Privacy policy

Privacy Policy

Last updated: 17 July 2026

This policy explains what personal data Shuvien collects, why we collect it, what we do with it, and the rights you have over it. It applies to our website, our online shop, and any contact you have with our customer support team.

We are the data controller for the personal data described here, and we handle it in accordance with the UK GDPR, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

Our details Shuvien 36 Balsham Road, Harwell, DN10 1FP, United Kingdom Email: help@shuvienstore.com Phone: 07753 794421

For anything about privacy or your data, email help@shuvienstore.com with "PRIVACY" in the subject line.

1. What we collect, why, and our legal basis

Under the UK GDPR we must have a lawful basis for every use of your data. Here is exactly what we hold and why.

Identity and contact details

Name, email address, phone number, billing address, delivery address. Why: To take your order, deliver it, keep you updated, and answer your questions. Legal basis: Performance of a contract — we cannot fulfil your order without this.

Order and transaction history

What you bought, when, how much you paid, delivery status, returns and refunds. Why: To fulfil and track your order, handle returns, and keep the accounting records we are legally required to keep. Legal basis: Performance of a contract, and legal obligation for the tax and accounting records HMRC requires us to retain.

Payment information

Card type, last four digits, transaction reference, billing address. Why: To take payment and to investigate chargebacks or disputes. Legal basis: Performance of a contract. Important: Your full card number is entered directly into our payment provider's secure systems. Shuvien never sees, receives or stores your full card details.

Technical and device data

IP address, browser type and version, device type, operating system, time zone, referring page. Why: To keep the site running securely, prevent fraud, and diagnose faults. Legal basis: Legitimate interests — protecting our site and our customers from fraud and abuse, and keeping the service working. We have assessed this against your rights and consider the impact minimal.

Usage and analytics data

Pages viewed, links clicked, time on site, how you arrived, what you added to your basket. Why: To understand how the shop is used and improve it. Legal basis: Consent — collected through non-essential cookies, only if you accept them. See Section 5.

Marketing preferences

Whether you have subscribed to or opted out of our emails. Why: To send you offers and product news, and to honour your choices. Legal basis: Consent, or the soft opt-in under PECR where you bought from us and we are contacting you about similar products. You can unsubscribe from any message, at any time, free of charge.

Customer service correspondence

Emails, call records, photos you send us to support a return or a fault claim. Why: To resolve your query and keep a record of what was agreed. Legal basis: Performance of a contract, and legitimate interests in maintaining accurate records and defending legal claims.

Reviews and content you submit

Your review text, rating, and the display name you choose. Why: To publish on our product pages. Legal basis: Consent — you choose to submit it, and can ask us to remove it.

We do not knowingly collect special category data (health, biometrics, race, religion, political opinions, sexual orientation, trade union membership). Please do not send us any.

2. Where your data comes from

Most of it comes directly from you: when you place an order, create an account, subscribe to emails, leave a review, or contact us.

Some is collected automatically when you use the site, through cookies and similar technologies (Section 5).

A limited amount comes from third parties: our payment providers send us the outcome of fraud checks, and our carriers send us delivery status updates.

3. Who we share it with

We do not sell your personal data. We never have and we will not.

We share it only with the categories of recipient below, only to the extent they need it, and under contracts that require them to protect it:

  • Payment service providers — to take payment and run fraud and anti-money-laundering checks.
  • Order fulfilment and dropshipping suppliers — your name, delivery address and phone number are passed to the supplier who packs and dispatches your order.
  • Shipping and logistics carriers — to deliver your parcel and give you tracking.
  • E-commerce platform and hosting providers — the infrastructure our shop runs on.
  • Email and marketing platforms — to send order confirmations and, if you have opted in, marketing.
  • Analytics providers — only where you have accepted analytics cookies.
  • Customer support tools — to manage and respond to your messages.
  • Professional advisers — accountants, insurers and lawyers, where genuinely necessary.
  • Law enforcement, regulators and courts — where we are legally required to disclose, or where we need to establish, exercise or defend legal claims.

We may also transfer your data to a buyer if our business is sold or reorganised. If that happens, this policy continues to apply to your data, and we will tell you.

4. Sending data outside the UK

Shuvien operates a dropshipping model. This means your name, delivery address and phone number are shared with fulfilment suppliers located outside the United Kingdom, so that they can pack and dispatch your order. Some of our technology providers also store data outside the UK.

When we transfer personal data outside the UK, we rely on one of the following safeguards required by the UK GDPR:

  • The country has UK adequacy regulations in place, meaning the UK government has decided it offers an equivalent standard of protection; or
  • We have an International Data Transfer Agreement (IDTA) in place with the recipient; or
  • We use the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment.

If you would like details of the safeguards used for a specific transfer, email help@shuvienstore.com and we will tell you.

5. Cookies and tracking

A cookie is a small file placed on your device. We use them, and similar technologies such as pixels and local storage, for the purposes below.

When you first visit, a consent banner appears. Nothing other than strictly necessary cookies is set until you make a choice. You can accept all, reject non-essential cookies, or choose by category — and you can change your mind at any time through the cookie settings link in our site footer.

Category What it does Do we need your consent?
Strictly necessary Keeps you logged in, remembers your basket, processes checkout, protects against fraud and attacks No — the site cannot work without these, and PECR exempts them
Functionality Remembers preferences like language, region or recently viewed items Yes
Performance and analytics Tells us which pages are visited and where people run into problems Yes
Marketing and targeting Measures our advertising and shows you relevant ads on other sites Yes

Rejecting non-essential cookies will not stop you from browsing or buying.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies will break checkout.

Do Not Track: browsers send inconsistent Do Not Track signals and there is no agreed standard for responding to them, so our site does not currently respond to DNT. Our cookie banner gives you direct control instead.

6. How long we keep it

We keep personal data only as long as we actually need it.

  • Order, transaction and tax records — 6 years from the end of the relevant financial year. This is the retention period HMRC requires and we cannot shorten it, even at your request.
  • Account data — for as long as your account is open, plus a reasonable period afterwards in case you return or a dispute arises.
  • Customer support correspondence — for as long as needed to resolve your query, plus a period allowing for any follow-up claim.
  • Marketing data — until you unsubscribe or withdraw consent, after which we keep a minimal suppression record so that we do not accidentally contact you again.
  • Technical and analytics data — for a short period only, and usually in aggregated or anonymised form after that.

Once a retention period ends, we securely delete the data or anonymise it so that it can no longer identify you.

7. How we protect it

We use encryption in transit (HTTPS/TLS) across our site, restrict access to personal data to people who need it to do their job, require our suppliers to commit to appropriate security measures, and keep our systems patched.

Payment card data is handled entirely by PCI DSS compliant payment providers and never reaches our systems.

No system is perfectly secure, and we cannot guarantee the security of data you send us over the internet. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours, and we will tell you directly where the risk is high.

8. Your rights

Under the UK GDPR you have the right to:

  • Be informed — know what we do with your data. That is what this policy is for.
  • Access — get a copy of the personal data we hold about you.
  • Rectification — have inaccurate or incomplete data corrected.
  • Erasure — have your data deleted where we no longer need it, where you withdraw consent and there is no other basis, or where we have handled it unlawfully. This right is not absolute — we cannot delete records we are legally required to keep, such as tax records.
  • Restrict processing — ask us to pause our use of your data while a dispute is resolved.
  • Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller, where processing is based on consent or contract and is automated.
  • Object — object to processing based on legitimate interests. You can object to direct marketing at any time and we must stop immediately, no questions asked.
  • Withdraw consent — at any time, where we rely on consent. This does not affect anything done before you withdrew it.
  • Not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions, though our payment providers run automated fraud screening on transactions. If a payment is declined by that screening, contact us and a person will review it.

To exercise any right, email help@shuvienstore.com. It is free. We respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within the first month if we do. We may ask you to verify your identity before we release data.

Complaining

If you are unhappy with how we have handled your data, please tell us first — we would like the chance to fix it. You also have the right to complain directly to the UK's regulator:

Information Commissioner's Office (ICO) Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk

Complaining to the ICO does not affect any other legal remedy you have.

9. Data Protection Officer

Shuvien is not required to appoint a Data Protection Officer. We are not a public authority, we do not carry out large-scale systematic monitoring of individuals, and we do not process special category data on a large scale — the three circumstances that make a DPO mandatory under Article 37 of the UK GDPR.

All privacy queries, rights requests and complaints go to help@shuvienstore.com, which is monitored by the person responsible for data protection at Shuvien.

10. Children

Our shop is intended for adults. We do not knowingly collect data from anyone under 16. If you believe a child has given us their data, email help@shuvienstore.com and we will delete it.

11. Other websites

Our site may link to other websites. We are not responsible for their privacy practices, and this policy does not cover them. Please read their own privacy policies before giving them your data.

12. Changes to this policy

We may update this policy. The date at the top always tells you when it last changed. If we make a significant change to how we use your data, we will tell you by email or through a prominent notice on the site before it takes effect.

13. Contact

Privacy enquiries: help@shuvienstore.com (subject line: PRIVACY) Phone: 07753 794421 Post: Shuvien, 36 Balsham Road, Harwell, DN10 1FP, United Kingdom