Privacy Policy
Last updated: 5 October 2026
This policy explains what personal data we collect when you browse elviora.uk, place an order or write to us, why we need it, who we share it with and how long we keep it. We keep it short where we can and specific where it matters.
1. Who we are
Elviora is an online shop selling paints, brushes, canvases, easels, paper and drawing materials to customers in the United Kingdom. The controller of your personal data is:
- ELVIORA LTD, a company registered in England and Wales, company number 16948313
- Registered office: 1 Affordable Test Ltd, 1000 Great West Road, Brentford, Middlesex, United Kingdom, TW8 9DW
- Email: [email protected]
- Phone: +44 7438 216905
- Website: elviora.uk
We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For any privacy question, write to the email address above.
2. Data we collect
When you place an order
- Full name, email address and phone number.
- Delivery address, town or city and postcode.
- The products you order, quantities, prices, order number and order date.
- Any order comment you add, such as delivery instructions.
- The text of an optional gift card message, which we print or handwrite and put in the parcel.
Payment information
Payments are handled by our payment provider. You enter card details on the provider's secure systems, not on our site, and we never receive or store your full card number or security code. The provider tells us whether a payment succeeded and may share limited details such as the card type, the last four digits and the transaction reference.
When you contact us
If you email or phone us, we keep your name, contact details and the content of the correspondence, including any photos you send, for example of a damaged item.
When you browse the site
Our hosting provider automatically records technical data needed to deliver the pages and keep them secure: IP address, browser type, the pages requested and the time of the request. We do not use analytics or advertising trackers.
We do not ask for and do not knowingly collect special category data, such as health information.
3. Purposes and legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Taking, confirming and delivering your order, arranging payment, handling cancellations, returns and refunds | Order, contact, delivery and payment status data, gift message | Contract (Article 6(1)(b) UK GDPR) |
| Answering your questions and resolving problems with an order | Contact details, correspondence | Contract, or legitimate interests in providing good customer service (Article 6(1)(f)) |
| Keeping accounting and tax records, meeting consumer law duties | Order and payment records | Legal obligation (Article 6(1)(c)) |
| Preventing fraud and keeping the website secure | Technical data, order and payment status data | Legitimate interests in protecting our business and customers (Article 6(1)(f)) |
| Sending occasional news about new stock, only if you ask us to | Name, email address | Consent (Article 6(1)(a)), which you can withdraw at any time |
| Defending or bringing legal claims | Relevant order records and correspondence | Legitimate interests (Article 6(1)(f)) |
If you do not give us the details we need to deliver an order, such as your address, we cannot complete it.
4. Who we share data with
We never sell your personal data. We share only what each recipient needs:
- Payment provider — processes your payment and carries out fraud checks.
- Courier and postal services — receive your name, delivery address, phone number and sometimes your email so they can deliver the parcel and send tracking updates. Easels and other large items go with a two-person courier.
- Email and IT service providers — host our website and mailbox and store our records.
- Accountants and professional advisers — where needed for bookkeeping, audit or legal advice.
- Public authorities — such as HMRC or the police, only where the law requires it.
Service providers acting on our behalf are bound by contracts that allow them to use your data only on our instructions and require them to keep it secure.
5. International transfers
We aim to keep your data in the UK. Some of our service providers, such as email, hosting or payment services, may store or access data outside the UK. When that happens we make sure the transfer is protected: either the destination country has UK adequacy regulations, or the provider signs the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards in place.
6. How long we keep data
| Data | Retention period |
|---|---|
| Order, invoice and payment records | 6 years from the end of the financial year of the order, to meet tax and company law requirements |
| Delivery address and phone number linked to an order | Kept with the order record above; shared with couriers only for the delivery itself |
| Gift card message | Deleted 30 days after the order is delivered |
| Email correspondence and call notes | 2 years after the last contact, unless linked to an open claim |
| Newsletter consent and email address | Until you unsubscribe or withdraw consent |
| Server security logs | Up to 90 days |
When a retention period ends we delete or anonymise the data.
7. Security
The site is served over an encrypted HTTPS connection. Access to order data is limited to the people who need it, accounts are protected with strong passwords and two-factor authentication, and our providers are chosen for their security standards. No system is completely secure, so if a breach affecting your data occurs we will tell you and the ICO where the law requires it.
8. Cookies and similar technologies
Our website does not set cookies and does not use local storage, analytics or advertising trackers. Your cart lives only in the open browser tab and disappears when you close or reload it.
Our pages load fonts from Google Fonts, which means your browser connects to Google's servers and shares your IP address with them so the fonts can be delivered. Our payment provider may use strictly necessary cookies on its own secure payment pages to process the payment and prevent fraud; these are governed by the provider's own policy.
9. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data where we no longer have a reason to keep it.
- Restriction — ask us to limit how we use your data, for example while a correction is checked.
- Data portability — receive data you gave us in a structured, machine-readable format, or have it sent to another organisation.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on consent, withdraw it at any time.
To use any of these rights, email [email protected]. We reply within one month and do not charge a fee. We may ask you to confirm your identity before releasing data.
10. Withdrawing consent
If you have agreed to receive news from us, you can withdraw consent by clicking the unsubscribe link in any email or by writing to [email protected]. Withdrawing consent does not affect processing carried out before you withdrew it, and does not affect orders you have already placed.
11. Complaints
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or by phone on 0303 123 1113.
12. Age restriction
Our shop is intended for adults. You must be 18 or over to place an order. We do not knowingly collect personal data from children under 13; if you believe a child has given us their data, contact us and we will delete it.
13. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last revised. If a change significantly affects how we use your data, we will tell customers with an active order by email.