Privacy Policy
1. Who we are
This website, graventis.shop, is operated by GRAVENTIS LTD, a company registered in England and Wales under company number 17434084. We sell home storage and organisation products to private customers in the United Kingdom.
Registered address: 167-169 Great Portland Street, Fifth Floor, London, England, W1W 5PF.
For anything relating to your personal data, write to [email protected] or call +44 7700 900418.
GRAVENTIS LTD is the data controller for the personal data described in this policy. We process that data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data we collect
Order details
When you place an order we ask for the information needed to send the goods to you and to keep you informed:
- your full name;
- e-mail address;
- telephone number;
- delivery address, town or city and postcode;
- any note you add to the order, for example access instructions for a bulky shelving delivery.
Payment data
Card and other payment details are collected and processed by our payment provider on its own systems. We never see or store your full card number, expiry date or security code. We receive only a confirmation that the payment succeeded or failed, together with a transaction reference.
Correspondence
If you e-mail or call us, we keep the message, your contact details and our reply so that we can deal with the query and any follow-up.
Technical data
Our hosting provider records standard server log data such as IP address, browser type and the pages requested. This is used to keep the site available and secure.
Data we do not collect
We do not ask for and do not want special category data — information about health, ethnicity, religion, political opinions, trade union membership, genetics, biometrics, sex life or sexual orientation. Please do not include such information in order notes or e-mails.
3. Purposes and legal bases
| What we do | Data used | Legal basis |
|---|---|---|
| Take, process and dispatch your order | Name, e-mail, phone, address, order note | Performance of a contract |
| Arrange delivery and access for large items | Name, phone, address, order note | Performance of a contract |
| Answer questions and handle returns | Contact details, order history | Performance of a contract; legal obligation |
| Keep accounting and tax records | Order and transaction records | Legal obligation |
| Prevent fraud and keep the site secure | Technical data, order data | Legitimate interests |
| Improve our product range and service | Aggregated order data | Legitimate interests |
| Send marketing e-mails, if you ask for them | Name, e-mail | Consent |
Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights and freedoms, and we have concluded that they are not. You can object to this processing at any time — see section 9.
5. International transfers
We aim to keep personal data within the United Kingdom and the European Economic Area. If a provider we use stores or accesses data outside those areas, we make sure the transfer is covered by UK adequacy regulations, or by the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the transfer requires. You can ask us for details of the safeguards in place.
6. How long we keep data
- Order and transaction records — six years after the end of the financial year in which the order was placed, to meet HMRC record-keeping rules.
- Delivery and returns correspondence — two years after the case is closed.
- General enquiries that do not lead to an order — twelve months.
- Marketing consent records — until you withdraw consent, and then for two years as proof that consent existed and was withdrawn.
- Server logs — up to twelve months.
When a retention period ends, the data is deleted or irreversibly anonymised.
7. Security
The site is served over HTTPS. Access to order data is limited to the people who need it to fulfil orders and answer questions, and is protected by individual accounts and strong authentication. Our providers are chosen for their security posture, and we review access rights periodically. No system can be guaranteed absolutely secure, but if a breach occurs that is likely to result in a risk to your rights and freedoms we will notify the Information Commissioner's Office within 72 hours, and you directly where the risk is high.
9. Your rights
Under the UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected and incomplete data completed.
- Erasure — ask us to delete data where we no longer have a valid reason to keep it.
- Restriction — ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
- Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where processing is based on consent.
To exercise any of these, e-mail [email protected]. We reply within one month. If a request is complex we may extend that by a further two months and will tell you why. We may ask for proof of identity before releasing data. There is no charge unless a request is manifestly unfounded or excessive.
10. Withdrawing consent
Where we rely on your consent — in practice, marketing e-mails — you can withdraw it at any time by using the unsubscribe link in any message or by e-mailing us. Withdrawal does not affect the lawfulness of processing carried out before you withdrew, and it does not stop us from processing order data where we need it to fulfil a contract or meet a legal obligation.
11. Complaints
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office: ico.org.uk, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Age restriction
This shop is intended for adults. We do not knowingly sell to or collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We update this policy when our processing changes or when the law does. The date at the top always shows the current version. Where a change materially affects how we use your data, we will tell customers with an active order by e-mail.
14. Contact us
GRAVENTIS LTD
167-169 Great Portland Street, Fifth Floor, London, England, W1W 5PF
Company number 17434084
E-mail: [email protected]
Phone: +44 7700 900418
Orders may be returned within 14 days under the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013; details are sent with your order confirmation.