Privacy Policy

Effective Date: September 2026

Vach Cittoni ("Vach Cittoni," "we," "us," or "our") respects the privacy of our customers and website visitors and is committed to handling personal information responsibly and in accordance with applicable privacy and data-protection laws.

This Privacy Policy explains how we collect, use, disclose, retain, transfer, and protect personal information when you visit VachCittoni.com, create or use a customer account, place an order, contact us, subscribe to marketing, use customer-service features, participate in a promotion, or otherwise interact with Vach Cittoni.

The privacy law that applies to particular information may depend on where you live, where the information is collected or processed, and the nature of your interaction with Vach Cittoni.

Nothing in this Privacy Policy limits a privacy right that applicable law does not permit us to limit.

1. Personal Information We Collect

Depending on how you interact with Vach Cittoni, we may collect the following categories of personal information.

Identity and Contact Information

This may include:

• Name.
• Email address.
• Telephone number.
• Billing address.
• Shipping address.
• Account information.
• Other contact information you voluntarily provide.

Order and Transaction Information

This may include:

• Products purchased.
• Order history.
• Order value.
• Shipping information.
• Payment status.
• Refunds.
• Returns.
• Pre-orders.
• Discount or promotional-code use.
• Customer-service history.
• Order preferences.

Payment Information

Payments are processed through authorized third-party payment providers, which may include Shopify Payments, Shop Pay, PayPal, and other payment methods made available through checkout.

Vach Cittoni does not store complete payment-card numbers or card security codes on our own systems.

We may receive limited payment-related information necessary to administer a transaction, including transaction identifiers, payment status, payment-method type, billing confirmation, or fraud-risk information.

Customer Account Information

Where customer accounts are available, we may process information associated with the account, including:

• Contact information.
• Order history.
• Account preferences.
• Login or account activity.
• Loyalty or rewards information where applicable.

Communications

If you contact Vach Cittoni, we may collect and retain information contained in:

• Emails.
• Contact forms.
• Customer-service messages.
• Chat communications.
• Return requests.
• Claims.
• Reviews.
• Photographs.
• Other information you voluntarily submit.

Device and Technical Information

When you use VachCittoni.com, we or our authorized service providers may automatically collect technical information such as:

• IP address.
• Browser type.
• Device type.
• Operating system.
• Language settings.
• Approximate geographic region.
• Pages viewed.
• Referring website or page.
• Access date and time.
• Session information.
• Cookie identifiers.
• Website performance and diagnostic information.

Marketing and Preference Information

Where applicable, we may collect:

• Marketing-subscription status.
• Cookie preferences.
• Privacy choices.
• Advertising preferences.
• Product or content interests inferred from your interactions with our website where permitted by law.

Fraud and Security Information

We may collect or generate information used to identify or investigate:

• Suspected fraudulent transactions.
• Payment risk.
• Chargeback abuse.
• Account misuse.
• Return fraud.
• Security incidents.
• Unauthorized activity.
• Other conduct that may threaten Vach Cittoni, our customers, or our service providers.

2. How We Collect Personal Information

We may collect personal information:

• Directly from you.
• Automatically from your browser or device.
• Through cookies and similar technologies.
• Through Shopify and related e-commerce services.
• From payment processors.
• From shipping and logistics providers.
• From fraud-prevention and security providers.
• From analytics, marketing, or advertising providers where legally permitted.
• From publicly available or lawful sources where reasonably necessary for fraud prevention, legal compliance, or protection of our rights.

We do not knowingly obtain personal information through unlawful or deceptive means.

3. How We Use Personal Information

We may use personal information for the following purposes.

Processing and Fulfilling Orders

Including to:

• Receive and verify orders.
• Process payments.
• Fulfill purchases.
• Arrange delivery.
• Provide tracking.
• Administer pre-orders.
• Process cancellations.
• Process returns and refunds.
• Investigate delivery or product claims.

Customer Service

Including to:

• Respond to inquiries.
• Resolve order issues.
• Provide account assistance.
• Investigate claims.
• Communicate about purchases.
• Provide product or service support.

Operating and Improving VachCittoni.com

Including to:

• Maintain website functionality.
• Diagnose technical problems.
• Measure website performance.
• Understand customer interaction with our website.
• Improve user experience.
• Improve products, services, and business operations.

Fraud Prevention and Security

Including to:

• Verify transactions.
• Detect suspected fraud.
• Prevent unauthorized payment activity.
• Investigate suspicious orders.
• Prevent chargeback or return abuse.
• Protect customer accounts.
• Protect Vach Cittoni.
• Maintain website and information security.

Legal and Regulatory Compliance

Including to:

• Maintain business records.
• Meet accounting and tax obligations.
• Respond to lawful court, regulatory, or government requests.
• Meet consumer-protection requirements.
• Address product-safety matters.
• Establish, exercise, or defend legal claims.
• Meet other legal or regulatory obligations.

Marketing

Where permitted by applicable law, we may communicate with customers about:

• Product releases.
• Promotions.
• Events.
• Educational content.
• Brand news.
• Other Vach Cittoni products or services.

You may unsubscribe from marketing communications at any time using the unsubscribe mechanism provided in the communication.

Unsubscribing from marketing does not prevent transactional, security, account, product-safety, legal, or customer-service communications.

4. Lawful Bases for Processing in the European Union and United Kingdom

Where the EU GDPR, UK GDPR, or another law requiring a lawful basis applies, Vach Cittoni may rely on one or more of the following bases.

Contract

We may process personal information where necessary to enter into or perform a contract with you, including to:

• Process an order.
• Receive payment.
• Deliver products.
• Manage cancellations or returns.
• Operate customer accounts.
• Provide transaction-related customer support.

Legal Obligation

We may process information where necessary to comply with legal obligations, including:

• Tax requirements.
• Accounting requirements.
• Consumer-protection obligations.
• Product-safety obligations.
• Regulatory requirements.
• Lawful disclosure requirements.

Legitimate Interests

Where permitted by law, we may process information where necessary for legitimate business interests that are not overridden by the rights and freedoms of the individual.

These interests may include:

• Fraud prevention.
• Information security.
• Protecting customers and the business.
• Preventing misuse of purchasing, discount, return, payment, or account systems.
• Establishing or defending legal claims.
• Business administration.
• Improving our products, services, and website.
• Maintaining appropriate business records.

Where we rely on legitimate interests, we consider the necessity and proportionality of the processing and its potential impact on individuals.

Consent

We may rely on consent where legally required, including for certain:

• Marketing communications.
• Non-essential cookies.
• Advertising technologies.
• Tracking technologies.

Where processing is based on consent, you may withdraw that consent as permitted by law.

Withdrawal does not affect the lawfulness of processing performed before consent was withdrawn.

5. Cookies and Similar Technologies

VachCittoni.com uses cookies and similar technologies to support:

• Essential website functionality.
• Security.
• Customer preferences.
• Analytics.
• Store performance.
• Advertising or marketing where legally permitted.

Where required by law, non-essential cookies or similar technologies will not be activated until the required consent has been obtained.

Customers may manage available cookie and privacy preferences through the controls provided on VachCittoni.com and through browser or device settings.

Disabling certain technologies may affect website functionality.

6. Do Not Track and Global Privacy Control

Some browsers provide a traditional Do Not Track (DNT) setting.

Because there is no universally accepted technical or legal standard governing all ordinary DNT signals, Vach Cittoni does not necessarily alter its practices in response to ordinary browser DNT settings.

This is separate from legally recognized opt-out preference signals such as Global Privacy Control (GPC).

Where applicable law requires Vach Cittoni to recognize a qualifying GPC or similar opt-out preference signal, we will honour that signal as required by law and through the privacy controls supported by our store.

7. Service Providers and Other Recipients

Vach Cittoni uses third-party providers to operate our business and online store.

These providers may process personal information where reasonably necessary to provide their services.

Shopify

VachCittoni.com is hosted on Shopify.

Shopify may provide:

• Website hosting.
• Checkout.
• Customer accounts.
• Order management.
• Store security.
• Payment infrastructure.
• E-commerce functionality.

Shopify processes personal information subject to its applicable agreements, privacy documentation, and legal obligations.

Payment Providers

Payment providers may include:

• Shopify Payments.
• Shop Pay.
• PayPal.
• Other payment methods presented at checkout.

Vach Cittoni does not receive or retain complete card numbers or card security codes through these services.

Shipping and Logistics Providers

We may disclose information reasonably necessary to deliver an order, including:

• Recipient name.
• Shipping address.
• Telephone number where required.
• Email address where required.
• Package information.
• Customs information.

Shipping Protection Providers

Where optional Shipping Protection is selected, information reasonably necessary to administer that service or a related claim may be provided to the applicable service provider.

Analytics and Search Services

We may use services such as:

• Google Analytics.
• Google Search Console.
• Other analytics or website-performance tools.

Use of non-essential analytics technologies remains subject to applicable consent requirements.

Advertising and Social Media Services

Where permitted by law and consistent with your privacy choices, Vach Cittoni may use services such as Meta Pixel or comparable technologies to measure advertising performance and improve marketing relevance.

Customer-Service and AI-Assisted Tools

Vach Cittoni may use Shopify Inbox, automated tools, and AI-assisted features in connection with customer service.

When you communicate through these features, Shopify or other authorized service providers may process the contents of the communication and relevant customer or order information for the purpose of providing customer support.

Do not send:

• Passwords.
• Complete payment-card numbers.
• Card security codes.
• Unnecessary sensitive personal information.

through ordinary customer-service chat.

Fraud, Security, and Verification Providers

We may use providers that help us detect:

• Fraud.
• Unauthorized payment activity.
• Chargeback abuse.
• Security threats.
• Account misuse.
• Other suspicious conduct.

Professional Advisers

Where reasonably necessary, information may be disclosed to:

• Lawyers.
• Accountants.
• Insurers.
• Auditors.
• Other professional advisers.

Government or Legal Authorities

Information may be disclosed where required or permitted in connection with:

• Court orders.
• Subpoenas.
• Regulatory obligations.
• Law-enforcement requests.
• Other lawful government demands.
• Establishing, exercising, or defending legal rights.

8. Sale, Sharing, and Targeted Advertising

Vach Cittoni does not sell personal information in exchange for monetary payment.

However, some privacy laws may define certain advertising, analytics, or online tracking activities as a "sale," "sharing," targeted advertising, or similar disclosure even where no money is exchanged for the information.

Where such laws apply to Vach Cittoni, eligible individuals may exercise legally available opt-out rights through:

• The privacy controls provided on VachCittoni.com.
• A qualifying opt-out preference signal such as GPC where legally required.
• Another method required by applicable law.

We do not knowingly sell or share children's personal information in violation of applicable law.

9. Marketing Communications

Where legally permitted, Vach Cittoni may send marketing communications to customers who have subscribed, consented, or where another lawful basis exists.

Marketing may relate to:

• Fragrance releases.
• Promotions.
• Events.
• Educational content.
• Brand news.
• Other Vach Cittoni products and services.

You may unsubscribe at any time using the unsubscribe mechanism contained in the communication.

Where applicable law requires prior consent for electronic marketing, we will obtain that consent.

10. Automated Fraud and Risk Screening

Vach Cittoni and our authorized service providers may use automated tools to assist with:

• Fraud screening.
• Payment-risk assessment.
• Account security.
• Order verification.
• Abuse prevention.

An order may be delayed, reviewed, restricted, or cancelled where lawful based on identified risk.

Where applicable law provides rights relating to a decision based solely on automated processing that produces legal or similarly significant effects, those rights remain unaffected.

11. Data Retention

Vach Cittoni retains personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate legal or business requirements.

Retention may be necessary to:

• Complete transactions.
• Maintain order history.
• Provide customer support.
• Meet accounting and tax obligations.
• Administer returns, claims, warranties, or recalls.
• Prevent fraud.
• Resolve disputes.
• Enforce agreements.
• Establish, exercise, or defend legal claims.
• Comply with applicable law.

Retention periods vary depending on the category of information and the reason for retaining it.

When information is no longer reasonably required, it will be deleted, anonymized, or otherwise disposed of in accordance with applicable law and reasonable business practices.

12. International Data Transfers

Vach Cittoni is based in Alberta, Canada.

Personal information may be processed or stored in Canada, the United States, or other countries in which authorized service providers operate.

Privacy laws in those jurisdictions may differ from those in the individual's home jurisdiction.

Where applicable law requires a particular safeguard or transfer mechanism for an international transfer, Vach Cittoni or the relevant service provider will use an appropriate lawful mechanism or safeguard.

Personal information remains subject to protections required by applicable law while under our control.

13. Security

Vach Cittoni uses reasonable administrative, technical, and organizational safeguards designed to protect personal information against:

• Unauthorized access.
• Unauthorized disclosure.
• Loss.
• Misuse.
• Alteration.
• Destruction.

Measures may include:

• Encrypted website connections.
• Secure payment infrastructure.
• Restricted administrative access.
• Authentication controls.
• Fraud detection.
• Security monitoring.
• Reputable service providers.

No electronic system or method of storage is completely risk-free.

Vach Cittoni therefore cannot guarantee absolute security.

Where a privacy or security incident creates a legal reporting or notification obligation, Vach Cittoni will act in accordance with applicable law.

14. Canadian Privacy Rights

Vach Cittoni is based in Alberta, Canada.

For activities subject to Alberta's private-sector privacy law, personal information is handled in accordance with Alberta's Personal Information Protection Act (PIPA).

The federal Personal Information Protection and Electronic Documents Act (PIPEDA) may also apply to particular commercial activities, including certain interprovincial or international personal-information transactions.

Depending on applicable Canadian privacy law, individuals may have rights including:

• Access to personal information held about them.
• Correction of inaccurate information.
• Information concerning how their personal information has been used or disclosed.
• Withdrawal of consent where consent may lawfully be withdrawn.
• The right to raise a privacy complaint.

These rights may be subject to statutory limitations or exceptions.

15. European Union and United Kingdom Privacy Rights

Where applicable EU or UK data-protection law applies, individuals may have rights including:

• Access.
• Rectification.
• Erasure.
• Restriction of processing.
• Data portability.
• Objection to certain processing.
• Objection to direct marketing.
• Withdrawal of consent.
• Rights concerning certain solely automated decisions.
• The right to complain to an applicable supervisory authority.

These rights are subject to applicable legal conditions and exceptions.

Nothing in this Privacy Policy restricts a mandatory EU or UK data-protection right.

16. United States Privacy Rights

Residents of certain U.S. states may have additional rights where applicable state privacy law applies to Vach Cittoni and the relevant statutory thresholds or conditions are met.

Depending on the applicable law, rights may include:

• Access to personal information.
• Correction of inaccurate information.
• Deletion.
• Data portability.
• Opt-out rights relating to certain sales or sharing.
• Opt-out rights relating to targeted advertising.
• Rights relating to certain profiling.
• Rights relating to sensitive personal information.
• Protection from unlawful discrimination for exercising privacy rights.

Where legally required, Vach Cittoni will recognize qualifying privacy preference signals such as Global Privacy Control.

Identity verification may be required where permitted or required by law.

17. Children's Privacy

VachCittoni.com is not directed toward children.

We do not knowingly collect personal information from children under 13 years of age, or a higher minimum age where required by applicable law, in circumstances prohibited by law.

If we learn that information has been collected from a child in violation of applicable law, reasonable steps will be taken to delete or otherwise lawfully handle that information.

A parent or legal guardian who believes a child has improperly provided information may contact us.

18. Privacy Requests

Privacy requests may be submitted to:

Privacy Officer
Vach Cittoni
Email: legal@vachcittoni.com

We may request information reasonably necessary to:

• Verify identity.
• Confirm authority to make the request.
• Locate responsive records.
• Protect another individual's privacy.
• Prevent fraudulent requests.

Vach Cittoni will respond within the period required by applicable law.

Where a legal exception permits a request to be denied or limited, we may do so and will provide any explanation required by applicable law.

19. Changes to This Privacy Policy

Vach Cittoni may update this Privacy Policy to reflect:

• Changes in law.
• Changes in technology.
• Changes in business operations.
• Changes to products or services.
• Changes in service providers.
• Improvements to privacy practices.

The current version will be made available on VachCittoni.com with its effective date.

Material changes will be subject to any additional notice or consent requirements imposed by applicable law.

An updated Privacy Policy will not retroactively remove a legal right that applicable law does not permit Vach Cittoni to remove.

20. Contact

For privacy and legal inquiries:

Privacy Officer
Vach Cittoni
Email: legal@vachcittoni.com

For general customer-service inquiries:

Email: hello@vachcittoni.com

Where applicable, individuals may also contact the privacy or data-protection regulator having jurisdiction over their complaint.