Privacy Policy

Last updated: September 2026. This is starter wording for a UK online retailer — please have it reviewed before going live.

1. Who we are

Alvi Ecom Enterprise is the data controller for the personal information described in this policy. We are registered in England and Wales; our registered office, company number and Information Commissioner registration number are published on our Business Details page. This policy explains what we collect when you use our website or place an order, why we collect it, and the rights you have under the UK GDPR and the Data Protection Act 2018.

2. Information we collect

We collect information you give us directly — name, delivery and billing address, email address, telephone number and order details — along with information collected automatically, such as IP address, device and browser type, pages viewed and referring pages. If you contact us we keep a record of that correspondence.

3. Why we use it, and our lawful basis

We process your information to perform our contract with you (taking payment, delivering orders, handling returns and refunds); to meet legal obligations (VAT and accounting records, product safety); for our legitimate interests (preventing fraud, securing the website, improving our range and service, and answering enquiries); and with your consent where required (marketing emails and non-essential cookies). You can withdraw consent at any time without affecting processing already carried out.

4. Payment information

Card and wallet payments are processed by FCA-authorised, PCI DSS compliant payment service providers over an encrypted connection. We receive only a transaction reference, the last four digits of the card and a payment status. We do not collect or store full card numbers, security codes or wallet credentials.

5. Who we share it with

We share only what is necessary, and only with Royal Mail and courier partners (to deliver your order), payment processors (to take payment and handle chargebacks), and service providers such as hosting, email and analytics providers who act on our written instructions as processors. We may disclose information where the law, HMRC or another competent authority requires it. We never sell your personal data.

6. Transfers outside the UK

Some of our providers process data outside the United Kingdom. Where that happens we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, together with appropriate security measures, so your information keeps an equivalent level of protection.

7. Cookies

The website uses strictly necessary cookies to keep your session active and your basket working; these do not require consent. Analytics and preference cookies are set only where you agree, in line with the Privacy and Electronic Communications Regulations. You can block or delete cookies in your browser settings; some parts of the site may then stop working as intended.

8. How long we keep it

Order, invoice and VAT records are kept for six years after the end of the accounting period, as HMRC requires. Marketing contact details are kept until you unsubscribe. Enquiries are kept while they are being handled and for a reasonable period afterwards. Website analytics data is kept in aggregate form.

9. Security

The site is served over HTTPS, administrative access is restricted and protected by strong authentication, and access to customer records is limited to staff who need it. No online service can be completely secure, but we review our controls regularly and will notify you and the Information Commissioner of a personal data breach where the law requires it.

10. Your rights

You have the right to be informed about how we use your data, and to request access to it, correction of it, erasure of it where we are not required to keep it, restriction of processing, portability of the data you provided, and to object to processing based on legitimate interests or to direct marketing at any time. Requests reach us through the contact page and are answered within one month. If you are not satisfied you can complain to the Information Commissioner Office at ico.org.uk or on 0303 123 1113.

11. Children

Our services are intended for customers aged 18 and over. We do not knowingly collect information from children.

12. Changes to this policy

We may update this policy as our services or the law change. The revision date at the top of the page always shows the current version.

13. Contact

For any privacy question, or to exercise the rights above, contact us using the details on the contact page.