cat privacy-policy
Privacy Policy
Last updated: 28 September 2026
This policy explains what personal data we collect when you visit orqeva.shop or buy from us, why we use it, who we share it with and what rights you have. We apply the UK GDPR, the EU General Data Protection Regulation (GDPR) and applicable national data protection laws.
Who is responsible
The controller is SANDYCROFT WORKWEAR LTD., trading as ORQEVA, Prior House, 129 High Street, Prestatyn, Wales, LL19 9AS, United Kingdom, company number 07917944. For any privacy question or request, email support@orqeva.shop.
What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, billing and delivery address, email, phone number, order details | Processing and delivering your order, sending order and dispatch emails, handling returns and withdrawals | Performance of a contract (Art. 6(1)(b) GDPR) |
| Payment information | Taking payment and refunds. Card details are entered directly with our payment provider; we only receive the payment status, card type and last four digits | Performance of a contract (Art. 6(1)(b)) |
| Order and invoice records | Accounting and tax obligations | Legal obligation (Art. 6(1)(c)) |
| Account details (if you create an account): email, password (stored encrypted), saved addresses, order history | Giving you access to your orders and faster checkout | Performance of a contract (Art. 6(1)(b)) |
| Messages you send us (contact form, email, phone) and withdrawal requests | Answering your questions and handling your requests | Performance of a contract or our legitimate interest in answering enquiries (Art. 6(1)(b) and (f)) |
| Technical data: IP address, browser type, date and time of access, pages requested | Delivering the website securely, preventing abuse, estimating your country to show the right currency | Legitimate interest in a secure, working shop (Art. 6(1)(f)) |
| Fraud-prevention signals collected by our payment providers during checkout | Preventing card fraud | Legitimate interest in preventing fraud (Art. 6(1)(f)) |
We do not use your data for advertising, we do not build marketing profiles, and we do not send newsletters. We do not sell your personal data.
Who we share data with
- Payment providers — Stripe (Stripe Payments Europe Ltd. / Stripe Payments UK Ltd.) for card payments and PayPal (Europe) S.à r.l. et Cie, S.C.A. if you choose PayPal, when these methods are offered at checkout. They process payment data as independent controllers or as our processors, under their own privacy policies.
- Carriers and our fulfilment partner — your name, delivery address, email and phone number, so the parcel can be packed, delivered and tracked.
- Hosting and email — our web hosting provider (Hostinger) stores the website and its database; our email provider delivers order and support emails. They act as processors under data processing agreements.
- Authorities — where we are legally required, for example tax authorities.
International transfers
Some providers process data outside the UK and the European Economic Area, for example in the United States. Where this happens, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework and the UK extension) or by standard contractual clauses approved by the European Commission and the UK authorities.
How long we keep data
- Order, invoice and payment records: 6 years after the end of the financial year of the order, as required by UK tax law.
- Customer accounts: until you delete your account or ask us to delete it. Accounts with no activity for 3 years are deleted.
- Messages and withdrawal requests: 3 years after the matter has been closed, or longer if they form part of an order record.
- Server logs: up to 30 days.
Cookies
We only use cookies and similar technologies that the shop needs to work, such as your cart, your language and delivery country, and security at checkout. Details are in our Cookie Policy.
Your rights
You have the right to access your data, to have it corrected or deleted, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw consent at any time. To use any of these rights, email support@orqeva.shop. We answer within one month.
You also have the right to complain to a data protection supervisory authority. In the UK this is the Information Commissioner’s Office (ico.org.uk). In the EU you can contact the authority in your country of residence, for example Datatilsynet in Denmark or the data protection authority of your federal state in Germany.
Automated decisions
We do not make decisions about you based solely on automated processing. Our payment providers use automated fraud screening when you pay; if a payment is declined, you can contact us and we will review it.
Security
The whole site uses an encrypted HTTPS connection. Access to customer data is limited to the people who need it to handle your order.
Children
Our shop is not directed at children under 16, and we do not knowingly collect their data.
Changes to this policy
We update this policy when our processing changes. The date at the top of the page shows the latest version.