Last updated: August 6, 2026

This policy explains what personal information Lily Wellington collects, why, who else gets to see it, and what you can require us to do about it.

Who is responsible

The agency responsible for your personal information is DONT SLEEP LLC, a company registered in Wyoming, United States under Reg. No. 2026-001979081, whose company address is at 30 N Gould St Ste R, Sheridan, WY 82801, USA. It trades as Lily Wellington.

Because we sell to customers in New Zealand, we handle personal information in line with the Privacy Act 2020 and its information privacy principles. Although DONT SLEEP LLC is registered in Wyoming, United States, we also apply the standards of the European Union's General Data Protection Regulation (GDPR) to how we collect, store and use it.

The store runs on Shopify, which processes information on our instructions as our platform provider.

What we collect

Straight from you. Name, email address, phone number if you give one, billing and delivery addresses, what you ordered and when, any account details, and whatever you write to customer service.

Automatically, as you browse. IP address, browser and device type, operating system, time of visit, pages opened, items viewed or added to the cart, the site that referred you, and identifiers set by cookies and similar technology.

From third parties. Payment status, a transaction reference and the last digits of a card from our payment providers; delivery progress from NZ Post and other carriers; measurement data from advertising and analytics providers. A full card number never reaches us.

Wherever it is reasonably practicable to do so, we collect personal information directly from you, as the Privacy Act 2020 requires.

Why we collect it

We only collect what is necessary for the purposes below, and we use it for those purposes or a directly related one.

Taking, processing and delivering your order. Taking and verifying payment. Keeping you informed while a parcel travels. Answering questions and handling returns, faults, complaints and claims, including claims under the Consumer Guarantees Act 1993. Detecting and preventing fraud, misuse and unauthorised payments. Meeting tax, accounting and other legal obligations. Improving the store. And, with your agreement, sending marketing and measuring how our advertising performs.

Our payment providers apply automated fraud screening, which can result in a payment being declined. If yours is refused and you think it should not have been, contact us and we will look into it with you.

Every marketing email carries an unsubscribe link, as the Unsolicited Electronic Messages Act 2007 requires. You can also unsubscribe by writing to support@lily-wellington.com.

Cookies

Necessary cookies run the cart, secure the session and process payment; the store does not work without them. Analytics, functional and advertising technologies follow the choices you make in the cookie settings, and are only switched on where valid consent has been given. Withdrawing consent does not undo processing that was lawful at the time.

For any cookie in use we can give you the name, the provider, the purpose, how long it lasts and which third parties can read it. Ask and we will send the current list.

Who we share it with

Only where it is necessary for one of the purposes above, or where the law requires or permits it. That means Shopify as our store platform; our payment providers; warehouse and fulfilment partners; the carriers who deliver your order, including NZ Post; our email and helpdesk providers; Google, where Google Analytics or Google Ads are in use; Meta, where the Meta Pixel is in use; hosting, IT and security suppliers; accountants, auditors and professional advisers; and public authorities where we are legally required to disclose.

We do not sell your personal information.

Sending information overseas

Our operations and our suppliers sit outside New Zealand, so your information is stored and processed overseas — including in the United States, where our company and several of our service providers are based.

Before disclosing personal information to anyone outside New Zealand, we take reasonable steps to ensure the recipient must protect it with safeguards comparable to those in the Privacy Act 2020, as information privacy principle 12 requires. Depending on the recipient that rests on contractual protections such as standard contractual clauses, on a comparable privacy regime in the destination country, or on your authorisation.

Links to other sites

Where we link to a site we do not operate, its privacy practices are its own and outside our responsibility.

Children

The store is not aimed at children under 16 and we do not knowingly collect their information for marketing. If you believe a child has given us information without authorisation, tell us and we will delete it.

Security and retention

We use reasonable technical and organisational safeguards — encrypted connections, access control, least privilege internally, and suppliers who maintain comparable measures. No method of transmission or storage is completely secure, and we will not claim ours is.

Order and accounting records are held as long as tax and accounting law requires. Support, return and complaint records are held while a case runs and afterwards for as long as documenting it may require. Marketing information is held until you unsubscribe or withdraw consent. Cookie and analytics data follows the periods in the cookie settings. Anything no longer needed is deleted or anonymised.

Where a privacy breach occurs that is likely to cause serious harm, we notify the Office of the Privacy Commissioner and the affected individuals, as the Privacy Act 2020 requires.

Your rights

Under the Privacy Act 2020 you may ask whether we hold personal information about you and request access to it, and you may ask us to correct anything that is wrong — and where we do not correct it, ask for a statement of the correction you sought to be attached to it.

As a matter of policy, and as a matter of right where European data protection law or the California Consumer Privacy Act applies, we also honour requests to delete information we no longer need, to restrict or object to particular processing, to object to direct marketing at any time, to receive your information in a commonly used machine-readable format, and to withdraw a consent.

Although this store serves New Zealand, our position does not change with geography. Residents of California hold rights under the CCPA and CPRA to know what is collected and why, to have it deleted or corrected, and to opt out of the sale or sharing of personal information and of targeted advertising. Where a browser sends a Global Privacy Control signal, we read it as an opt-out for that browser and device.

We may need to confirm your identity before acting. Requests go to support@lily-wellington.com. We respond without undue delay and, for access and correction requests, no later than 20 working days after receiving them.

Complaints

Raise it with us first at support@lily-wellington.com. You also have the right to complain to a privacy regulator: in New Zealand, the Office of the Privacy Commissioner, PO Box 10094, Wellington 6143, at privacy.org.nz; or, if you are in the United Kingdom, the Information Commissioner's Office at ico.org.uk.

Changes

We update this policy when our services, our suppliers or the applicable rules change. The current version carries the date at the top, and significant changes are communicated properly.

Contact

Lily Wellington
DONT SLEEP LLC — Reg. No. 2026-001979081
Company address: 30 N Gould St Ste R, Sheridan, WY 82801, USA
Returns address: sent to you by email once your return is approved
Email: support@lily-wellington.com
Customer service hours: Monday to Friday 09:00–17:00 (NZST) · Saturday and Sunday 10:00–17:00 (NZST)
We aim to reply within 24 hours.