Privacy Policy

Last updated: 14 October 2026

Casilia (Headway Commerce LLC) operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Casilia is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use or make a purchase or other transaction using the Services or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use and disclosure of your information as described in it.

Who is responsible for your personal information

The controller of your personal information for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 is:

Headway Commerce LLC
30 N Gould St, Ste N
Sheridan, WY 82801
United States
Email: info@casilia.shop

Personal information we collect or process

When we use the term "personal information", we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, depending on how you interact with the Services, where you live and as permitted or required by applicable law:

Contact details including your name, address, billing address, delivery address, phone number and email address.
Financial information including payment card details, transaction details, form of payment and payment confirmation. Full card numbers are processed by our payment providers and are not stored by us.
Account information including your username, password, preferences and settings, if you create an account.
Transaction information including the items you view, put in your basket or purchase, return or cancel, and your past transactions.
Communications with us including the information you include when you contact customer support.
Device information including information about your device, browser or network connection, your IP address and other unique identifiers.
Usage information including how and when you interact with or navigate the Services.

Personal information sources

We may collect personal information from the following sources:

Directly from you, including when you create an account, visit or use the Services, place an order, communicate with us or otherwise provide us with your personal information.
Automatically through the Services, including from your device when you visit our website, and through the use of cookies and similar technologies.
From our service providers, including when we engage them to enable certain technology and when they collect or process your personal information on our behalf.
From our partners or other third parties, such as payment and delivery providers.

How we use your personal information and our lawful bases

Depending on how you interact with us or which of the Services you use, we may use personal information for the following purposes:

Providing, tailoring and improving the Services. We use your personal information to provide you with the Services, including to perform our contract with you, to process your payments, to fulfil and deliver your orders, to remember your preferences, to send notifications relating to your order, to process returns, refunds and cancellations, to manage your account, and to create a customised shopping experience for you. Lawful basis: performance of a contract; our legitimate interest in improving the Services.
Marketing and advertising. We use your personal information to send marketing and promotional communications by email, and to show you online advertisements for our products on other websites, including based on items you previously purchased or added to your basket. Lawful basis: your consent (for email marketing, which you can withdraw at any time via the unsubscribe link); our legitimate interest in promoting our products.
Security and fraud prevention. We use your personal information to authenticate your account, to provide a secure payment and shopping experience, and to detect, investigate or take action regarding possible fraudulent, illegal or malicious activity. Lawful basis: our legitimate interest in keeping the Services secure; legal obligation.
Communicating with you. We use your personal information to provide customer support, to respond to you and to maintain our business relationship with you. Lawful basis: performance of a contract; legitimate interest.
Legal reasons. We use your personal information to comply with applicable law or respond to valid legal process, to investigate or participate in litigation, and to enforce our terms or policies. Lawful basis: legal obligation; legitimate interest.

How we disclose personal information

In certain circumstances we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

With Shopify, vendors and other third parties who perform services on our behalf (for example IT management, payment processing, data analytics, customer support, email delivery, cloud storage, order fulfilment and delivery).
With business and marketing partners to provide marketing services and advertise to you, for example advertising platforms that show you our advertisements on other websites. Our business and marketing partners will use your information in accordance with their own privacy notices.
When you direct or request us to disclose certain information to third parties, such as to deliver products to you.
With our affiliates or otherwise within our corporate group.
In connection with a business transaction such as a merger or sale, to comply with legal obligations (including to respond to court orders and similar requests), to enforce our terms or policies, and to protect or defend the Services, our rights and the rights of our users or others.

We do not sell your personal information.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services. In addition, to help protect, grow and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, along with other merchants and with Shopify. In these circumstances Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over the use of your personal information for these purposes. To learn more about how Shopify uses your personal information and the rights you may have, you can visit the Shopify Consumer Privacy Policy.

Third-party websites and links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness or reliability of information found on them.

Cookies and similar technologies

Like many websites, we use cookies and similar technologies on the Services. Some are strictly necessary to make the site and checkout work (for example remembering your basket). Others help us understand how the site is used, measure the performance of our advertising and show you relevant advertisements. Where required by law we ask for your consent before setting non-essential cookies, and you can change your choice at any time through the cookie settings on the site or your browser. Blocking some cookies may affect how the Services work. More information about the cookies Shopify uses is available at shopify.com/legal/cookies.

International transfers

We are based in the United States and some of our service providers are located outside the United Kingdom. Where we transfer your personal information outside the UK we rely on appropriate safeguards recognised under UK data protection law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or on adequacy regulations where they apply.

Retention

We keep your personal information only for as long as we need it for the purposes described above, including to satisfy legal, accounting or reporting requirements. Order and payment records are kept for the period required by tax law (generally six years). Marketing data is kept until you unsubscribe or we are no longer in contact with you. Account data is kept until you ask us to delete your account.

Security

We have implemented reasonable technical and organisational measures to protect your personal information against loss, misuse and unauthorised access. Payments are processed over encrypted connections by our payment providers. No system is completely secure, and we cannot guarantee the security of information transmitted over the internet. If you have an account, please keep your login details confidential.

Your rights

Under UK data protection law you have the right to:

Access the personal information we hold about you;
Rectify inaccurate or incomplete information;
Erase your personal information in certain circumstances;
Restrict or object to our processing, including objecting to direct marketing at any time;
Data portability: receive the information you gave us in a structured, commonly used, machine-readable format;
Withdraw consent at any time where we rely on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, email us at info@casilia.shop. We may need to verify your identity before responding. We will respond within one month, or tell you if we need longer. There is normally no charge.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by telephone on 0303 123 1113. We would appreciate the chance to deal with your concern first, so please contact us before approaching the ICO.

Children's data

The Services are not intended for use by children, and we do not knowingly collect personal information about children under 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

Changes

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal or regulatory reasons. We will post the revised Privacy Policy on the Services and update the "Last updated" date.

Contact

If you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of your rights, please contact us: