Privacy policy
This policy explains what personal information Kolvi collects when you use kolvishop.com, why we collect it, who we share it with, and the rights you have over it. We are the data controller for that information.
Contact for any privacy question or to exercise any right below: info@kolvishop.com. We reply within one working day, Monday to Friday. Our postal address for formal correspondence is available on request by email.
What we collect
- Order and contact details: your name, email address, delivery and billing address, and phone number if you give one.
- Payment information: handled entirely by our payment providers. We receive confirmation that a payment succeeded and the last four digits and card type. We never see or store your full card number.
- Account details if you create an account, including your login credentials in hashed form.
- Order history: what you bought, returned, cancelled or claimed under the guarantee.
- Messages you send us, including guarantee and complaint correspondence.
- Technical and usage data: IP address, device and browser type, and how you move through the site, collected through cookies and similar technologies.
Why we use it, and our lawful basis
- To fulfil your order and provide the guarantee and support that go with it. Lawful basis: performance of a contract.
- To comply with the law, including keeping records for tax and consumer-protection purposes. Lawful basis: legal obligation.
- To prevent fraud and keep the shop secure. Lawful basis: legitimate interests.
- To send marketing email, only where you have asked for it. Lawful basis: consent, which you can withdraw at any time using the unsubscribe link in any email or by emailing us.
- Non-essential cookies and analytics run only where you have accepted them. Lawful basis: consent.
Who we share it with
We do not sell your personal information. We share it only with the processors we need to run the shop:
- Shopify, which hosts this store and processes orders and payments on our behalf.
- Our supplement fulfilment partner in the United States, which receives the name and delivery address needed to make and post your supplement order.
- Carriers, including FedEx and USPS, which receive the delivery details needed to deliver your parcel.
- Payment providers, which process your payment directly.
- Authorities or advisers, where the law requires it or where we need to establish or defend a legal claim.
International transfers
Our supplements are made and posted from the United States, so your name and delivery address are transferred there in order to fulfil the order. Where personal information leaves the UK, we rely on the UK International Data Transfer Addendum, the European Commission's Standard Contractual Clauses, or an adequacy decision, as appropriate.
How long we keep it
Order and transaction records are kept for six years after the end of the tax year they relate to, because tax law requires it. Support correspondence is kept for two years. Marketing consent records are kept until you withdraw consent and then for a further year so we can show the consent was valid. Account data is kept until you ask us to close the account.
Your rights
Under UK and EU data protection law you have the right to access your personal information, to have it corrected, to have it erased, to restrict or object to how we use it, to data portability, and to withdraw consent at any time. Exercising any of these rights is free, and we will respond within one month.
To make a request, email info@kolvishop.com. We may need to confirm your identity first, and we will only ask for what is necessary to do that.
Cookies
Essential cookies keep the shop working, remember your bag and keep your session secure. They do not need consent. Analytics and marketing cookies only run if you accept them in the cookie banner, and you can change or withdraw that choice at any time through the banner or your browser settings.
Children
This shop is not intended for children. Our supplements are not suitable for under-18s and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us their details, email us and we will delete them.
Security
Payments run over an encrypted connection and are handled by the payment provider, not by us. No system is perfectly secure, so please do not send card details, passwords or other sensitive information to us by email.
Complaints
If you are unhappy with how we have handled your personal information, please tell us first at info@kolvishop.com so we can put it right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk, or to your local supervisory authority if you are in the EEA.
Changes
We may update this policy. The version published on this page when you place an order is the version that applies to that order.