Privacy policy

This policy explains what personal data Loravella collects when you visit loravella.com or place an order, why we collect it, how long we keep it and what rights you have. It applies to the whole site. Last updated: 29 August 2026.

1) Who is responsible for your data

The controller responsible for processing your personal data is:

MATIRSHOP LLC, trading as Loravella
Customer service and returns: 24 The Pasture, Pound Hill, Crawley, England RH10 7AP, United Kingdom
E-mail: info@loravella.com
Phone: +44 7882 776427

We process personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2) What data we collect

Order data: your name, delivery and billing address, e-mail address, phone number, the items ordered and the amount paid.
Payment data: handled by our PCI-DSS certified payment provider. We receive only a masked reference such as the card brand, the last four digits and the authorisation result. We never receive or store your full card number or security code.
Account data: if you create an account, your e-mail address, an encrypted password and your saved addresses and order history.
Communication data: the content of e-mails, contact-form messages and phone notes, so we can answer you and keep a record of what was agreed.
Technical data: IP address, browser type and version, device type, pages visited, referring page, and the date and time of each visit, recorded in server logs.
Cookie data: see our Cookie Policy. Non-essential cookies are set only after you consent through our banner.

We do not knowingly collect data from children under 16, and we do not collect special categories of data such as health, religious or biometric information.

3) Why we use your data, and on what legal basis

To process and deliver your order - performance of the contract you entered into with us (Article 6(1)(b) UK GDPR). Without this data we cannot ship to you.
To take payment and prevent fraud - performance of the contract and our legitimate interest in preventing fraudulent transactions (Article 6(1)(f)).
To answer your questions - performance of the contract, or our legitimate interest in responding to enquiries.
To meet legal duties - accounting and tax record-keeping obligations (Article 6(1)(c)).
To keep the site secure and working - our legitimate interest in operating a safe website.
To send marketing e-mails - only with your consent (Article 6(1)(a)), which you can withdraw at any time.

4) Who we share it with

We never sell your personal data and we never share it for someone else's advertising. We share only what is needed, and only with:

Royal Mail - your name, address and phone number, so your parcel can be delivered and tracked.
our PCI-DSS certified payment provider - the data required to authorise and settle your payment.
Our hosting and IT providers - who store the site and its database on our instructions.
Our accountant and, where legally required, the authorities - invoice and transaction records.

Each of these acts as a processor bound by contract to use your data only on our instructions. Where a provider is located outside the United Kingdom, we transfer data only to countries covered by UK adequacy regulations, or under the International Data Transfer Agreement or UK Addendum to the standard contractual clauses.

5) How long we keep it

Order and invoice records: 6 years, as required for tax and accounting purposes (HMRC).
Account data: until you ask us to delete the account.
Customer service correspondence: 3 years from the last contact.
Marketing consent records: until you withdraw consent, plus 1 year as proof.
Server logs: 12 months.

6) Your rights

Under the UK GDPR you have the right to:

ask what data we hold about you and get a copy of it;
have inaccurate data corrected;
have your data deleted, where we are not legally required to keep it;
ask us to restrict processing, or object to processing based on legitimate interest;
receive your data in a portable, machine-readable format;
withdraw consent at any time, without affecting processing already carried out.

To exercise any of these, e-mail info@loravella.com. We answer within one month and we do not charge for it. We may ask you to confirm your identity first so we do not disclose your data to someone else.

7) Complaints

If you believe we have handled your data wrongly, please tell us first - most issues are a misunderstanding we can fix quickly. You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, helpline 0303 123 1113.

8) Cookies and tracking

We use strictly necessary cookies to run the cart, the checkout and your login session; these do not need consent. Any other cookie is set only after you agree through our consent banner, and you can change or withdraw that choice at any time using the cookie settings link in the footer. Full details, including categories and how to reopen the banner, are in our Cookie Policy.

9) Security

The site is served exclusively over encrypted HTTPS. Access to order data is limited to the staff who need it, protected by individual accounts and strong authentication. Payment card data never touches our systems. No system is perfectly secure, but if a breach ever affected your rights we would notify you and the ICO as the law requires.

10) Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. Material changes affecting your rights will be announced on the site.