Privacy Policy
Last updated: 31 August 2026
Elmvora LTD ("Elmvora", "we", "our" or "us") is committed to protecting your privacy.
This policy explains what personal information we collect when you visit elmvora.com, place an order, create an account, contact us or subscribe to marketing — why we collect it, who we share it with, and what control you have over it.
We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We do not sell your personal information.
1. Who we are
Elmvora LTD is the data controller for the information described in this policy.
| Store name | Elmvora |
| Company name | Elmvora LTD |
| Business address | St Nicholas Avenue, Fulford, York YO19 4TA, United Kingdom |
| support@elmvora.com | |
| Phone | +44 1904 682700 |
| Contact form | Click here |
| Hours | Monday to Saturday, 9:00 am–6:00 pm UK time |
Sunday and public holidays: closed.
2. What we collect
When you place an order Name, email address, telephone number, billing address, delivery address, the contents of your order, payment confirmation, and records of delivery, returns and refunds.
Payment information Card details go directly into our payment provider's secure form and never reach our servers. We receive a payment confirmation, the last four digits and the card type.
When you create an account Username, encrypted password and your account preferences.
Automatically, when you visit IP address, browser type and version, device characteristics, operating system, language preferences, referring URL, pages and products viewed, time spent on pages, basket and checkout activity, and cookie identifiers.
We also use tools that measure page response times, length of visit and how you navigate away from a page. This is used to keep the site secure and working, and to understand how it's used.
When you contact us Whatever you include in your message, plus your email address.
From third parties Shopify, our payment providers, delivery partners, fraud-prevention services and analytics providers supply information needed to run the business and complete your order.
3. Why we use it, and on what basis
| Purpose | Lawful basis |
|---|---|
| Processing, dispatching and delivering your order | Performance of a contract |
| Taking payment and issuing refunds | Performance of a contract |
| Managing your account | Performance of a contract |
| Customer support, returns and complaints | Performance of a contract |
| Preventing and investigating fraud | Legitimate interests |
| Keeping the website secure and working | Legitimate interests |
| Understanding how the site is used and improving it | Legitimate interests |
| Accounting, tax and other legal obligations | Legal obligation |
| Marketing emails and offers | Consent |
| Analytics and advertising cookies | Consent |
Where we rely on legitimate interests, we've considered whether our interest is outweighed by your rights, and you can object at any time.
Where we rely on consent — marketing and non-essential cookies — you can withdraw it whenever you like, without affecting processing carried out beforehand.
Buying from us is never conditional on agreeing to marketing.
4. Cookies
| Type | What it does | Optional? |
|---|---|---|
| Strictly necessary | Basket, checkout, account login, security | No — the site won't work without these |
| Functional | Remembers your settings and language preference | Yes |
| Analytics | Traffic, performance and error measurement | Yes |
| Advertising | Ad measurement, personalisation and remarketing | Yes |
We only set non-essential cookies once you've given consent through our cookie banner, as required by the Privacy and Electronic Communications Regulations. You can change or withdraw that consent at any time through the banner.
Browser settings also let you block cookies, though blocking them doesn't delete cookies already stored — you'd need to clear those separately. Disabling strictly necessary cookies will prevent checkout from working.
Remarketing: where you've consented, we may show you advertising on other websites and platforms after you've visited ours. You can withdraw that consent at any time.
5. Marketing
Where you've opted in, we may send you product updates, new arrivals and offers.
Unsubscribe at any time using the link in any marketing email or by contacting support@elmvora.com.
Unsubscribing doesn't stop necessary messages about an order, refund, delivery or support request.
6. Who we share it with
- Shopify — the platform our store runs on
- Payment providers — taking payment and screening for fraud
- Delivery and fulfilment partners — getting your order to you
- Email and marketing providers — order confirmations and, where you've opted in, marketing
- Analytics and advertising providers — understanding site use and measuring advertising
- Professional advisers, regulators and authorities — where the law requires it
Each receives only what their function requires and processes it under our instructions. We have data processing agreements in place with our processors.
Business transfers: if Elmvora is sold, merged or restructured, customer records may transfer as part of that transaction. Any recipient would be required to handle the information in line with this policy, and we'd tell you.
7. Transfers outside the UK
Some of our providers process personal information outside the United Kingdom.
Where a transfer is a restricted transfer under UK data protection law, we rely on UK adequacy regulations or on appropriate safeguards — in particular the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8. How long we keep it
| Data | Retention |
|---|---|
| Order and transaction records | 6 years — HMRC requirement |
| Account information | Until you close your account |
| Marketing contacts | Until you unsubscribe |
| Customer support correspondence | 2 years after the matter closes |
| Website analytics | 26 months |
| Fraud prevention records | 3 years |
Where a dispute or legal claim is live, the relevant records are kept as long as necessary. Otherwise they're deleted, anonymised or securely disposed of.
9. Your rights
Under UK data protection law you have the right to:
- Access the personal information we hold about you
- Rectification of anything inaccurate or incomplete
- Erasure, where we're not required to keep it
- Restriction of how we process it
- Data portability — receive your information in a common electronic format
- Object to processing based on legitimate interests, and always to direct marketing
- Withdraw consent at any time, where consent is the basis
- Not be subject to decisions based solely on automated processing that produce legal effects
Some rights are subject to conditions and exemptions.
To exercise a right, email support@elmvora.com. We may ask you to confirm your identity, usually by checking details of a recent order.
We respond within one month. Where a request is complex, we may extend that by a further two months and will tell you within the first month. Exercising your rights costs nothing, and we won't treat you differently for doing so.
10. Security
We use appropriate technical and organisational measures to protect personal information against unauthorised access, unlawful processing, accidental loss, destruction and alteration.
These include SSL/TLS encryption across the site, restricted internal access, and payment handling through a PCI-DSS compliant provider so card details never reach our systems.
No method of transmission or storage is completely secure, and we won't claim otherwise.
Where a personal data breach is likely to result in a high risk to your rights, we'll inform you without undue delay and report it to the Information Commissioner's Office, as the law requires.
11. Children
Our website and products are intended for adults. We don't knowingly collect personal information from children under 13.
If you believe a child has provided us with personal information, contact support@elmvora.com and we'll review it and delete it where required.
12. Third-party websites and advertising
Our site may link to websites and services operated by others, and may display third-party advertising. These operate independently of Elmvora and have their own privacy policies.
We're not responsible for the content, accuracy, security or privacy practices of third-party sites. Please review their policies before providing anything to them.
13. Complaints
If you have a concern about how we handle your personal information, contact us first — we usually resolve things directly, and we acknowledge complaints within five working days.
If you're not satisfied with our response, you have the right to complain to:
Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF 0303 123 1113 · ico.org.uk
14. Changes to this policy
We may update this policy to reflect changes in our business, the services and technologies we use, our data-processing practices, or legal requirements.
The current version is always on this page with the date at the top. Where a change materially affects how we process your information, we'll take any additional steps the law requires.
15. Contact us
| Company name | Elmvora LTD |
| Business address | St Nicholas Avenue, Fulford, York YO19 4TA, United Kingdom |
| support@elmvora.com | |
| Phone | +44 1904 682700 |
| Monday–Saturday | 9:00 am–6:00 pm UK time |
| Sunday and public holidays | Closed |