Privacy policy

Last updated: 8 September 2026

This Privacy Policy explains how MF COMPANY GLOBAL LTD, trading as Lirae London ("we", "us", "our"), collects, uses, shares and protects your personal data when you visit liraelondon.com (the "Site"), place an order, subscribe to our emails or contact us.

We are the data controller for the personal data described in this policy.

1. Who we are and how to contact us

MF COMPANY GLOBAL LTD
Trading as Lirae London
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Registered in England and Wales, Company No. 16409523
Privacy enquiries: privacy@liraelondon.com
General enquiries: support@liraelondon.com
Telephone: +44 7418 315190

We are not required to appoint a Data Protection Officer. Privacy matters are handled directly by our management team at the address above.

2. Personal data we collect

2.1 Data you give us

• Order and account data: name, billing address, delivery address, email address, telephone number, order history and account login details.
• Payment data: the payment method used, the last four digits of your card, billing postcode and the transaction result. We never receive or store your full card number, expiry date or security code — these are collected and processed directly by our payment providers.
• Communications data: the content of emails, contact form submissions, live chat conversations and social media messages you send us, together with any attachments such as photographs supplied to support a return.
• Marketing data: your email address and marketing preferences when you subscribe to our newsletter or opt in at checkout.
• User-generated content: product reviews, ratings, photographs and any material you choose to submit or tag us in.
• Customs data: where required by the destination country, identification details necessary for customs clearance.

2.2 Data collected automatically

• Device and technical data: IP address, browser type and version, operating system, device type, screen resolution, language and time zone settings.
• Usage data: pages viewed, products browsed, items added to cart, referring URL, search terms used on the Site, session duration and interaction events.
• Cookies and similar technologies: as described in section 5 below.

2.3 Data from third parties

• Payment and fraud providers: transaction authorisation results and fraud risk indicators.
• Carriers: delivery status, tracking events and delivery confirmation.
• Advertising and analytics platforms: aggregated audience and campaign performance data, and — where you have consented — attribution data linking an advertisement to a visit or purchase.
• Social media platforms: where you interact with our profiles or use a social login, the information your privacy settings on that platform permit us to see.

We do not intentionally collect special category data (such as data revealing health, race, religion or sexual orientation). Please do not include such information in messages to us.

3. Why we use your data and our lawful basis

Under the UK GDPR we must have a lawful basis for each purpose for which we process your data. Ours are as follows:

Purpose	Data used	Lawful basis
Processing your order, taking payment and arranging delivery	Order, payment, delivery data	Performance of a contract
Sending order confirmations, dispatch notifications and delivery updates	Contact and order data	Performance of a contract
Handling returns, refunds, exchanges and warranty claims	Order, contact and communications data	Performance of a contract; legal obligation
Responding to your enquiries and providing customer care	Contact and communications data	Legitimate interests — assisting our customers effectively
Managing your account	Account data	Performance of a contract
Sending marketing emails about new collections, offers and restocks	Contact and marketing data	Consent; or legitimate interests where you are an existing customer (soft opt-in under PECR)
Abandoned cart and browse reminder emails	Contact, marketing and usage data	Consent
Advertising, retargeting, audience building and attribution measurement	Device, usage and cookie data	Consent
Analytics, site performance measurement and improving our collections	Device and usage data	Consent (for non-essential cookies)
Preventing fraud, chargeback abuse and misuse of promotions	Order, payment, device data	Legitimate interests — protecting our business from loss
Publishing reviews and customer content	User-generated content, first name	Consent
Accounting, tax records and statutory reporting	Order and payment data	Legal obligation
Establishing, exercising or defending legal claims	Any relevant data	Legitimate interests — protecting our legal position

Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You may object to this processing at any time — see section 10.

4. Marketing communications

• We send marketing emails only where you have opted in, or where you have purchased from us and have not objected (the "soft opt-in" permitted under PECR).
• Every marketing email contains an unsubscribe link. You can also update your preferences by emailing privacy@liraelondon.com.
• Withdrawing consent takes effect promptly but does not affect processing carried out before withdrawal.
• Unsubscribing from marketing does not stop transactional messages such as order confirmations, dispatch notifications and returns correspondence, which we must send to fulfil your order.

5. Cookies and tracking technologies

We use cookies and similar technologies (pixels, tags, local storage and SDKs) to operate the Site and, with your consent, to measure and advertise. We group them as follows:

• Strictly necessary — required for the cart, checkout, login, security and fraud prevention. These cannot be switched off.
• Analytics — help us understand how the Site is used so we can improve it.
• Marketing and attribution — allow us to measure advertising performance and show you relevant advertisements on other platforms.
• Preferences — remember your currency, language and display settings.

Under the Privacy and Electronic Communications Regulations 2003 (PECR), non-essential cookies are set only with your consent, which we request through our cookie banner on your first visit. You can change or withdraw your choices at any time through the cookie settings link in our footer, or by clearing cookies in your browser. Blocking non-essential cookies does not affect your ability to shop.

6. Who we share your data with

We never sell your personal data. We share it only with the categories of recipient below, each of which processes it on our instructions or as an independent controller for the purposes described:

• E-commerce platform — Shopify Inc. and Shopify International Limited, which host the Site, operate our checkout and process orders on our behalf.
• Payment processing — payments are processed through Shopify's payment infrastructure. Depending on the method you choose at checkout, this involves:
  • Shopify Payments, which for card transactions is powered by Stripe;
  • Apple Pay and Google Pay, which transmit your payment credentials in tokenised form so that your card details are not shared with us;
  • Klarna, where you choose to pay in instalments or later. Klarna acts as an independent controller, carries out its own affordability and identity checks, and processes your data under its own privacy policy.
  These providers receive the data necessary to authorise your payment and carry out fraud screening.
• Fulfilment and logistics partners — the facilities in China, the United States and the European Union that prepare your order, and the carriers that deliver it. They receive the name, delivery address, telephone number and order contents needed to complete delivery, and nothing further.
• Customs authorities — where required by law for international shipments.
• Email and customer service platforms — including Klaviyo for marketing and lifecycle emails and our email provider for customer correspondence.
• Advertising and analytics platforms — including Google, Meta and TikTok, and our attribution provider, which receive device and usage data where you have consented.
• Professional advisers — accountants, auditors and legal advisers, where necessary.
• Authorities and third parties — where required by law, to enforce our terms, or in connection with a merger, acquisition or sale of business assets.

We put written agreements in place with all processors requiring them to protect your data and use it only for the purposes we specify.

7. International transfers

Our service providers and fulfilment partners are located in the United Kingdom, the European Economic Area, the United States and China. This means:

• Where your order is dispatched from a facility outside your own country, the delivery details necessary to fulfil it — your name, delivery address, telephone number and the contents of your order — are transferred to that facility and to the carriers involved. Our Shipping Policy explains where orders are dispatched from.
• Technical, analytics and marketing data may be transferred to providers established outside the United Kingdom.

We transfer only the data necessary for the purpose. Payment data is not transferred to our fulfilment partners.

Where we transfer personal data to a country not covered by UK adequacy regulations — including China and, depending on the provider, the United States — we rely on one of the following safeguards:

• An adequacy decision or adequacy regulations covering the destination country, where one applies;
• The UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum, supported by a transfer risk assessment;
• Certification under an approved framework, such as the UK Extension to the EU–US Data Privacy Framework.

You may request a copy of the relevant safeguard by emailing privacy@liraelondon.com.

8. How long we keep your data

Category	Retention period
Order and transaction records	7 years from the end of the relevant financial year, to meet UK tax and accounting requirements
Account data	While your account remains active, and for 3 years after your last interaction
Marketing data	Until you unsubscribe, or after 24 months of no engagement
Customer service correspondence	3 years from the date of the last message
Cookie and analytics data	Up to 24 months, depending on the cookie
Fraud and chargeback records	6 years, matching the limitation period for contractual claims

When a retention period ends we delete the data or anonymise it so that it can no longer be linked to you.

9. Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), restricted access on a need-to-know basis, multi-factor authentication on administrative accounts, and the use of PCI-DSS compliant payment providers so that card details never reach our systems.

No transmission over the internet is entirely secure. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform you without undue delay where the risk is high.

10. Your rights

If you are in the United Kingdom or the European Economic Area, you have the right to:

• Be informed about how we use your data — this policy serves that purpose;
• Access a copy of the personal data we hold about you;
• Rectification of inaccurate or incomplete data;
• Erasure of your data, where we have no overriding lawful reason to keep it;
• Restrict processing in certain circumstances;
• Data portability — receive the data you provided in a structured, machine-readable format;
• Object to processing based on legitimate interests, and to object at any time to direct marketing, which we will always honour;
• Withdraw consent at any time where processing is based on consent;
• Not be subject to solely automated decisions producing legal or similarly significant effects (see section 12).

To exercise any right, email privacy@liraelondon.com. We respond within one month, and may extend this by two further months for complex requests, telling you if we do. We may ask you to verify your identity before we act. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

11. Complaints

If you are unhappy with how we have handled your personal data, please raise it with us first so that we can put it right.

Send your complaint to privacy@liraelondon.com with the subject line "Data Protection Complaint". We will acknowledge your complaint within 3 business days, take appropriate steps without undue delay, keep you updated on progress, and communicate the outcome to you in writing within 30 days.

If you remain dissatisfied, you may complain to the UK's supervisory authority:

Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
Helpline: 0303 123 1113 — ico.org.uk

If you are in the EEA, you may also complain to the supervisory authority in your country of residence.

12. Automated decision-making

Our payment providers apply automated fraud screening to transactions, which may result in an order being declined or held for manual review. Where you choose to pay with Klarna, Klarna may also carry out an automated affordability or credit assessment under its own terms. This processing is necessary for entering into a contract with you and to prevent fraud. If your order is affected, you may contact us at support@liraelondon.com to request human review, express your point of view and contest the outcome; where the decision was made by Klarna, you may also exercise these rights directly with Klarna.

We do not carry out any other solely automated decision-making that produces legal or similarly significant effects.

13. Additional rights for United States residents

If you are a resident of California, Virginia, Colorado, Connecticut, Texas, Oregon, Utah or another state with comprehensive privacy legislation, you may have the right to know what personal information we collect and how it is used, to access, correct or delete it, to opt out of the sale or sharing of personal information and of targeted advertising, and not to be discriminated against for exercising these rights.

We do not sell personal information for money. However, our use of advertising and analytics cookies may constitute a "sale" or "sharing" for targeted advertising under some state laws. To opt out, adjust your choices through the cookie settings link in our footer, or email privacy@liraelondon.com. We honour Global Privacy Control (GPC) signals sent by your browser as a valid opt-out request.

You may use an authorised agent to submit a request on your behalf, subject to verification. We do not knowingly sell or share the personal information of consumers under 16.

14. Children

The Site is intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact privacy@liraelondon.com and we will delete it.

15. Third-party sites

Our Site may link to third-party websites, plugins and social media platforms. We are not responsible for their privacy practices. Please review the privacy policy of any site you visit through a link from ours.

16. Changes to this policy

We may update this policy from time to time. The revised version takes effect when posted, with an updated date at the top of this page. Where changes are significant, we will notify you by email or through a notice on the Site. We encourage you to review this page periodically.

17. Contact

For any question about this policy or your personal data:

MF COMPANY GLOBAL LTD
Trading as Lirae London
71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Registered in England and Wales, Company No. 16409523
privacy@liraelondon.com
+44 7418 315190