is handled in accordance with our Privacy Policy.

9. Managing or withdrawing your choices

When the cookie banner is shown, you can:

• accept all optional categories;
• reject optional categories;
• make a more granular choice where the banner provides category controls; and
• return later through Cookie preferences to change the decision.

Changing a preference stops future optional use through that browser where technically supported. Existing cookies may remain until they expire or are removed, but they should not be used for a purpose that you have withdrawn where the system is correctly configured.

Your choice may need to be made again if you use another browser or device, clear cookies, use private browsing or if we request fresh consent after a material change.

10. Browser and device controls

Most browsers allow you to view, delete or block cookies, block third-party cookies and clear storage when the browser closes. Similar controls may be available in mobile operating systems and privacy extensions.

Blocking all cookies can affect basket, checkout, login, country selection, payment and other requested store functions.

Browser controls are separate from the Grace Belgravia consent panel. Using both provides additional control, but a browser setting may prevent the store from remembering the choice you made.

Private or incognito browsing reduces local history and storage after the session but does not make a person anonymous to websites, internet providers or other services.

11. Cookie duration and retention

A session cookie normally expires when the browser session ends. A persistent cookie remains until its stated expiry date, it is replaced or it is deleted through browser or device controls.

We choose durations that are proportionate to the purpose. Consent and objection choices may be remembered for an extended period so that the store does not repeatedly ask the same question.

Information derived from cookies can be retained separately from the browser cookie. Where it is personal data, the retention approach in our Privacy Policy applies.

We periodically renew the request for consent where appropriate and request a fresh choice when our optional purposes or providers materially change.

12. Changes to cookies and this policy

We may update this policy when Shopify changes its platform cookies, when we add or remove an app, pixel, payment method or embedded service, or when law and regulatory guidance change.

The current version and effective date will be published on this page. Where a change materially alters an optional purpose, we will update the consent mechanism and request a new choice where required.