CCPA Privacy Policy
Updated 30 October 2026 · THOF-2026-10-30-R3
This page contains our current privacy and cookie notice, followed by additional regional rights. The regional provisions apply where the relevant law covers our processing and do not limit rights under the GDPR or any other applicable law. Applicable local response deadlines take precedence for requests governed by that law. Reading this notice or using the website does not by itself give consent.
Privacy policy
Controller and contact
THE HOUSE OF FAIRIES - CANDLES & HOME DECOR LTD is responsible for the personal data we process to operate The House of Fairies. Contact info@thehouseofairies.com, telephone 70000410, or write to Argyri Eftalioti 4A, Petrou & Pavlou, 3085 Limassol, Cyprus.
Information we use and where it comes from
You provide information when you place an order, create or use an account, contact us, subscribe to messages, submit a review or enrol in a course. This can include your name, contact and delivery details, billing information, order and payment status, communications, reviews and course participation. We receive transaction and delivery updates from the relevant providers and basic device, connection and usage information when you use the website.
Purposes and legal bases
We use information necessary to enter into and perform your purchase or course contract, deliver orders, provide access and support, and handle cancellations and returns. Tax, accounting, consumer-protection and other legal obligations require us to retain or disclose relevant records. Information needed for a purchase is identified in the relevant form; without it we may be unable to fulfil the order.
Our legitimate interests may support proportionate fraud prevention, security, handling legal claims and improving basic business operations, subject to your rights. Where required, we rely on consent for optional cookies, marketing or particular recording and publicity activities. Consent is separate from simply reading this policy, and you can withdraw it.
Service providers and recipients
Shopify provides our store, accounts and checkout infrastructure. The payment service and the delivery provider you select receive the information necessary to process payment or deliver the order; this includes BOX NOW when selected. We use Klaviyo for customer communications, Judge.me for reviews and Avada for consent management. The information used depends on the feature you choose, the purpose and the permissions that apply.
Zoom supports live teaching. Tevello supports enrolment and access to Academy recordings. Enrolment, participation and support information is used to provide the programme. Depending on the session and your participation, a recording may contain your display name, image, voice, chat or shared work. Check the session notice and contact us before attending if you need an alternative participation arrangement.
Providers may act as processors for our services and as independent controllers for particular activities under their own notices. Read Shopify’s consumer privacy notice, the Zoom privacy statement and the Tevello privacy policy. We also share information with professional advisers, authorities or a business successor where necessary and lawful.
Optional analytics, advertising and session replay
Where enabled and permitted by your privacy choices, our integrations include Google & YouTube, Meta (Facebook and Instagram), Pinterest and Klaviyo for analytics, advertising and attribution, and Microsoft Clarity for interaction analysis and session replay. These features can process device and browser information, identifiers and activity on our website. Optional tracking requiring consent is subject to your choices; newsletter consent is separate.
We use Shopify Network Intelligence, through which Shopify combines data from interactions with our store and other merchants to improve services, advertising and personalisation. Shopify’s consumer privacy notice explains its processing and available privacy choices.
International processing
Some service providers process information outside Cyprus or the EEA, including in the United States. Transfers subject to the GDPR require an applicable lawful mechanism, such as an adequacy decision or appropriate contractual safeguards, with supplementary measures where necessary. Contact us for information about the safeguards relevant to your information.
How long we retain information
We retain order and financial records for applicable accounting, tax and legal periods. We retain course records for the contracted access, support and legitimate recordkeeping or claims needs. Support correspondence is kept while needed to resolve and follow up the issue. Security records are kept for a proportionate security period. When a purpose ends, information is deleted or anonymised unless lawful retention is still necessary.
Marketing information is kept while the relevant consent or other lawful basis remains applicable. A minimal suppression record may be retained after an unsubscribe request so that we can respect it. Participant recording access and retention depend on the notified course purpose and access arrangements; recording retention is not automatically unlimited.
Your choices and rights
Depending on the processing and applicable law, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can object to direct marketing at any time. Where processing relies on consent, withdrawal does not affect the lawfulness of earlier processing. Email info@thehouseofairies.com. We may request proportionate identity verification and respond within the applicable GDPR deadlines, normally one month subject to lawful extensions.
You may complain directly to the Cyprus Commissioner for Personal Data Protection at dataprotection.gov.cy or another competent supervisory authority. You do not have to complain to us first.
Children, payments and security
We do not knowingly seek children’s independent purchases or marketing subscriptions. Where a child attends an appropriate workshop, the relevant information is handled with the required guardian involvement. Payment card information is handled through the payment service; do not send card numbers or security codes by email. We use appropriate security and access measures, but no internet service can be guaranteed completely secure.
Updates
We update this notice when our services or processing change and provide additional information or seek fresh consent where required. The version date appears with the policy.
Cookies and privacy choices
Cookies and similar technologies
Our store uses cookies and similar browser storage for essential shopping functions and, where enabled and permitted, optional preferences, analytics and marketing. A session cookie normally expires when the browser session ends; persistent storage remains until its stated expiry or deletion. Your browser and the available consent controls provide information and control over stored technologies.
Necessary functions
Necessary technologies support the cart, checkout, account security, fraud prevention and a function you expressly request, including remembering your privacy choice. They can operate without optional tracking consent where legally permitted. Blocking them in your browser may prevent the requested function from working. Analytics and advertising are not treated as necessary merely because they help our business.
Optional purposes and providers
Optional preferences remember non-essential choices. Analytics measures website use. Marketing supports advertising, attribution and related personalisation. Shopify and enabled integrations can supply these functions; our integrations include Google & YouTube, Meta, Pinterest, Klaviyo, Microsoft Clarity, Judge.me and Avada. Whether a particular function needs consent depends on its actual purpose and configuration, rather than its provider’s name alone.
Where consent is required, optional tracking requires your prior choice. You can reject optional purposes and still make an ordinary purchase. Visiting the site, scrolling, closing a notice or accepting sales terms does not by itself provide consent to optional tracking.
Change or withdraw your choice
Open Cookie choices in the footer to review available consent controls, reject optional purposes, accept them or save selected purposes. You can return to change or withdraw consent. Withdrawal applies to future processing based on consent and does not make earlier lawful processing unlawful. Your browser also lets you inspect or delete cookies and other storage; deleting a preference may cause you to be asked again.
Contact info@thehouseofairies.com if a privacy control is unavailable or you need information about a particular cookie, provider or storage period. The Privacy policy explains our contact details, data use, international processing and your rights.
Marketing messages
Newsletter sign-up is separate from cookie consent and purchase. Each marketing email provides an unsubscribe route. Buying a product, joining a course or allowing necessary cookies is not blanket permission for unrelated marketing. Any applicable lawful marketing exception remains subject to its conditions and an opt-out.
California — CCPA/CPRA rights
Where California’s CCPA, as amended by the CPRA, applies, California residents may request to know/access and obtain a portable copy of personal information, correct inaccuracies and delete information subject to lawful exceptions. They may opt out of sale or sharing for cross-context behavioural advertising and limit qualifying uses or disclosures of sensitive personal information. Exercising applicable rights must not lead to unlawful discrimination.
The information categories, sources, purposes, recipients and retention criteria are described above. Advertising integrations and Shopify Network Intelligence may involve disclosures classed as sale or sharing even without a monetary payment; this notice does not claim that no such disclosures occur.
Submit a request or an authorised-agent request by email to info@thehouseofairies.com or by post to our address above. Identity checks may apply to access, correction and deletion. Sale/sharing opt-outs do not require a verified identity or a new account. Qualifying browser opt-out signals, including Global Privacy Control, are a statutory opt-out method where the law requires them; cookie rejection and an advertising-industry opt-out are not automatically equivalent to every CCPA opt-out. Contact us if a control is unavailable.
Access, correction and deletion responses are generally due within 45 days, with any lawful extension explained; sale/sharing opt-outs have separate, shorter deadlines. Learn more or submit a complaint through the California Privacy Protection Agency.
Privacy requests
You may use the existing Avada request controls below for account-data requests, or email info@thehouseofairies.com for any privacy right, including rights not listed in those controls. Avada processes the submitted email address and request type to route your request. The controls do not require you to waive other rights. Receipt of a request is not confirmation that information has already been deleted.