Privacy Policy

This policy explains how PVRA Ltd collects and uses your personal information when you visit pvramat.com, buy from us or contact us.

Who we are

PVRA Ltd ("PVRA", "we", "us") is the controller of the personal information described in this policy.

• Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
• Company number: 15781106 (registered in England and Wales)
• Contact: support@pvramat.com

What we collect

• Order and account details: name, email address, phone number (optional), delivery and billing addresses, order history, and any messages you send us.
• Payment information: handled by Shopify Payments and our other payment providers. We never see or store your full card number.
• Device and usage information: IP address, browser and device type, pages and products viewed, basket activity, the site that referred you, and cookie identifiers. We only collect this as described under "Cookies and similar technologies".
• Marketing preferences: whether you've subscribed to our emails, and how you interact with them.
• Reviews: if you choose to leave a product review, your name, your review and any photos you upload.

Why we use it, and our lawful bases

Purpose	Lawful basis (UK GDPR)
Processing and delivering your order, returns, refunds and customer support	Performance of a contract
Order emails (confirmation, shipping updates, changes to your order)	Performance of a contract
Preventing fraud, securing payments and protecting our website	Legitimate interests
Keeping legal, tax and accounting records	Legal obligation
Analytics: measuring how our website is used (Google Analytics, Judge.me)	Consent, given through our cookie banner
Advertising and ad measurement on Meta (Facebook/Instagram) and Google, including the Meta Pixel, Meta Conversions API and Google tags	Consent, given through our cookie banner
Marketing emails	Consent. We only send these if you tick "Email me with news and offers" at checkout or sign up on our website. Every email has an unsubscribe link.
Publishing a review you submit	Consent

Who we share it with

We share personal information only with the following, and only as needed for the purposes above:

• Shopify, our e-commerce platform, for hosting, checkout and payments. For UK merchants this is Shopify International Limited (Ireland), working with other Shopify group companies including Shopify Inc. (Canada). Shopify mainly acts as our processor. For some of its own services it acts as an independent controller; see Shopify's privacy policy.
• Meta Platforms, Inc. (Facebook and Instagram), only if you accept marketing cookies. We send website and checkout events, such as product views, add to basket, checkout started and purchases, through the Meta Pixel and the Meta Conversions API. This can include hashed (scrambled) contact details. We use it to measure and improve our advertising. Under Meta's Business Tools terms, PVRA and Meta are joint controllers only for the collection and transmission of this event data to Meta. Once Meta receives it, Meta processes it as an independent controller under its own privacy policy, which explains how Meta uses it and how to exercise your rights with Meta. We are not a joint controller of Meta's further processing.
• Google LLC, for website analytics (Google Analytics) and ad measurement, only if you accept the relevant cookies. Google Consent Mode is used to respect your choices.
• Klaviyo, Inc., for marketing emails and website sign-up forms.
• Judge.me Ltd, for product reviews. Its analytics only run if you accept analytics cookies.
• Zipify, LLC, which shows an optional offer after you complete checkout.
• Our fulfilment partner (a UK warehouse) and delivery carriers, who receive your name, address, phone number and order details so they can deliver your order.
• Professional advisers, and courts, regulators or law enforcement, where we are legally required to share information or need it to establish or defend legal claims.

We do not sell your personal information.

International transfers

Some of these providers process personal information outside the UK. When that happens, they rely on safeguards recognised under UK data protection law. As described in each provider's own data-processing terms, these are:

• Shopify: UK adequacy regulations, including for the EEA and for commercial organisations in Canada, and Standard Contractual Clauses with the UK Addendum.
• Google and Klaviyo: the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework), which both state they are certified under, with Standard Contractual Clauses and the UK Addendum as a fallback.
• Meta: the data transfer terms in Meta's Business Tools terms for UK data.
• Judge.me: UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, or Standard Contractual Clauses, as set out in its data processing addendum.
• Zipify: Standard Contractual Clauses with the UK Addendum.

To request more information about these safeguards, email support@pvramat.com.

Cookies and similar technologies

The first time you visit, our cookie banner lets you Accept, Decline or Manage preferences.

• We don't load Meta, Google or Klaviyo tracking, or set analytics or advertising cookies, unless you accept them.
• Judge.me's review analytics also run only with your analytics consent.
• Strictly necessary cookies (for your basket, checkout, security, and remembering your cookie choice) are always set.
• You can change your choice at any time using "Cookie preferences" in the website footer. Withdrawing consent stops further tracking. To remove cookies that were already set, clear them in your browser.

How long we keep it

• Orders and accounting records: 6 years from the end of the financial year they relate to, as required by HMRC.
• Customer support emails: 2 years after your enquiry is closed. We keep them longer only where we need to for an ongoing dispute, a legal claim or a legal obligation.
• Marketing data: until you unsubscribe. After that we keep a minimal suppression record so we don't email you again.
• Google Analytics data: 14 months, then deleted automatically.
• Data sent to Meta: kept by Meta under its own policies, as an independent controller.

Your rights

Under UK data protection law you have the right to: - access the personal information we hold about you; - have it corrected, or erased; - restrict how we use it, or object to it, including objecting to direct marketing at any time; - receive it in a portable format; - withdraw your consent at any time. This doesn't affect anything we did before you withdrew it.

To use any of these rights, email support@pvramat.com. We'll respond within one month.

Complaints

If you're unhappy with how we've handled your information, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.

Changes to this policy

We'll update this policy when our practices change, and the date below will show when it was last updated.

Last updated: 29 October 2026