Privacy Policy

Last updated: 29 October 2026.

This policy explains how personal information is handled when you browse GLOWZA and purchase lighting products. It is based on the EU General Data Protection Regulation (GDPR), applicable national privacy law and applicable rules on cookies and similar storage.

Controller information pending: GLOWZA is the storefront brand. The operator's legal name, business address and privacy contact have not yet been supplied. These mandatory details must be provided before this policy can serve as a complete privacy notice.

Information used and why

You do not need a customer account and this storefront has no newsletter signup or contact form. At Shopify checkout, you provide details needed for your order, such as your name, email, delivery and billing addresses, and payment information. Payment details are handled by Shopify and its payment providers; this storefront does not collect card details directly.

Order processing, delivery and order communications rely on performance of a contract or steps taken at your request before a contract. Tax, accounting and legally required records rely on legal obligations. Security and fraud prevention may rely on legitimate interests, subject to your rights and a balancing assessment. Optional marketing or non-essential tracking requires an appropriate legal basis, including consent where required; purchasing is not consent to marketing.

Information marked as required at checkout is needed to enter into or perform your purchase contract; without it, your order may not be completed or delivered. This storefront does not itself make solely automated decisions producing legal or similarly significant effects. The operator must confirm any such processing by its service providers and provide the disclosures and safeguards required by GDPR where applicable.

Browser storage and technical information

Your cart items, Shopify cart identifier, checkout link and wishlist product handles are stored locally in your browser to remember your shopping selections. You can remove them by clearing this site's browser data; doing so resets these selections but does not cancel an order. The storefront does not add analytics or advertising trackers. Shopify checkout uses its own cookies and similar technologies under its applicable notices.

Hosting, Shopify and other requested services may process technical data such as your IP address, browser information and request logs to deliver and secure the site. The site loads Manrope fonts from Google Fonts, so your browser connects to Google when retrieving those fonts.

Who receives information

Information needed to provide the service may be shared with Shopify, payment providers, hosting services, delivery partners and fulfilment providers. Only information necessary for the relevant purpose should be shared. Authorities may receive information where legally required. Shopify's role can vary by service; see its Privacy Policy for its processing practices. This notice does not replace the seller's own GDPR responsibilities.

International transfers

Service providers may process data outside the European Economic Area. Where GDPR applies, restricted transfers must use a lawful mechanism, such as an applicable adequacy decision or standard contractual clauses with necessary supplementary safeguards. The operator must confirm its actual providers and transfer arrangements and make information about applicable safeguards available on request.

Retention and security

Local shopping data remains in your browser until cleared or replaced. Order and accounting records must be retained for the applicable statutory periods; other personal data should be kept only as long as needed for its purpose, including resolving disputes. The operator must confirm the specific periods that apply to its business. Appropriate technical and organisational safeguards must protect personal data; no online service can guarantee absolute security.

Your privacy rights

Subject to the conditions in applicable law, you may request access, correction, erasure, restriction and portability of your data. You may object to processing based on legitimate interests and to direct marketing. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful processing. Erasure is not absolute: records may need to be retained to comply with law or defend legal claims.

GDPR requests normally require a response within one month. Where permitted because of complexity or the number of requests, this may be extended by two further months, with reasons communicated within the first month. Identity verification may be required where reasonably necessary.

You can complain to a competent supervisory authority, including the authority where you live, work or believe an infringement occurred. In Malta, this is the Information and Data Protection Commissioner.

Changes to this policy

Material changes to processing must be reflected in this notice and communicated as required by law. Your statutory rights are not reduced by this policy.

Legal reference: EU General Data Protection Regulation.