Privacy policy

Last updated: 24 August 2026

This Privacy Policy explains how Orvalés ("we", "us", "our") collects, uses, shares and protects your personal data when you visit Orvales.com, make a purchase, or otherwise interact with our services (the "Services").

Our store is hosted by Shopify, which acts as a data processor in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using our Services, you acknowledge that you have read and understood this Policy.

1. Data Controller

The data controller responsible for your personal data is:

Orvalés, LTD Trading as: Orvalés Phone: +31 6 18479307

Shopify acts as a data processor for technical services relating to hosting, payment processing, analytics and fraud prevention.

2. Data We Collect

A. Data you provide directly

Orvalés
Letterzetterhof 30, 2645 LD Delfgauw, The Netherlands
info@orvales.com
+31 6 18479307
Payment information (secured — we do not store full card numbers)
Order details (purchases, returns, exchanges, customer service enquiries)

B. Data collected automatically

Through cookies and analytics tools:

IP address
Browser and device type
Pages viewed and time spent browsing
Shopping cart activity (items added, items removed, abandoned carts)

C. Data from third parties

Payment providers
Shopify
Marketing partners (Google Ads)

We do not sell your personal data.

3. Legal Basis and Purposes of Processing

We process your data on the following legal bases under the UK GDPR:

Performance of a contract (processing your orders)
Legitimate interests (improving our Services, preventing fraud)
Consent (marketing, non-essential cookies)
Legal obligations (tax, accounting, regulatory requirements)

A. Order processing

Creating and managing your account
Processing payments
Delivery and order tracking
Managing returns and exchanges

B. Customer support

Responding to enquiries
Resolving delivery or product issues

C. Website improvement and personalisation

Analysing traffic and site performance
Optimising navigation and our product offering
Displaying relevant content

D. Marketing and advertising (with consent where required)

Sending newsletters and promotional offers
Displaying personalised or general advertising

You may unsubscribe at any time via our emails or by contacting us.

We may create customer segments or profiles based on your purchasing behaviour. You may object to such profiling by contacting info@orvales.com.

E. Security and fraud prevention

Protecting your account
Detecting fraudulent activity
Securing payments

F. Legal compliance

Tax and accounting obligations
Responding to legal or regulatory requests

4. Sharing Your Data

A. Shopify

Shopify hosts our store and processes certain data to operate the service.

B. Service providers

We share limited data with:

Payment providers
Carriers and logistics partners
IT, analytics and email service providers
Marketing platforms

These providers act as data processors and are contractually bound to confidentiality.

C. Advertising partners

We may share encrypted or pseudonymised identifiers with partners (Google Ads) in order to display relevant advertising.

D. Legal requirements

We may disclose data where required by law or to protect our rights and safety.

We do not sell personal data.

5. Cookies and Tracking Technologies

We use cookies to:

Provide essential functions (account, cart, checkout)
Remember your preferences
Analyse website performance
Enable advertising, retargeting and audience measurement

You can manage cookies through your browser settings or via our consent banner. Refusing certain cookies may limit the functionality of the website.

6. Data Storage and Security

We implement reasonable technical and organisational measures to protect your data. However, no system is entirely secure.

Data may be stored:

On secure servers located in the European Economic Area (EEA)
By Shopify, which may host data in the UK, EEA, Canada or the United States, subject to appropriate contractual safeguards

We retain your data only for as long as necessary for the purposes described above, or as required by law.

7. International Data Transfers

Where your data is transferred outside the UK, we rely on:

The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses
Appropriate contractual safeguards
Other transfer mechanisms recognised under the UK GDPR, including transfers to countries covered by UK adequacy regulations

8. Your Rights (UK GDPR)

You have the following rights:

Access – to obtain a copy of your data
Rectification – to correct inaccurate data
Erasure – to request deletion of your data
Restriction – to restrict certain processing
Objection – in particular to direct marketing
Portability – to receive your data in a readable format
Withdrawal of consent – at any time

To exercise your rights, contact us at info@orvales.com. We may request proof of identity to verify your request.

You may also lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

9. Children's Data

Our Services are not intended for children under the age of 13. In line with the UK GDPR and the Data Protection Act 2018, we do not knowingly collect data relating to children under this age. Please contact us if you believe such data has been collected so that we can delete it.

10. Links to Third-Party Websites

Our website may contain links to external sites. We are not responsible for their privacy practices. Please review their policies before providing any personal information.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent version. We will notify customers of material changes where required by law.