Privacy policy
Last updated: October 2026
At Elyvara, accessible at ellyvara.shop, we respect your privacy and are committed to handling your personal information responsibly. This Privacy Policy explains how we collect, use, disclose and protect information when you visit our website, make a purchase or contact us.
1. Introduction & Our Commitment
Elyvara is a business registered in the United Kingdom and acts as the data controller for personal information processed in connection with its online store, where it determines the purposes and means of processing. We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations (PECR). We do not sell, rent or trade our customers' personal information to third parties. We may nevertheless share limited information with service providers and advertising partners for the purposes explained below, subject to applicable law and consent requirements.
2. Information We Collect
When you place an order, contact customer support, subscribe to marketing or otherwise interact with us, we may collect your name, email address, telephone number, billing and delivery addresses, order details, account information and correspondence. Payments are handled by authorised payment providers; we do not store complete payment card numbers or security codes on our own systems. Our checkout and payment partners may process payment details necessary to complete your transaction.
We may also automatically collect technical and usage information, including IP address, device identifiers, browser type, operating system, approximate location, referring pages, pages viewed, interaction data, cookies and similar identifiers. We may receive relevant transaction, fraud-prevention or delivery information from payment providers, logistics partners and other service providers.
3. How We Use Your Information & Our Legal Bases
We use personal information to process and deliver orders, take payments, provide order updates, manage returns and refunds, and answer enquiries. These activities are generally necessary to perform our contract with you or to take steps at your request before entering into a contract.
We also use information to comply with legal obligations, including applicable tax, accounting and consumer protection requirements; to prevent fraud, secure our website, improve customer service and understand store performance where our legitimate interests are not overridden by your rights; and to send promotional messages where we have the necessary consent or another lawful permission under PECR. You can withdraw marketing consent or unsubscribe at any time using the link in our messages or by emailing support@ellyvara.shop. We may use aggregated or anonymised information to assess website performance and business trends.
4. Cookies & Tracking Technologies
Our Shopify-powered website uses strictly necessary cookies and similar technologies to operate core functions such as checkout, security, basket management and session continuity. Where consent is required, optional analytics or advertising technologies are activated only after you have made an appropriate choice through our cookie consent controls. You may change your preferences using the cookie settings available on our website, where provided.
Subject to your choices and applicable law, technologies associated with Meta, Google Ads and TikTok may help us understand advertising effectiveness, measure conversions and show relevant advertisements. These providers may process browsing and device information under their respective privacy terms. You may also manage cookies through your browser, although disabling essential technologies may affect certain website functions.
5. Order Fulfilment & Third-Party Services
We use Shopify to host and operate our online store, including its checkout and supporting services. Depending on your selected checkout option, payment services may be provided through Shop Pay, Visa, Mastercard, American Express, Diners Club, Discover, Apple Pay or Google Pay and their respective payment-processing partners. Those providers handle information needed to authorise payments, prevent fraud and fulfil payment-related legal requirements.
Orders may be processed through fulfilment locations in Germany, China and the United States. Products are subject to the same quality-control standards regardless of fulfilment location, and routing may be selected based on inventory availability and delivery efficiency. We share the information reasonably needed to prepare and deliver orders with fulfilment providers and shipping carriers, which may include your name, delivery address, contact details and relevant order information. Carriers may need a telephone number or email address to provide delivery updates or resolve delivery issues.
Where permitted, we may also work with analytics, customer support, security and advertising providers, including Meta, Google Ads and TikTok. We limit disclosures to information reasonably required for the relevant purpose and seek appropriate contractual and security protections. Some providers may act as independent controllers for their own services.
6. Data Retention
We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including completing orders, handling enquiries, resolving disputes, preventing fraud and meeting statutory record-keeping obligations. Relevant business and tax records may need to be retained for at least six years, depending on the applicable legal requirement and accounting circumstances. Other information, such as marketing preferences and support correspondence, is reviewed according to its purpose and necessity.
When data is no longer needed, we delete it or anonymise it securely, unless a legal obligation or legitimate need requires further retention. A valid deletion request will be assessed against any continuing legal obligations or permitted exemptions.
7. Your Rights Under UK Data Protection Law
Subject to applicable conditions and exemptions, you may request access to your personal information, correction of inaccurate information, deletion, restriction of processing, portability of certain information or objection to certain processing. You may withdraw consent at any time where processing relies on consent. You also have relevant rights regarding decisions based solely on automated processing that produce legal or similarly significant effects, where applicable.
To exercise your rights, email support@ellyvara.shop with the subject line “Data Privacy Request”. We aim to acknowledge requests within 48 hours and respond without undue delay, normally within one calendar month as required by UK data protection law. In limited legally permitted circumstances, more time may be required; we will explain any applicable extension. We may request reasonable proof of identity before disclosing or changing personal information.
8. International Data Transfers
Some of our technology, payment, logistics and support providers may access or process personal information outside the United Kingdom. Where a transfer is restricted under UK data protection law, we use an appropriate lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to relevant standard contractual clauses, or another legally recognised safeguard, as applicable. We assess transfer arrangements and implement supplementary protections where required. Such mechanisms do not imply that individual transfers are approved in advance by the Information Commissioner's Office.
9. Data Security
We use reasonable administrative, technical and organisational safeguards designed to protect personal information from unauthorised access, alteration, disclosure and loss. These include secure HTTPS/TLS connections, access controls, appropriate service-provider arrangements and security features available through our Shopify infrastructure. No internet transmission or storage system is completely secure, and we cannot guarantee absolute security. We investigate suspected incidents and notify affected individuals or authorities where legally required.
10. Children's Privacy
Elyvara is intended for a general shopping audience and is not directed towards children under 16. We do not knowingly seek to collect personal information directly from children under 16 for marketing purposes. If you believe a child has provided personal information to us without appropriate authorisation, please contact support@ellyvara.shop so that we can review the situation and take appropriate action. This store policy does not replace the age-specific rules that may apply under UK law.
11. Automated Processing & Advertising Preferences
Our service providers may use automated tools for routine fraud screening, transaction verification, analytics or advertising measurement. We do not intend to make solely automated decisions about customers that have legal or similarly significant effects without complying with applicable requirements. You can raise concerns about relevant processing and exercise applicable rights by emailing support@ellyvara.shop.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our operations, technology or applicable law. The most recent revision date will appear at the top of this page. Where changes are material or the law requires it, we will provide additional notice or seek fresh consent before implementing affected processing. Continuing to use our website after an update does not remove any statutory rights or replace consent where consent is legally required.
13. Contact Us & Supervisory Authority
For privacy questions, requests or concerns, contact Elyvara at support@ellyvara.shop or visit ellyvara.shop. Our customer support team aims to reply to general enquiries within 24 hours on business days. Privacy rights requests follow the statutory timetable described above.
If you are dissatisfied with how we handle your information, you may lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk. We encourage you to contact us first so that we have an opportunity to address your concern.