Privacy policy

Last updated: 25/06/2026

This Privacy Policy explains how Lulus Global Limited (trading as “Sonny Eyewear”) ("Sonny", "we", "us" or "our") collects, uses, and discloses your personal information when you visit, use, or make a purchase through sonnyeyewear.com and our related services (the "Services"), or otherwise communicate with us.

We are the data controller of your personal information for the purposes of UK data protection law, including the UK GDPR and the Data Protection Act 2018.

Our store is hosted by Shopify, which provides the underlying platform that enables us to offer the Services to you.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood it.

Who We Are

Controller: Lulus Global Limited
Registered company number: 16336093
Registered office: 32 Kinburn Street, London, England, SE16 6DW
Contact for privacy matters: hello@sonnyeyewear.com

Personal Information We Collect

Depending on how you interact with us, we may collect or process the following categories of personal information:

Contact details — your name, billing address, shipping address, phone number and email address.
Payment information — payment card details, transaction details, form of payment and payment confirmation. Card details are processed by our payment provider; we do not store full card numbers.
Account information — where you create an account, your username, password and saved preferences.
Transaction information — items you view, add to your cart or wishlist, and your purchases, returns, exchanges and cancellations.
Communications — the content of messages you send us, for example customer support enquiries or replies to our emails.
Marketing information — your preferences for receiving marketing from us and your engagement with our emails.
Device and usage information — your device, browser, IP address, other identifiers, and information about how you interact with the Services, collected through cookies and similar technologies.

How We Collect Your Information

We collect personal information:

Directly from you — when you join our waiting list, create an account, place an order, or contact us.
Automatically — through cookies and similar technologies when you use the Services (see Cookies below).
From service providers — who collect or process information on our behalf, such as our hosting, payment, email and fulfilment providers.

How We Use Your Information and Our Lawful Basis

Under UK data protection law we must have a lawful basis for processing your personal information. The table below sets out how we use your information and the basis we rely on.

Purpose	Lawful basis
Processing and fulfilling your orders, taking payment, arranging delivery, and handling returns and exchanges	Performance of our contract with you
Creating and managing your account	Performance of our contract with you
Providing customer support and responding to your enquiries	Performance of our contract with you, or our legitimate interests in running our business
Sending you marketing emails and showing you online advertising	Your consent (which you can withdraw at any time)
Improving and personalising the Services, and understanding how customers use them	Our legitimate interests in operating and improving our business
Preventing fraud and keeping the Services secure	Our legitimate interests in protecting our business and customers
Keeping records and meeting our tax, accounting and other legal obligations	Compliance with a legal obligation

Where we rely on legitimate interests, you have the right to object (see Your Rights below).

Marketing

If you join our waiting list or subscribe, we will send you marketing emails based on your consent. You can opt out at any time using the unsubscribe link in any email, or by contacting us. Opting out of marketing will not stop service messages such as order confirmations and shipping updates.

We use the Meta (Facebook and Instagram) advertising tools, including the Meta Pixel and Conversions API, to measure and improve our advertising and to show you relevant ads. Where required, we only activate these tools after you have given consent through our cookie banner. You can read more about how Meta processes data in Meta's own privacy policy.

Cookies and Similar Technologies

We use cookies and similar technologies to operate the Services, remember your preferences, analyse usage and support advertising.

Some cookies are strictly necessary for the site to function. Others — including analytics and advertising cookies, such as those used by the Meta Pixel — are non-essential. Where you are in the UK or EU, we only set non-essential cookies after you have given consent through our cookie banner. You can change or withdraw your choices at any time through the cookie settings on our site.

Who We Share Your Information With

We share personal information with the following categories of recipients, only as needed for the purposes described above:

Shopify — our store hosting and platform provider, and provider of certain payment and checkout services.
Payment providers — to process payments securely.
Klaviyo — our email marketing provider, to send and manage our emails.
Meta — for advertising and measurement, as described above.
Our fulfilment provider (3PL) — to pick, pack and ship your orders, including arranging international shipping and customs documentation where relevant.
Professional advisers — such as our accountants and lawyers, where reasonably necessary.
Authorities and other parties — where we are required to do so by law, to respond to valid legal requests, or to protect our rights, our customers, or the Services.
A buyer or successor — in connection with a sale, merger or reorganisation of our business.

We do not sell your personal information.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your use of the Services in order to provide and improve the platform. In providing certain enhanced features, Shopify may act as a controller of your personal information and may use it across its merchant network. To learn more about how Shopify uses your personal information and the rights you may have, see the Shopify Consumer Privacy Policy at https://privacy.shopify.com/en.

International Transfers

We are based in the UK, but some of our service providers are located outside the UK, including in the United States. This means your personal information may be transferred to, stored, or processed outside the UK.

Where we transfer personal information out of the UK, we rely on a recognised transfer mechanism — such as the UK's International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or a finding of adequacy — to ensure your information remains protected. You can request more information about the safeguards we use by contacting us.

How Long We Keep Your Information

We keep your personal information for as long as we need it for the purposes set out in this policy. How long that is depends on the type of information and why we hold it. For example, we keep order and transaction records for at least six years to meet our tax and accounting obligations, and we keep marketing information until you unsubscribe or ask us to delete it. When we no longer need your information, we securely delete or anonymise it.

Security

We take reasonable measures to protect your personal information. However, no system is completely secure, and we cannot guarantee absolute security. Please do not send us sensitive information through insecure channels.

Your Rights

Under UK data protection law, you have the following rights in relation to your personal information:

Access — to ask for a copy of the information we hold about you.
Rectification — to ask us to correct inaccurate or incomplete information.
Erasure — to ask us to delete your information in certain circumstances.
Restriction — to ask us to limit how we use your information in certain circumstances.
Portability — to receive certain information in a portable format, or have it transferred to another provider.
Objection — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
Withdraw consent — where we rely on your consent, you can withdraw it at any time. This does not affect processing carried out before you withdrew it.

To exercise any of these rights, contact us at privacy@sonnyeyewear.com. We may need to verify your identity before responding. We will respond within the timeframes required by law and will not discriminate against you for exercising your rights.

Children

The Services are not intended for children, and we do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us with their information, please contact us and we will delete it.

Complaints

If you have a concern about how we handle your personal information, please contact us first so we can try to resolve it. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk. If you are in the EU or EEA, you may complain to your local data protection authority.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational or regulatory reasons. We will post the updated version on this page and update the "Last updated" date above.