Privacy Policy

This Privacy Policy describes how Volca (the "Site," "we," "us," or "our") collects, uses, and discloses your personal information when you visit or make a purchase from the Site.

Contact

After reviewing this policy, if you have additional questions, want more information about our privacy practices, or would like to make a complaint, please contact us by email at volcabeauty@gmail.com.

Collecting Personal Information

When you visit the Site, we collect certain information about your device, your interaction with the Site, and information necessary to process your purchases. We may also collect additional information if you contact us for customer support. In this Privacy Policy, we refer to any information about an identifiable individual as "Personal Information." See below for more detail on what we collect and why.

Device information
Purpose of collection: to load the Site accurately for you, and to perform analytics on Site usage to optimize our Site.
Source of collection: collected automatically when you access our Site using cookies, log files, and similar tracking technologies.
Disclosure for a business purpose: shared with our processor, Shopify.
Personal information collected: version of web browser, IP address, time zone, cookie information, what pages or products you view, search terms, and how you interact with the Site.

Order information
Purpose of collection: to provide products to you and fulfill our contract with you, process your payment, arrange shipping, provide order confirmations, communicate with you, screen orders for potential risk or fraud, and (where you've consented) keep you updated on offers and new products.
Source of collection: collected directly from you.
Disclosure for a business purpose: shared with our processor, Shopify, and with our fulfillment partner, teemdrop, as needed to ship your order.
Personal information collected: name, billing address, shipping address, payment information, email address, and phone number.

Customer support information
Purpose of collection: to respond to and resolve customer service inquiries, returns, and order issues.
Source of collection: collected directly from you when you contact us.
Disclosure for a business purpose: not shared with third parties beyond what's needed to resolve your inquiry (e.g. our email provider).
Personal information collected: your name, email address, order number, and the contents of your message to us.

Sharing Personal Information

We share your Personal Information with service providers to help us provide our services and fulfill our contracts with you. For example:

We use Shopify to power our online store, process payments, and handle order fulfillment. You can read more about how Shopify uses your information here: https://www.shopify.com/legal/privacy
We use teemdrop, our order fulfillment and dropshipping partner, to fulfill and ship your order. This requires sharing your name, shipping address, and order details with teemdrop so your order can be processed and delivered.
We may share your Personal Information to comply with applicable laws and regulations, to respond to a lawful request for information, or to otherwise protect our legal rights.

Behavioural Advertising

We may use your Personal Information to provide you with targeted advertisements or marketing communications we believe may be of interest to you, using services such as Meta (Facebook/Instagram) Ads and Google Ads. As of the date of this policy, we are not yet running these campaigns, but this section will apply once we do.

If and when active, we may share information about your use of the Site, your purchases, and your interaction with our ads with these advertising partners, in some cases through cookies or similar technologies.

You can opt out of targeted advertising through:

Facebook: https://www.facebook.com/settings/?tab=ads
Google: https://www.google.com/settings/ads/anonymous
The Digital Advertising Alliance's opt-out portal: https://optout.aboutads.info/

Using Personal Information

We use your Personal Information to provide our services to you, which includes: offering products for sale, processing payments, shipping and fulfilling your order, providing customer support, and (where you've consented) keeping you up to date on new products, services, and offers.

Lawful Basis (GDPR)

As a business operating from the United Kingdom, and because we may serve customers in the European Economic Area (EEA), we process your Personal Information under the following lawful bases pursuant to the UK GDPR and EU GDPR:

Your consent;
The performance of the contract between you and the Site (i.e. fulfilling your order);
Compliance with our legal obligations;
Our legitimate interests, which do not override your fundamental rights and freedoms (for example, fraud prevention and Site analytics).

Retention

When you place an order through the Site, we retain your Personal Information for our records unless and until you ask us to erase it, or for as long as needed to comply with our legal and tax obligations. For more information on your right of erasure, see "Your Rights" below.

Automatic Decision-Making

You have the right to object to processing based solely on automated decision-making (including profiling) when that decision-making has a legal or otherwise significant effect on you.

We do not engage in fully automated decision-making that has a legal or otherwise significant effect on you.

Our processor, Shopify, uses limited automated decision-making to prevent fraud, which does not have a legal or otherwise significant effect on you. This includes:

Temporary blacklisting of IP addresses associated with repeated failed transactions (persists for a small number of hours).
Temporary blacklisting of payment cards associated with blacklisted IP addresses (persists for a small number of days).

Your Rights

If you are a resident of the UK or EEA (GDPR)

You have the right to access the Personal Information we hold about you, to port it to a new service, and to ask that it be corrected, updated, or erased. To exercise these rights, contact us at volcabeauty@gmail.com.

Your Personal Information may be processed and stored outside of the UK or EEA, including in Canada and the United States, by our processor Shopify. For more information on how these data transfers comply with data protection law, see Shopify's GDPR Whitepaper: https://help.shopify.com/en/manual/your-account/privacy/GDPR

If you are a resident of California (CCPA)

You have the right to access the Personal Information we hold about you (the "Right to Know"), to port it to a new service, and to ask that it be corrected, updated, or erased. To exercise these rights, contact us at volcabeauty@gmail.com. If you would like to designate an authorized agent to submit these requests on your behalf, please also contact us at that email.

We do not sell Personal Information as defined under the CCPA.

Cookies

A cookie is a small amount of information downloaded to your device when you visit our Site. We use functional, performance, and (once active) advertising cookies. Cookies make your browsing experience better by remembering your actions and preferences, and they help us understand how visitors use our Site.

Our store is built on Shopify, which sets a number of cookies necessary for the store to function (such as shopping cart, checkout, and login cookies) as well as cookies for analytics and fraud prevention. A current list of Shopify's standard cookies can be found here: https://www.shopify.com/legal/cookies

Most cookies we use are persistent and expire between 30 minutes and two years from the date they're downloaded to your device, depending on their function.

You can control and manage cookies through your browser settings. Please note that blocking cookies may affect your experience and may mean some parts of the Site no longer function correctly. For more information on managing cookies, visit www.allaboutcookies.org.

Do Not Track

Because there is no consistent industry standard for how to respond to "Do Not Track" browser signals, we do not currently alter our data collection practices when such a signal is detected.

Changes

We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal, or regulatory reasons. The "last updated" date below will reflect the most recent revision.

Complaints

If you would like to make a complaint about how we handle your Personal Information, please contact us using the details under "Contact" above.

If you are not satisfied with our response, UK residents have the right to lodge a complaint with the UK's data protection authority, the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/

EEA residents may contact their own country's local data protection authority.

Last updated: 30.06.2026