Privacy policy

Who is responsible

The controller for your personal data on this website is MISS SHORTHAIR LTD (AVELIQQ), 123 Eastern Avenue, Redbridge, Ilford, Essex, IG4 5AN, United Kingdom, e-mail support@aveliqq.shop. We process personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for visitors in the European Economic Area, the EU General Data Protection Regulation (GDPR).

What we collect and why

Situation	Data	Purpose	Legal basis
Placing an order	Name, billing and delivery address, e-mail, phone (optional), items, order and payment status	Processing, delivering and supporting your order; returns and refunds	Contract (Art. 6(1)(b))
Keeping records	Order and invoice data	Tax and accounting obligations	Legal obligation (Art. 6(1)(c))
Customer account (optional)	Login e-mail, password (encrypted), saved addresses, order history	Giving you access to your orders and faster checkout	Contract (Art. 6(1)(b))
Contact and withdrawal forms, e-mail	Name, e-mail, order number, your message	Answering you; handling withdrawals and complaints	Contract or steps before a contract (Art. 6(1)(b)); legal obligation for withdrawals (Art. 6(1)(c))
Visiting the website	IP address, browser type, pages requested, date and time (server logs)	Running the site securely, preventing abuse	Legitimate interests (Art. 6(1)(f))
Payment	Payment method, transaction ID, fraud-check result (we never receive full card numbers)	Taking payment, preventing fraud	Contract (Art. 6(1)(b)); legitimate interests in fraud prevention (Art. 6(1)(f))

We don’t use your data for advertising, we don’t build marketing profiles and we don’t send newsletters. We don’t sell or share personal information for cross-context behavioural advertising.

Who we share data with

• Hosting: Hostinger International Ltd. hosts this website and stores its database on our behalf (processor).
• Payments: Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.) processes card, Apple Pay and Google Pay payments; PayPal (Europe) S.à r.l. et Cie, S.C.A. processes PayPal payments. They receive the data needed for the payment and fraud prevention and act partly as independent controllers under their own privacy policies.
• Delivery: the carrier delivering your parcel receives your name, delivery address and, where needed for delivery notifications, your e-mail or phone number.
• E-mail: our e-mail provider processes messages you send us and order e-mails we send you (processor).
• Authorities and advisers: where the law requires it, for example tax authorities, or our accountants under confidentiality.

International transfers

We are based in the United Kingdom. The UK and the EU recognise each other’s data protection as adequate. Some service providers (for example Stripe and PayPal) may process data in the United States; such transfers are protected by adequacy decisions (such as the EU-US Data Privacy Framework and the UK extension) or standard contractual clauses.

How long we keep data

• Order and invoice data: for as long as tax and commercial law requires, generally 6 years in the UK (up to 10 years where EU rules apply to us).
• Customer accounts: until you ask us to delete the account; order records stay as described above.
• Messages and withdrawal declarations: 3 years after the matter is closed, unless needed longer for legal claims.
• Server logs: up to 30 days.

Cookies

We only use cookies and similar storage that are strictly necessary for the shop to work — for example your bag, your language and currency, login and secure payment. We don’t use analytics or advertising cookies. Details are in our Cookie policy.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict processing, to data portability and to object to processing based on legitimate interests. To use these rights, e-mail support@aveliqq.shop. We answer within one month.

You also have the right to complain to a data protection authority: in the UK the Information Commissioner’s Office (ico.org.uk), or the authority in the EU country where you live or work — for example the Datatilsynet in Denmark or the data protection authority of your German federal state.

Automated decisions

We don’t make decisions about you based solely on automated processing. Our payment providers run automated fraud checks on payments; if a payment is declined, you can contact us or the provider.

Security

The website uses HTTPS encryption. Payment details are entered in fields provided by our PCI DSS compliant payment providers and never reach our servers. Access to order data is limited to people who need it.

Children

Our shop is for adults. We don’t knowingly collect data from anyone under 16.

Changes

We update this policy when our processing changes. The date at the top shows the latest version.