Privacy policy
What personal data we collect, why, who it is shared with, how long we keep it and your rights under UK GDPR.
Last updated 18 September 2026
This policy explains what we do with your personal data when you browse this site, place an order or email us. We are the data controller for that data. Questions, or any request about your rights: support@aivelo.shop.
1. What we collect, and why
| Data | Why we have it | Lawful basis |
|---|---|---|
| Name, email, delivery and billing address, phone number if you give one | To take and fulfil your order, to send order and dispatch emails, and to deal with returns | Performance of a contract |
| Order contents, order number, amount paid, currency | To fulfil the order, handle returns and refunds, keep accounting records and answer payment disputes | Contract; legal obligation; legitimate interests (defending disputes) |
| Card brand and last four digits, payment reference | To identify a transaction if you contact us about it. We never receive or hold your full card number. | Contract; legitimate interests (fraud prevention) |
| Account email and a salted password hash, if you create an account | To let you sign in and see your orders | Contract |
| Message content you send us, and the email address you sent it from | To answer you and keep a record of what was agreed | Legitimate interests (customer service) |
| Technical data: IP address, browser and device type, pages requested, timestamps, error logs | To keep the site working and secure and to investigate abuse | Legitimate interests (security and service integrity) |
We do not ask for and do not want special category data — nothing about your health, beliefs, politics, ethnicity or sexuality. Please do not send it to us.
2. What we do not do
- We do not sell, rent or trade your personal data. Not to anyone, for any price.
- We do not send marketing email. There is no newsletter sign-up on this site, and you will only hear from us about an order you placed or a message you sent.
- We do not run advertising, analytics or social tracking pixels. No Google Analytics, no Meta pixel, no advertising cookies.
- We do not profile you or make automated decisions about you, apart from the fraud and address checks our payment provider runs on a transaction.
- Fonts and scripts are served from this site’s own domain, so browsing does not send your IP address to a third-party content network.
3. Who your data is shared with
Only with the parties we need to use to get your order to you, and only with the minimum each one needs:
- Our payment provider — takes the payment and runs the fraud and address checks. Your card details go to them, not to us. They act as a controller in their own right for the payment data and have their own privacy notice.
- Our supply and fulfilment partners — receive the delivery name, address, phone number where given, and the contents of the order, so the parcel can be made up and sent. They are not permitted to use it for anything else.
- Carriers — receive the delivery name, address and a contact detail so they can deliver and, where required, so customs can clear the parcel.
- Our hosting and email providers — process data on our instructions in order to run the site and send order emails.
- Professional advisers, and authorities — where we are required to disclose by law, or need to in order to establish or defend a legal claim.
4. Transfers outside the UK
Because orders are fulfilled and dispatched by partners who may be located outside the United Kingdom, your delivery details may be transferred abroad. Where that happens we rely on the safeguards permitted by UK data protection law — an adequacy regulation for the destination country, or the International Data Transfer Agreement or Addendum, together with the additional measures required. You can ask us which applies to your order.
5. How long we keep it
| Data | Kept for |
|---|---|
| Order and transaction records | 7 years from the end of the financial year, to meet tax and accounting requirements |
| Customer service correspondence | 2 years from the last message, then deleted |
| Account data | Until you ask us to close the account; order records are then retained as above |
| Server and error logs | Up to 90 days |
6. Your rights
Under the UK GDPR you have the right to: be told what we hold; get a copy of it; have inaccurate data corrected; have data erased where we no longer have a basis to keep it; restrict or object to our processing; receive your data in a portable form; and withdraw consent where we relied on consent.
To exercise any of these, email support@aivelo.shop. We respond within one month. We may need to confirm your identity first, and we will not charge you.
Erasure is not absolute: we must keep order and transaction records for the tax period above, so we can delete the rest but not those.
7. Complaining
If you are unhappy with how we have handled your data, tell us first — we would rather fix it. You also have the right to complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk.
8. Security
The site is served over HTTPS. Passwords are stored as salted hashes. Administrative access is restricted and individually credentialed. Card data never reaches our systems. See payment and security for more. No system is perfect: if a breach occurs that is likely to affect your rights, we will tell you and the ICO as the law requires.
9. Children
This shop is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us data, email us and we will delete it.
10. Changes
If we change this policy we will update the page and the last-updated date at the top. A material change to how we use existing data will be notified by email where we hold one for you.