Last updated: January 2025.
Who we are
ARVANTEO is the data controller for personal data collected through this website. You can reach us at [email protected].
What we collect and why
When you place an order
Your name, email address, phone number, delivery address and billing address, and the contents and value of your order. We need this to fulfil the contract between us — to take payment, ship the parcel and handle any return.
We never see or store your full card number. Card details go directly to our payment provider; we store only the card brand and last four digits so that you can recognise the charge.
When you create an account
Your name, email address and a hashed password — we cannot read your password. Saved addresses, order history and wishlist items are stored against your account so you do not have to re-enter them.
When you subscribe to our newsletter
Your email address, the exact consent wording you agreed to, and the date and a hashed form of the IP address you consented from. We rely on your consent, which you can withdraw at any time using the unsubscribe link in any email.
When you browse the site
With your consent, we use analytics and advertising cookies to understand which pages and products people use, and to measure our advertising. Without that consent, no analytics or advertising tag loads at all — the site simply works.
We store a record of the consent choices you make, including which channels you allowed and when, so we can demonstrate compliance.
When you contact us
Your name, email address, order number if you supply one, and the content of your message. We use it only to answer your enquiry.
Legal bases
- Contract — processing orders, payments, deliveries and returns.
- Consent — analytics cookies, advertising cookies and marketing emails.
- Legal obligation — retaining invoices and order records for tax and accounting.
- Legitimate interests — securing the site against fraud and abuse, and keeping the service working. We balance this against your rights and keep the data minimal (for example, IP addresses are stored only as a hash).
Who we share it with
- Payment providers, to take and refund payments.
- Carriers, to deliver your order and handle returns. Non-EU destinations require customs information to be shared.
- Email providers, to send order and account emails.
- Analytics and advertising platforms, only where you have consented. For advertising measurement we send a cryptographically hashed form of your email and address fields, never the plain values.
- Hosting and infrastructure providers, who process data on our instructions.
We never sell your personal data.
International transfers
Some of our providers are based outside the European Economic Area. Where that is the case, transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision.
How long we keep it
- Order and invoice records — as long as tax law requires, typically seven to ten years depending on the market.
- Account data — until you ask us to delete your account.
- Newsletter records — until you unsubscribe, plus a record of the unsubscribe itself so we do not email you again.
- Consent records — for as long as needed to demonstrate compliance.
- Contact messages — up to two years.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data deleted, where we are not legally required to keep it.
- Restrict or object to processing.
- Receive your data in a portable format.
- Withdraw consent at any time, without affecting processing already carried out.
- Complain to your national data protection authority.
You can request account deletion from your account settings, or email us. We respond within 30 days. Please note that order and invoice records are retained where the law requires it, even after an account is closed.
Cookies
Details of the cookies we use are in our cookie policy. You can change your choices at any time: