Last updated: 04 October 2026
This notice explains what we do with your personal information, why, and what you can ask us to do about it. We’ve tried to write it in plain English rather than legal language.
1. Who we are
LIMURIAN LIMITED (“Torti”, “we”, “us”) is the data controller for the personal information described here. That means we decide what is collected and why, and we are responsible for looking after it.
We are a company registered in England and Wales under company number 15070520, with our registered office and atelier at 57 Brewer Street, London W1F 9UL, United Kingdom.
We are also established in the European Union as:
KE INTERNATIONAL SRLS Piazza San Francesco 2, 06034 Foligno (PG), Italy VAT / tax code: 03461640546 · Certified email: keinternational@pec.it
How to contact us about your information: Email concierge.torti@gmail.com · Post: Data Protection, 57 Brewer Street, London W1F 9UL
This notice covers tortimassimiliano.com, our atelier, and our consultation, gift card and membership services. It does not cover other websites we link to.
2. What we collect
What you give us:
- Name, email address, telephone number
- Billing and delivery addresses
- Order and purchase history, including gift cards bought or redeemed
- Appointment bookings and the preferences you share during a consultation
- Fragrance preferences, and any allergy or sensitivity you choose to tell us about
- Account login details and membership/loyalty activity
- Marketing preferences
- Anything you write to us in an email, form or message
What we collect automatically:
- IP address, approximate location, device and browser details
- Pages and products viewed, time on site, how you arrived
- Information stored by cookies and similar technologies — but only the strictly necessary ones until you consent (see section 9)
- Server logs, which record interactions and may include your IP address
What we get from others:
- Confirmation of payment from our payment providers. We never receive your full card number
- In-store purchases and loyalty points from our till system
- Whether a marketing email was delivered and opened
Allergy and sensitivity information
If you tell us about an allergy or skin sensitivity, that counts as health information, which the law treats as especially sensitive.
We use it for one purpose only: to formulate safely and advise you properly. We rely on your explicit consent, you never have to give it, and you can withdraw it at any time by asking us to delete it. Withdrawing it limits what we can safely make for you, but has no other consequence.
3. Why we use it, and our lawful basis
The law requires us to have a specific reason — a “lawful basis” — for each use.
| What we do | Lawful basis |
|---|---|
| Take and fulfil your order, take payment, deliver it | Contract |
| Manage your account and the My Account area | Contract |
| Book, confirm and manage consultations | Contract |
| Create a bespoke fragrance to your brief | Contract |
| Issue, deliver and redeem gift cards | Contract |
| Formulate safely around an allergy you’ve told us about | Explicit consent |
| Run the membership and loyalty scheme | Contract |
| Answer your questions and handle complaints | Legitimate interests — running the business properly |
| Keep accounting and tax records | Legal obligation |
| Prevent fraud and keep the site secure | Legitimate interests — protecting you and us |
| Send marketing emails | Consent, or the “soft opt-in” where you’ve bought from us |
| Analytics, advertising and personalisation cookies | Consent |
| Invite you to review a purchase | Legitimate interests |
| Defend ourselves in a legal claim | Legitimate interests |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded the processing is limited and what you’d reasonably expect. You can ask us for that assessment, and you can object — see section 7.
Where we rely on consent, you can withdraw it at any time, and that never affects anything we did lawfully beforehand.
We do not make any decisions about you by automated means alone. There is no profiling that produces a legal or similarly significant effect.
4. Marketing
We send marketing email only where you have opted in, or where you have bought from us and we are telling you about similar products — and in that case only because you were given a clear chance to decline when you bought.
Every marketing email has an unsubscribe link, and it works immediately. You can also change your preferences in your account.
Unsubscribing stops marketing. It does not stop service messages such as order confirmations, dispatch notices and appointment reminders, because those are part of fulfilling your order.
We do not sell your personal information, and we never have.
5. Who we share it with
We share your information with the following service providers, who act on our written instructions and may only use it to do the job we’ve asked them to do.
| Who | What they do for us |
|---|---|
| Our web hosting provider | Hosts the website and its database |
| Stripe and WooPayments | Process card payments |
| Square | Till system, appointment booking, loyalty points, gift cards |
| Klaviyo | Marketing email, and tracking how the site is used |
| Google (Analytics, Tag Manager, Site Kit) | Website analytics and tag management |
| Automattic / Jetpack | Site security and protection |
| Couriers and delivery partners | Deliver your order |
| Accountants and professional advisers | Accounts, audit, legal advice |
We will also disclose information where the law requires it, where we need to establish or defend a legal claim, or to a buyer if the business is sold.
An up-to-date list of our providers is available on request.
6. Sending information outside the UK
Several providers above are based in the United States, including Square, Klaviyo, Google and Automattic. Our payment providers process within the UK and EU, and may also transfer to the US.
When information goes outside the UK, we rely on one of the safeguards the law requires:
- the UK Addendum to the EU Standard Contractual Clauses; or
- the UK Extension to the EU–US Data Privacy Framework, where that provider is certified under it.
You can ask us which safeguard applies to any particular provider and we will tell you.
7. Your rights
You have the right to:
- be told what we do with your information — this notice
- get a copy of the information we hold about you
- have it corrected if it’s wrong
- have it deleted, in certain circumstances
- restrict how we use it
- receive it in a portable format, or have it sent to another provider
- object to processing based on legitimate interests
- object to direct marketing at any time — this one is absolute, we must stop, and you don’t have to give a reason
- withdraw consent at any time
- not be subject to automated decision-making — we don’t do any
How to exercise them
Email concierge.torti@gmail.com.
It is free. We respond within one month, and if a request is complex we’ll tell you inside that month and explain why we need longer. We may need to confirm who you are first.
Some rights are qualified. We can’t delete records we’re legally required to keep for tax, for example. If we can’t do what you’ve asked, we’ll tell you why and what your options are.
More on the right to object
Where we process your information for our legitimate interests, you can object on grounds relating to your particular situation, and we must stop unless we can show compelling grounds that override your rights.
Where we process it for direct marketing, you can object without giving any reason at all, and we must stop. No exceptions.
8. How long we keep it
| What | How long | Why |
|---|---|---|
| Orders and transactions | 7 years after the order | Tax law requires 6; we allow a margin |
| Your account | While active, then 3 years after last activity | So you keep your history and points |
| Bespoke formulation records | 10 years, or sooner if you ask | So a commission can be remade |
| Allergy / sensitivity information | Until you withdraw consent or close your account | Safety |
| Marketing contacts | Until you unsubscribe, then 2 years on a do-not-contact list | So we don’t add you back by mistake |
| Appointment records | 3 years | Service history |
| Enquiries and correspondence | 2 years from last contact | Handling follow-ups |
| Website analytics | 14 months | Year-on-year comparison |
| Server logs | 12 months | Security and troubleshooting |
At the end of each period we delete the information or anonymise it so it can no longer identify you. Once that happens, the rights in section 7 can no longer be exercised over it, because there is nothing left that identifies you.
9. Cookies and similar technologies
Apart from the ones strictly necessary to make the site work, nothing is set until you agree to it.
We group them as:
- Necessary — your basket, your login, security, and remembering your cookie choice. These can’t be switched off; the site won’t work without them.
- Analytics — how the site is used, so we can improve it.
- Functional — remembering preferences, such as recently viewed products.
- Advertising — measuring our advertising and showing relevant ads.
You choose when the banner first appears. You can change or withdraw your choice at any time using the cookie settings link in the footer — it’s as easy to say no later as it was to say yes. Our Cookie Policy lists every cookie, what it does and how long it lasts.
You can also block or delete cookies in your browser settings, though parts of the site may stop working properly if you do.
Do Not Track. Browsers can send a “Do Not Track” signal. There is no agreed standard for how sites should respond, so ours does not act on it. Use the cookie settings link instead — that choice we do act on.
10. Keeping it secure
The site runs over an encrypted connection. Access to personal information is limited to people who need it for their job. Card payments are handled by providers certified to the payment card industry standard, and card numbers never reach our systems. We keep backups and review who has access.
No system is perfectly secure. If something goes wrong in a way that is likely to risk your rights, we will tell the ICO within 72 hours and tell you without undue delay where the risk to you is high.
11. Children
Our products and services are for adults. We don’t knowingly collect information about anyone under 18. If you think a child has given us information, tell us and we’ll delete it.
12. Other websites
Links to other sites are not covered by this notice. Please read theirs.
13. Changes to this notice
We may update this notice. The date at the top shows when it last changed. Where a change is significant we’ll tell you directly rather than rely on you noticing. If a change affects something you consented to, we’ll ask again.
14. Complaints
Please come to us first at concierge.torti@gmail.com — we’d much rather fix it.
You can also complain to a regulator at any time, and you don’t have to come to us first:
United Kingdom — Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Helpline 0303 123 1113 · ico.org.uk/make-a-complaint/
European Union — you may complain to the supervisory authority where you live, where you work, or where the problem happened. The list is at edpb.europa.eu.
You can also take the matter to court.
