Privacy policy

This policy explains what personal data we collect when you visit rovelyn.shop or buy from us, why we use it, who we share it with, how long we keep it and the rights you have. We follow the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for customers in the European Union, the EU GDPR.

Who is responsible for your data

The data controller is REVOLVE CLOTHING LIMITED, trading as ROVELYN, a company registered in England and Wales. Our company number and registered address are listed on our Legal information page. Contact us about privacy at support@rovelyn.shop or +44 7877 740352.

What we collect

• Order details: your name, billing and delivery address, email address, phone number (optional), the products you buy, and the currency and language you used.
• Payment information: handled directly by our payment providers. We receive only a confirmation, the card type and the last four digits; we never see or store your full card number.
• Account details: if you create an account, your email address, a securely stored password and your order history.
• Messages: what you send us by email, phone or the contact form.
• Technical data: your IP address, browser type and the pages you request, which our web server records for security, and the cookies described in our Cookie policy.

Why we use it and our lawful basis

Processing and delivering your order

Performance of our contract with you.

Customer service, returns and refunds

Performance of our contract, and our legitimate interest in helping customers.

Preventing fraud and keeping the site secure

Our legitimate interest in protecting our customers and business; legal obligation where applicable.

Keeping accounting and tax records

Legal obligation.

Answering your messages

Our legitimate interest in responding to you, and your consent when you use the contact form.

Remembering your currency, language and bag

Our legitimate interest in making the site work as you expect (strictly necessary cookies).

We do not send marketing emails, we do not use advertising or analytics trackers, and we do not sell or rent your personal data.

Who we share it with

• Payment providers such as Stripe and PayPal, to take payment and prevent fraud. They act as independent controllers for some purposes under their own privacy policies.
• Delivery carriers, who receive your name, address and contact details to deliver your parcel and, for international parcels, customs authorities.
• Our hosting provider (Hostinger), which stores the website and its data on our behalf.
• Our email provider, which delivers our order emails and your messages.
• Professional advisers and authorities, such as accountants or HM Revenue & Customs, where required by law.

International transfers

Some of these providers process data outside the UK and the European Economic Area, for example in the United States. Where they do, we rely on adequacy regulations or on standard contractual clauses approved by the UK and EU authorities to protect your data.

How long we keep it

• Order and payment records: 6 years after the end of the financial year of the order, as required for tax and accounting.
• Account data: until you close your account, then deleted within 30 days (order records are kept as above).
• Contact messages: up to 2 years after our last exchange.
• Server security logs: up to 30 days.

Your rights

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its use, to data portability, and to withdraw consent at any time where we rely on consent. To use any of these rights, email support@rovelyn.shop. We reply within one month and do not charge a fee.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the UK Information Commissioner’s Office (ico.org.uk) or, in the EU, to the data protection authority in your country.

Residents of the United States

We do not sell or share your personal information for cross-context behavioural advertising. Residents of California and other US states with privacy laws may ask to know, correct or delete the personal information we hold by emailing support@rovelyn.shop. We will not treat you differently for making a request.

Children

Our website is not intended for children under 16, and we do not knowingly collect their data.

Security

The website uses HTTPS encryption throughout. Access to order data is limited to the people who need it to serve you.

Changes to this policy

We will update this policy if the way we use personal data changes. The date of the last update is shown at the top of this page.