Privacy Policy
Last updated: 14 October 2026
Who we are
ROVIKORE runs this store on the ROVIKORE e-commerce platform. If you have any questions about this privacy policy or how we handle your personal data, please contact us using the contact details on this website .
What data we collect
Storefront customers
When you create an account or place an order, we collect:
- Name and email address
- Delivery address
- Order history
Lawful basis: performance of a contract — we need this information to fulfil your order.
Merchants
When a business joins the platform, we collect:
- Business name and contact name
- Email address
- Bank and Stripe account details (for payment processing)
Lawful basis: performance of a contract — we need this information to provide the platform service.
All users
When you use this website, we automatically collect:
- Server logs (IP address, browser type, pages visited, timestamps)
- Session data (to keep you signed in and remember your cart)
Lawful basis: legitimate interests — these are strictly necessary for the website to function securely and to investigate any technical problems.
How we use your data
We use your personal data to:
- Fulfil and manage your orders
- Communicate with you about your orders (confirmation, dispatch, returns)
- Process payments securely via Stripe
- Send transactional emails (order confirmations, shipping updates) via Postmark
We do not use your data for marketing emails unless you have explicitly opted in (for example, by subscribing to our newsletter).
Who we share your data with
We only share your data with trusted third-party services that are necessary to run this store. We never sell your personal data.
- Stripe — payment processing. Stripe processes your card details directly; we do not store full card numbers. See Stripe's privacy policy .
- Postmark — transactional email delivery (order confirmations, shipping updates). See Postmark's privacy policy .
- Hetzner — cloud hosting. Our servers are located in the EU (Germany). See Hetzner's privacy policy .
- Cloudflare — CDN and DDoS protection. Traffic to this site passes through Cloudflare's network. See Cloudflare's privacy policy .
How long we keep your data
We keep your data only for as long as necessary for the purposes described above, or as required by law. The table below sets out our specific retention periods.
| Data type | Retention period | Reason |
|---|---|---|
| Session & magic-link tokens | Deleted on expiry | Short-lived tokens are purged automatically once they expire. |
| Customer accounts | Active + 3 years after last activity | Accounts inactive for 3 years (with no orders in the last 7 years) are anonymised: personal details are removed but the account record is retained to preserve order history references. |
| Order records | 7 years | Required by UK law (Companies Act 2006 / HMRC accounting records). Order records are never deleted. |
| Platform audit logs | 2 years | Internal security and compliance audit trail. Automatically deleted after 2 years. |
| Feedback submissions | 1 year after resolution | Resolved or closed feedback is deleted after 1 year. Open feedback is retained until resolved. |
| Merchant account data | Active + 7 years after offboarding | Required to support tax, legal, and contractual obligations after a merchant leaves the platform. |
You can request deletion of your personal data at any time — see Your Rights below. Note that some data (such as order records) must be retained by law even after a deletion request.
Your rights under UK GDPR
You have the following rights regarding your personal data:
- Access — request a copy of the data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your data ("right to be forgotten"), subject to legal retention requirements.
- Restriction — ask us to limit how we process your data.
- Portability — request your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interests.
To exercise any of these rights, please contact us using the contact details on this website . We will respond within 30 days.
If you are not satisfied with how we handle your request, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk .
Cookies
We use only strictly necessary cookies to operate this website:
- Session cookie — keeps you signed in while you browse.
- Cart cookie — remembers the items in your shopping cart.
We do not use tracking, analytics, or advertising cookies. No cookie consent banner is required for strictly necessary cookies under UK PECR.
Changes to this policy
We may update this privacy policy from time to time. When we do, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.