N°Help & policies
Privacy Policy
What personal data we collect, why, who we share it with and your rights.
This policy explains what personal data we collect when you visit tovelia.shop or buy from us, why we collect it, who we share it with and the rights you have. We keep it as short and plain as we can.
Who is responsible for your data
The controller of your personal data is UNIVERSAL WORKS LIMITED, trading as TOVELIA. Our company details are on our Legal Information page. For any privacy question or request, email support@tovelia.shop.
What we collect
- Order details: your name, billing and delivery addresses, email address, phone number (optional), the items you buy, and your order history.
- Account details: if you create an account, your email address and a securely hashed password.
- Payment details: card and wallet details are entered directly into our payment providers’ secure forms. We receive only limited information such as the payment status, card brand and last four digits. We never see or store your full card number.
- Messages: what you send us by email, phone or our contact form.
- Technical data: your IP address, browser type and device, which our hosting and payment providers process to deliver the site securely and to prevent fraud.
- Preferences: your chosen delivery country, currency and language, and the contents of your bag, stored in essential cookies. See our Cookie Policy.
We do not use advertising trackers and we do not build marketing profiles.
Why we use it, and our legal basis
| Purpose | Legal basis (UK and EU GDPR) |
|---|---|
| Taking payment, dispatching and delivering your order, handling returns and refunds | Performance of our contract with you |
| Answering your questions and complaints | Performance of a contract, or our legitimate interest in helping you |
| Preventing fraud and keeping the website secure | Our legitimate interests and legal obligations |
| Keeping accounting and tax records | Legal obligation |
| Remembering your bag, country, currency and language | Our legitimate interest in providing the service you ask for (essential cookies) |
Who we share it with
We share personal data only where needed, with:
- Payment providers such as Stripe and PayPal, to process payments and prevent fraud. They act as independent controllers for some of this processing under their own privacy notices.
- Delivery carriers, who receive your name, delivery address and, where needed for delivery, your email or phone number.
- Our hosting and email providers, who store and process data on our behalf under contract.
- Translation service: if you choose a language other than English, the text of the page you are viewing is sent to an automatic translation service (GTranslate, using Google Translate) to be translated in your browser. We do not send your order or account details for translation.
- Professional advisers and authorities, where required by law or to protect our legal rights.
We do not sell or rent your personal data, and we do not share it for cross-context behavioural advertising.
International transfers
Some of our providers process data outside the UK or the European Economic Area, for example in the United States. Where this happens we rely on adequacy decisions or on appropriate safeguards such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
How long we keep it
- Order and payment records: 6 years after the end of the financial year of purchase, to meet UK accounting and tax requirements.
- Customer messages: up to 24 months after the conversation ends.
- Accounts: until you ask us to delete your account, or after 3 years of inactivity.
- Essential cookies: see our Cookie Policy for each cookie’s lifetime.
Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data;
- ask us to delete your data;
- restrict or object to certain processing, including processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email support@tovelia.shop. We reply within one month. We may need to confirm your identity first.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk) or to the data protection authority in your EU country of residence. We would appreciate the chance to help first.
California and other US state residents
If you live in California or another US state with a consumer privacy law, you have the right to know what personal information we collect and how we use it, to request access, correction or deletion, and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined in those laws. Send requests to support@tovelia.shop.
Children
Our website is not directed at children under 16 and we do not knowingly collect their data.
Security
The website uses an encrypted HTTPS connection. Access to order data is limited to the people who need it to fulfil your order. Payment data is handled by PCI DSS compliant payment providers.
Changes
We may update this policy. The date at the top of this page shows when it last changed.