Privacy policy

Last updated: September 1, 2026

Ella & Roam operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Ella & Roam is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy explains how we collect, use, disclose, store and otherwise process your personal information when you visit, use or make a purchase or other transaction using the Services, or when you otherwise communicate with us.

If you are located in the European Union ("EU") or European Economic Area ("EEA"), this Privacy Policy also explains your rights under the General Data Protection Regulation ("GDPR") and applicable local data protection laws.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand how your personal information may be collected, used and disclosed as described in this Privacy Policy.

Personal Information We Collect or Process

When we use the term "personal information", we are referring to information that identifies you or can reasonably be linked to you or another person.

Personal information does not include information that has been collected anonymously or de-identified so that it can no longer reasonably identify or be linked to an individual.

Depending on how you interact with the Services, where you are located and as permitted or required by applicable law, we may collect or process the following categories of personal information:

• Contact details, including your name, address, billing address, shipping address, telephone number and email address.

• Financial information, including payment card information, financial account information, transaction details, form of payment and payment confirmation. Payment information may be processed by our payment service providers.

• Account information, including your username, password, preferences and settings.

• Transaction information, including products you view, add to your cart, add to your wishlist, purchase, return, exchange or cancel, as well as your previous transactions.

• Communications with us, including information you provide when contacting customer support or otherwise communicating with us.

• Device information, including information about your device, browser, network connection, IP address and other unique identifiers.

• Usage information, including information about how, when and where you interact with or navigate the Services.

• Marketing preferences, including your preferences regarding communications and advertising.

We do not intentionally collect special categories of personal data unless permitted by applicable law and where an appropriate legal basis and additional safeguards apply.

Sources of Personal Information

We may collect personal information from the following sources:

• Directly from you, including when you create an account, place an order, visit or use the Services, communicate with us or otherwise provide your personal information.

• Automatically through the Services, including from your device when you use our products or services or visit our websites, including through cookies and similar technologies where permitted by law.

• From our service providers, including when we engage them to provide technology, payment, analytics, fulfilment, shipping, customer support or other services on our behalf.

• From our business partners or other third parties, where permitted by applicable law.

How We Use Your Personal Information

Depending on how you interact with us and which Services you use, we may use your personal information for the following purposes:

Provide, Tailor and Improve the Services

We use your personal information to provide and operate the Services, including to:

• process and fulfil your orders;

• process payments;

• arrange shipping and delivery;

• facilitate returns, refunds and exchanges;

• create and manage customer accounts;

• remember your preferences;

• provide customer support;

• enable product reviews;

• recommend products that may be relevant to you;

• personalise and improve your shopping experience; and

• maintain, develop and improve our website, products and Services.

Where required under the GDPR, we rely on the performance of our contract with you or our legitimate interests as the legal basis for these activities.

Marketing and Advertising

Where permitted by applicable law, we may use your personal information to send marketing, advertising and promotional communications by email, text message or other permitted communication channels.

We may also use information about your interactions with the Services, including products you have viewed, purchased or added to your cart, to help us provide relevant advertising.

Where required, we will obtain your consent before sending electronic direct marketing or using cookies and similar technologies for advertising purposes.

You may withdraw your consent or unsubscribe from marketing communications at any time.

Security and Fraud Prevention

We may use your personal information to:

• authenticate accounts;

• provide a secure payment and shopping experience;

• detect, investigate and prevent fraud;

• identify potentially illegal, unsafe or malicious activity;

• protect our customers, business and Services; and

• maintain the security and integrity of our systems.

Where applicable, we rely on our legitimate interests and our legal obligations as the legal basis for these activities.

Communicating With You

We use your personal information to communicate with you regarding your orders, account, enquiries, support requests and other matters relating to our Services.

We may also send service-related communications that are necessary to perform our contract with you or comply with our legal obligations.

Legal and Regulatory Reasons

We may process your personal information where necessary to:

• comply with applicable laws and regulations;

• respond to lawful requests from courts, regulators, law enforcement or government authorities;

• establish, exercise or defend legal claims;

• enforce our Terms of Service or other policies; or

• protect our rights, property, customers or others.

Legal Bases for Processing

If you are located in the EU or EEA, we process your personal information only where we have a valid legal basis under applicable data protection law.

Depending on the circumstances, our legal bases may include:

• Performance of a contract – where processing is necessary to provide products or Services you have requested, process your order or manage your account.

• Legal obligation – where processing is necessary for us to comply with a legal or regulatory requirement.

• Legitimate interests – where processing is necessary for our legitimate business interests, provided that those interests are not overridden by your fundamental rights and freedoms.

• Consent – where we ask you to provide consent for a specific processing activity. You may withdraw your consent at any time, although this will not affect the lawfulness of processing carried out before you withdrew your consent.

• Protection of vital interests – where processing is necessary to protect your vital interests or those of another person, where applicable.

Where we rely on legitimate interests, those interests may include operating and improving our business and Services, preventing fraud and misuse, maintaining website and information security, communicating with customers and improving the customer experience.

How We Disclose Personal Information

We may disclose your personal information to third parties where necessary for legitimate business purposes and in accordance with applicable data protection law.

These third parties may include:

• Shopify, vendors and service providers that provide services on our behalf, such as payment processing, IT management, data analytics, customer support, cloud storage, fulfilment and shipping.

• Business and marketing partners, where permitted by applicable law, to provide marketing services, advertising and other business functions.

• Third parties you direct us to, request us to use or otherwise authorise, such as shipping providers, social media platforms or third-party integrations.

• Our affiliates and companies within our corporate group, where applicable.

• Authorities and other parties where legally required, including in connection with legal proceedings, regulatory requirements, law enforcement requests, fraud prevention or the protection of our rights.

• A purchaser or successor in connection with a business transaction, such as a merger, acquisition, restructuring or sale of assets.

We require service providers that process personal information on our behalf to process that information only as permitted by applicable law and, where required, under appropriate contractual arrangements.

Relationship With Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services.

Information you submit through the Services may be transmitted to and shared with Shopify and other service providers that may be located in countries outside the country in which you reside.

Shopify may process personal information in accordance with its own privacy policies and applicable data protection obligations.

To learn more about how Shopify processes personal information and the rights available to you, please review the Shopify Consumer Privacy Policy.

Depending on where you live, you may also exercise certain rights in relation to information processed by Shopify through the Shopify Privacy Portal.

Cookies and Similar Technologies

We use cookies and similar technologies to operate our website, remember preferences, understand how visitors use our Services and, where permitted, support marketing and advertising activities.

Where required by applicable law, we will obtain your consent before placing or accessing non-essential cookies or similar technologies on your device.

You may manage your cookie preferences through our cookie consent tools or through your browser settings.

Disabling certain cookies may affect the functionality or availability of some parts of the Services.

Third-Party Websites and Links

The Services may contain links to websites or online platforms operated by third parties.

If you follow a link to a website that is not affiliated with or controlled by us, you should review that website's privacy policy, cookie policy and terms and conditions.

We are not responsible for the privacy, security or content practices of third-party websites or platforms.

Information that you share on public or semi-public platforms, including social networking platforms, may be visible to other users and may be used by those platforms in accordance with their own privacy policies.

Children's Data

The Services are not intended for children who are below the applicable age of consent in their jurisdiction.

We do not knowingly collect personal information from children where prohibited by applicable law.

If you are a parent or legal guardian and believe that a child has provided us with personal information, please contact us using the contact details below so that we can review the situation and, where appropriate, delete the information.

Security and Retention of Your Information

We use appropriate technical and organisational measures designed to protect your personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no security measure is completely secure or impenetrable, and we cannot guarantee absolute security.

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

The length of time we retain information depends on factors including:

• whether we need the information to provide our Services;

• whether we need to maintain your account;

• whether we are required to retain the information for legal or regulatory purposes;

• whether the information is necessary to resolve disputes; and

• whether we need the information to establish, exercise or defend legal claims.

Your Rights Under the GDPR

If you are located in the EU or EEA, you have certain rights regarding your personal information under the GDPR. These rights may be subject to specific conditions and exceptions under applicable law.

You may have the right to:

• Right to be informed – to receive clear information about how and why your personal information is processed.

• Right of access – to request access to the personal information we hold about you.

• Right to rectification – to request correction of inaccurate or incomplete personal information.

• Right to erasure – to request deletion of your personal information in certain circumstances.

• Right to restriction of processing – to request that we restrict the processing of your personal information in certain circumstances.

• Right to data portability – to receive certain personal information in a structured, commonly used and machine-readable format and, where technically feasible, request that it be transmitted to another controller.

• Right to object – to object to certain processing activities, including processing based on legitimate interests and direct marketing.

• Right to withdraw consent – where we rely on your consent as the legal basis for processing, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

• Rights relating to automated decision-making and profiling – in certain circumstances, you may have rights concerning decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

You may exercise these rights by contacting us using the contact details provided below.

We may need to verify your identity before processing your request, as permitted or required by applicable law.

We will respond to valid requests without undue delay and, in principle, within one month of receiving the request. Where permitted by law, this period may be extended where a request is particularly complex or where you have made multiple requests. If an extension is required, we will inform you of the reason for the delay.

You will generally not be charged for exercising your data protection rights. However, applicable law may allow us to charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.

International Transfers

Your personal information may be transferred to, stored or processed in countries outside the EU or EEA.

Where we transfer personal information outside the EU or EEA, we will take appropriate steps to ensure that your personal information continues to receive an adequate level of protection as required by applicable data protection law.

Depending on the circumstances, we may rely on:

• an adequacy decision adopted by the European Commission;

• the European Commission's Standard Contractual Clauses;

• other legally recognised transfer mechanisms; or

• applicable derogations permitted under the GDPR.

Where appropriate, you may request further information about the safeguards we use for international transfers.

Complaints

If you have concerns about how we process your personal information, please contact us using the contact details provided below so that we can investigate and respond to your concern.

If you are located in the EU or EEA, you also have the right to lodge a complaint with a supervisory authority in the EU/EEA Member State where you live, work or where you believe an infringement has occurred.

A list of European data protection supervisory authorities is available from the European Data Protection Board.

European Data Protection Board – Supervisory Authorities

Data Controller

For the purposes of applicable data protection legislation, Ella & Roam is the data controller responsible for your personal information.

Data Controller:
Ella & Roam

Email:
shasnei.sevilla@ecomcapital.com

Telephone:

If applicable, the details of our Data Protection Officer ("DPO") are:

Data Protection Officer:

DPO Email:

If Ella & Roam is not established in the EU/EEA but is subject to the GDPR and is required to appoint an EU representative, the details of our representative are:

EU Representative:

EU Representative Address:

EU Representative Email:

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business practices, Services, technology, legal requirements or regulatory obligations.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy and provide any additional notice required by applicable law.

We encourage you to review this Privacy Policy periodically so that you remain informed about how we collect, use and protect your personal information.

Contact

If you have questions about this Privacy Policy, our privacy practices or the way we process your personal information, or if you would like to exercise any of your data protection rights, please contact us:

Email: shasnei.sevilla@ecomcapital.com

Telephone:

For the purposes of applicable EU/EEA data protection laws, Ella & Roam is the data controller of your personal information.