Privacy policy

Last updated: 7 September 2026

This Privacy Policy explains how Rig Cosmetics Limited, trading as VAASTU, collects, uses, shares and protects personal information when you visit www.vaastu.co.uk, place an order, contact us or otherwise use our services.

1. Who We Are

The controller responsible for your personal information is:

2. Information We Collect

Depending on how you interact with us, we may collect:

• Your name
• Billing and delivery addresses
• Email address and telephone number
• Account and login information
• Order, payment and transaction information
• Products viewed, purchased, returned or reviewed
• Delivery, collection and tracking information
• Customer-service messages and enquiries
• Photographs or videos submitted for damage, compatibility or warranty claims
• Business information supplied for B2B or wholesale enquiries
• Device, browser, IP address and website-usage information
• Cookie preferences and marketing choices
• Fraud-prevention and security information

3. How We Collect Information

We may collect personal information:

• Directly from you when you place an order, create an account or contact us
• Automatically through cookies and similar website technologies
• From payment, delivery, fraud-prevention and ecommerce service providers
• From another person where they place an order or make an enquiry on your behalf
• From marketplaces or business partners where necessary to manage an authorised transaction or enquiry

4. How We Use Personal Information

We may use personal information to:

• Process and fulfil orders
• Take and verify payments
• Arrange delivery, collection, returns and refunds
• Provide customer service
• Handle faulty-product, warranty or insurance claims
• Create and manage customer accounts
• Prevent fraud, misuse and security threats
• Maintain financial, tax and business records
• Improve our website, products and customer experience
• Respond to legal or regulatory requirements
• Manage B2B and wholesale enquiries
• Send marketing communications where permitted
• Measure website performance and advertising effectiveness, subject to applicable consent requirements

5. Our Lawful Bases

Depending on the activity, we process personal information because:

• It is necessary to perform a contract with you or take steps at your request before entering a contract.
• It is necessary to comply with a legal obligation.
• It is necessary for our legitimate interests, such as operating the business, preventing fraud, improving services and handling enquiries, where those interests are not overridden by your rights.
• You have given consent, including where consent is required for marketing or non-essential cookies.
• Processing is necessary to establish, exercise or defend legal claims.

You may withdraw consent at any time where processing relies on consent. Withdrawal does not affect processing carried out before consent was withdrawn.

6. Marketing Communications

We send promotional marketing only where permitted by applicable law.

Marketing consent is optional and is not required to place an order. You can unsubscribe at any time by:

• Using the unsubscribe link in a marketing email
• Updating available account preferences
• Contacting support@vaastu.co.uk

Unsubscribing from marketing will not prevent essential communications about orders, payments, delivery, security, returns or customer-service requests.

7. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Operate essential website and checkout functions
• Remember preferences and shopping-cart contents
• Maintain security and prevent fraud
• Understand website performance
• Measure advertising and marketing, where permitted

Non-essential cookies will be used according to your consent choices where consent is required.

You can manage preferences through the cookie banner or browser settings. Blocking essential cookies may prevent parts of the website or checkout from operating correctly.

8. How We Share Information

We may share relevant personal information with:

• Shopify and other website-service providers
• Payment processors
• Banks and payment networks
• Delivery companies, postal services and fulfilment providers
• Customs authorities and international shipping agents
• Customer-service and communication providers
• IT, hosting, security and fraud-prevention providers
• Analytics or advertising providers, subject to applicable consent
• Accountants, insurers, auditors and professional advisers
• Government, regulatory, tax or law-enforcement authorities where legally required
• A buyer, investor or successor in connection with a proposed or completed business transaction

We provide only information reasonably required for the relevant service or legal purpose.

9. International Transfers

Some service providers may process personal information outside the United Kingdom or European Economic Area.

Where required, we use appropriate safeguards for international transfers, such as an applicable adequacy regulation, approved contractual protections or another lawful transfer mechanism.

You may contact us for more information about the safeguards relevant to your personal information.

10. Data Retention

We retain personal information only for as long as reasonably necessary to:

• Fulfil the purpose for which it was collected
• Provide customer service
• Complete transactions
• Comply with accounting, tax and legal obligations
• Resolve disputes
• Prevent fraud
• Establish, exercise or defend legal claims

Retention periods vary according to the type of information and applicable legal requirements. Information will be deleted or anonymised when it is no longer reasonably required.

11. Data Security

We use reasonable administrative, organisational and technical safeguards intended to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

12. Your Privacy Rights

Depending on your location and applicable law, you may have rights to:

• Request access to your personal information
• Request correction of inaccurate or incomplete information
• Request deletion of information
• Request restriction of processing
• Object to certain processing
• Receive certain information in a portable format
• Withdraw consent
• Object to direct marketing
• Complain to a data-protection authority

Some rights are subject to legal conditions and exemptions. We may request information to verify your identity before completing a request.

To exercise a privacy right, contact support@vaastu.co.uk.

13. Right to Object

You have the right to object to personal information being used for direct marketing at any time.

You may also object to processing based on legitimate interests. We will stop the relevant processing unless we have compelling legitimate grounds to continue or the processing is required for legal claims.

14. Complaints

Please contact us first at support@vaastu.co.uk so we can try to resolve your concern.

Customers in the European Economic Area may complain to the data-protection authority in the country where they live or work.

15. Children's Privacy

16. Third-Party Websites

Our website may contain links to independent third-party websites. Their handling of personal information is governed by their own privacy policies, not this policy.

17. Automated Processing

We may use automated tools to help identify suspected fraud, payment risk or website-security threats.

We do not intentionally make decisions based solely on automated processing that produce legal or similarly significant effects unless permitted by law and appropriate safeguards are provided.

18. Changes to This Policy

We may update this Privacy Policy to reflect changes to our services, providers, technology or legal obligations.

The latest version will be published on this page with an updated revision date.

19. Contact Us