Privacy policy

Last updated: 15 September 2026

This policy explains how Vellys Company LLC, trading as Phillip Nibosi, handles personal information in connection with philipnibosi.com, purchases and customer support. It also explains how to contact us about your information. Using the website does not, by itself, give consent to optional marketing or tracking.

1. Who is responsible for your information

Vellys Company LLC is the business responsible for the personal information we use to operate Phillip Nibosi. Where data protection law uses the term, we act as a data controller for those activities.

Business: Vellys Company LLC, registered in Florida, United States

Address: 2335 E ATLANTIC BLVD STE 200, POMPANO BEACH, FL 33062, United States

Privacy contact: support@philipnibosi.com

Shopify provides our ecommerce platform. It processes information to provide services to us and may act separately as a controller for certain services it provides directly. Its own processing is described in the Shopify Privacy Policy. Contact us about our store's handling of your information; you do not need to contact Shopify first.

2. Information involved and where it comes from

The information involved depends on how you interact with us:

• Contact and customer details: Your name, email, billing and delivery addresses, and other contact details you provide when ordering or asking for help.
• Order and transaction information: Items purchased, order identifiers, amounts and currency, payment status, payment-related references, delivery information, and records of cancellations, refunds or warranty claims. Payment services process the information needed to authorise and complete your payment.
• Messages and supporting material: Enquiries, complaints, privacy requests and any photos or other evidence you choose to provide about an order or product.
• Technical and usage information: Information such as IP address, browser and device details, pages or actions associated with a visit, and logs needed to operate and protect the store. Optional analytics or advertising information depends on the services used and the permissions required by law.
• Preferences: Marketing choices, privacy choices and records needed to respect those choices.

We receive information directly from you, through the store and checkout, and from service providers involved in payment, fulfilment and support. For example, a fulfilment provider may supply a delivery update. Technical information can be collected automatically through the website and related technologies.

Information needed to process payment, deliver an order or meet a legal obligation is necessary for those purposes. If you do not provide it, we may be unable to complete the purchase or resolve the request. Optional marketing information is not required to buy from us. If you give us another person's details for delivery, provide only what is needed and make them aware of this policy.

Please do not email full payment card numbers, passwords or identity documents unless we have explained why specific information is necessary and how to provide it safely.

3. Why we use information and our legal bases

Where the EU GDPR or UK GDPR applies to our processing, we use the following bases. A contractual basis covers processing objectively necessary for the purchase or requested steps before it; it does not make optional advertising necessary.

Purpose	Information used	Legal basis where GDPR or UK GDPR applies
Process orders and payments, arrange delivery and send order updates	Contact, order, transaction and delivery information	Performance of a contract or steps you request before entering one
Handle returns, refunds, warranty claims and purchase-related support	Contact, order and claim information	Performance of a contract; compliance with a legal obligation where that obligation provides a valid basis under the applicable data protection law
Answer general enquiries and manage customer relationships	Contact details and messages	Steps requested before a contract, where relevant; otherwise legitimate interests in answering enquiries and maintaining customer service
Protect the store, prevent fraud, investigate misuse and establish or defend claims	Relevant transaction, contact, technical and correspondence records	Legitimate interests in protecting customers and our business and resolving disputes; compliance with a legal obligation where applicable
Maintain accounting, tax and other required business records	Relevant order, transaction and contact records	Compliance with a legal obligation recognised by the applicable data protection law; otherwise legitimate interests in lawful recordkeeping, where permitted
Send optional marketing communications	Contact details and marketing preferences	Consent where required; otherwise legitimate interests in permitted marketing to existing customers, subject to applicable marketing rules and your right to object
Use optional analytics, personalisation or advertising technologies, if used	Technical, usage and preference information	Consent where required; otherwise legitimate interests in measuring or improving the store only where the relevant law permits that processing without consent
Record and respond to privacy choices and requests	Contact, preference and request records	Compliance with a legal obligation where applicable; otherwise legitimate interests in respecting and documenting your choices

When relying on legitimate interests, we must consider the purpose, whether the processing is necessary and its effect on your rights. Those interests do not override rights that require us to stop processing, or replace consent required by cookie or electronic marketing law. Where consent is the basis, you may withdraw it without affecting processing that was lawful before withdrawal.

Other applicable privacy laws may use different rules, including consent and reasonable-purpose requirements. We apply those rules where they govern the activity. A legal basis under GDPR is not a blanket exemption from another applicable law.

4. Who receives information

We disclose information needed for the relevant purpose to these categories of recipients:

• Ecommerce and technical service providers, including Shopify, which support the store, hosting, checkout and related functions.
• Payment service providers, to process transactions, refunds, payment verification and disputes.
• Suppliers and fulfilment or delivery providers, to prepare, ship and deliver orders and handle relevant returns or product claims. Our products are fulfilled through suppliers in Asia.
• Customer support and business service providers, where needed to manage communications, records and requests.
• Analytics or marketing providers, if those services are used, subject to the privacy choices and legal permissions that apply.
• Professional advisers, public authorities or other parties to a legal matter, where disclosure is legally required or justified to obtain advice, protect rights or address fraud and disputes.

If a business sale, restructuring or similar transaction occurs, relevant information may be shared subject to lawful safeguards and any required notice. This does not authorise unrelated use of your information.

Providers acting on our instructions must be subject to appropriate restrictions on their handling of information. Some recipients, such as payment services or public authorities, may have their own legal responsibilities and privacy notices. We do not give fulfilment providers permission to use your delivery details for their unrelated marketing.

5. International processing

Vellys Company LLC is registered in the United States, and our fulfilment model uses suppliers in Asia. Information needed for international fulfilment may therefore be processed outside your country. Shopify also describes international processing, including in Canada and the United States, in its privacy policy. The destination and recipient depend on the service and order involved. Privacy laws in another country may differ, and lawful requests from authorities in that country may apply.

Where applicable law restricts an international transfer, the transfer must have a permitted basis and the required protection. Depending on the transfer, this may involve an applicable adequacy decision, approved standard contractual clauses with any necessary additional measures, or the UK International Data Transfer Agreement or UK Addendum. We do not rely on your use of the store as blanket consent to international transfers.

Email our privacy contact for information about recipients, destination countries or the safeguards relevant to your information, including how to obtain a copy of applicable safeguards, subject to lawful redactions. A platform's safeguards do not automatically cover a separate supplier or a different transfer.

6. Cookies, similar technologies and marketing choices

Cookies, pixels and similar technologies can store information on a device or access information from it. The relevant categories are:

• Essential: Functions needed for a service you request, such as keeping a cart, operating checkout, security and remembering a privacy choice.
• Analytics and preferences: Measuring use of the store or remembering optional preferences.
• Marketing: Measuring advertising or selecting advertising based on activity or interests.

For visitors protected by EU or UK rules, optional technologies require prior consent where the law requires it. Any exemption, including a permitted statistical-use exemption, applies only if all its conditions are met. Consent must be a real choice; visiting the site or accepting these policies is not consent to optional cookies. Withdrawing consent must be as easy as giving it. Refusing optional tracking does not remove your right to make a purchase.

Visit Your Privacy Choices for the opt-out options displayed for your location. Device-based choices concern the browser and device used; the page may also offer a separate choice linked to your email or customer account. Where other privacy controls are displayed on the store, use them to review the choices they cover. You can also email support@philipnibosi.com to communicate a privacy or marketing request, including if you cannot use a displayed control. Browser settings can remove or restrict cookies, although blocking essential technologies may affect cart or checkout functions. Removing a cookie does not by itself erase information already held by a recipient.

Third-party analytics or advertising services, if used, may collect information about activity over time and across websites. Such activity remains subject to applicable consent and opt-out rules. A browser's legacy “Do Not Track” setting is different from a legally recognised opt-out preference signal. Do not assume that enabling legacy Do Not Track changes your store preferences. Where the law requires recognition of an opt-out preference signal, such as Global Privacy Control, that obligation applies independently of whether you email us.

You may ask us to stop direct marketing at any time by emailing support. You may also use an unsubscribe option in a marketing message where provided. Marketing messages must include any opt-out facility required by applicable law. This does not stop necessary messages about an existing order, a safety issue or a request you made.

7. Retention and security

We keep personal information for as long as needed for its purpose, including completing an order, dealing with returns and legal warranty claims, meeting recordkeeping obligations and resolving disputes. Retention depends on the type of information, applicable legal periods, the relationship involved and whether a claim or investigation is ongoing. We retain the information needed to respect a marketing opt-out or other privacy restriction without using it to restart the unwanted activity.

When information is no longer needed and no retention obligation applies, we delete it or make it anonymous. Backup copies remain subject to appropriate protection and deletion arrangements. There is no single retention period that applies to every record. You can ask for the criteria relevant to your information.

We are responsible for using appropriate organisational and technical safeguards for the information we handle and for addressing security incidents as applicable law requires. No online service or transmission method can be guaranteed completely secure.

8. Requests and regional rights

Email support@philipnibosi.com with your request and enough information to identify the relevant interaction. A subject line such as “Privacy request” can help route it but is not required. You may also write to the address in section 1. We may request proportionate information to verify identity or an agent's authority before disclosing or changing protected information. You do not need to create an account just to submit a request.

Rights depend on the law applicable to the processing and can have exceptions. We will explain any refusal or lawful limitation and any available appeal route. We will not charge for a request unless the applicable law permits it, in which case we will explain the basis. We will not penalise you for exercising a protected privacy right.

European Economic Area and United Kingdom

Where the EU GDPR or UK GDPR applies, rights may include access and a copy, correction, erasure, restriction, portability, withdrawal of consent and objection to processing based on legitimate interests. You can object to direct marketing at any time. Where legally applicable, you also have protections concerning decisions made solely by automated processing that have legal or similarly significant effects, including rights to human intervention and to contest a decision.

We respond to rights requests within the applicable legal period, normally one month. A permitted extension of up to two further months requires notice within the initial period explaining the reason. Any lawful identity check or other rule affecting the calculation must meet the relevant legal conditions.

You may complain to your competent data protection authority, including the authority in the relevant EEA country or the UK Information Commissioner's Office. You can also send a data protection complaint to our privacy contact. Where the UK complaint-handling rules apply, we must acknowledge it within the statutory 30-day period, investigate without undue delay and communicate the outcome. An acknowledgement is not the final resolution. You do not lose your right to approach a regulator by contacting us first.

California and other United States residents

State privacy rights apply when the relevant law covers the business, processing and request. We do not assume that every state privacy statute applies merely because a visitor lives in that state.

Where the California Consumer Privacy Act applies, rights include knowing and accessing information, deletion, correction, portability, opting out of a sale or sharing for cross-context behavioural advertising, and limiting certain uses of sensitive personal information, subject to the law's scope and exceptions. A transfer can count as a sale or sharing under that law even without a monetary payment. Eligible consumers can use an authorised agent and must not face unlawful discrimination for exercising their rights.

Send requests, including applicable opt-out requests, to our privacy contact. You may also visit Your Privacy Choices for the options displayed there. A request by email does not replace a legally required website control or recognised browser signal. For covered access, deletion and correction requests, the usual California response period is 45 calendar days; an extension is available only as permitted by law and with the required notice. Other request types can have different or shorter deadlines.

Other state laws may provide access, correction, deletion, portability, consent protections for sensitive information, or opt-outs from targeted advertising, sale or certain profiling. If an applicable law gives you an appeal right, email our privacy contact stating that you wish to appeal our decision; we will follow that law's procedure and deadlines.

Canada

Where PIPEDA or an applicable provincial privacy law governs, you may request access to your information, challenge its accuracy and completeness, and complain about its handling. Consent must meet the applicable standard. You may withdraw consent, subject to lawful or contractual restrictions and reasonable notice; we will explain relevant consequences. Withdrawing necessary processing may affect our ability to provide a requested service.

PIPEDA access requests generally require a response within 30 calendar days, with extensions only on the grounds and notice permitted by that law. You may raise a complaint with us and with the competent federal or provincial privacy regulator. Sending information to an overseas service provider does not remove responsibilities imposed on us by applicable Canadian law.

Australia

Where the Australian Privacy Act and Australian Privacy Principles apply to our handling of your information, you may seek access and correction and complain about a breach of those principles. Email our privacy contact so we can investigate and respond. You may also complain to the Office of the Australian Information Commissioner where its jurisdiction applies. Overseas disclosure does not waive applicable accountability requirements.

Other locations

Other mandatory privacy rights remain available where the relevant law applies. Contact us to exercise a right or ask which process applies to your request. The regional sections above do not replace protections applicable in another jurisdiction.

9. Children

Our store is not directed to children under 16, and we do not intentionally collect their personal information. If you believe a child under 16 has provided information to us, contact support so we can investigate and take appropriate action, including deletion where required. This store policy does not change a statutory age threshold or remove any additional protection for children under applicable law.

10. Changes and contact

We will update the date at the top when this policy changes. For a material change, we will provide an appropriate notice on the store or by direct communication where required. If a new use requires consent, an updated policy alone does not provide that consent or authorise the new use.

Email: support@philipnibosi.com

Email support is available 24 hours a day, seven days a week. Our average response time is 12 hours, an estimate that is separate from legal privacy-request and complaint deadlines. Our reference time zone is Miami, Florida, United States, America/New_York. Telephone support is not available.

Related information: Refund and Returns Policy, Terms of Service and Contact Information.