Privacy Notice

Payments

Stripe processes payment and payment-method data through its own hosted checkout. This website never receives, stores or transmits card or bank details. Stripe acts as an independent controller for its own fraud-prevention and regulatory purposes.

Data this website collects

• Contact form: name, email, message and optional phone. Purpose: responding to enquiries. Provisional lawful basis: legitimate interests (a Legitimate Interests Assessment is to be confirmed by the controller). Retention: deleted within 12 months of the matter closing unless a legal, accounting, fraud or dispute reason requires longer.
• Update subscription: email, preferred language, consent timestamp, consent-wording version and unsubscribe status. Purpose: project and launch updates. Lawful basis: consent. Retention: until consent is withdrawn, plus a minimal suppression record.
• Public acknowledgement (optional, default anonymous): chosen display name only, never the contribution amount. Lawful basis: consent, withdrawable at any time.
• Customer account (optional): email address, password (stored only as a secure hash by our authentication provider), optional full name, preferred language, marketing preference and the gift cards linked to the account. Purpose: letting you view your gift cards, balances and history in one place. Lawful basis: contract (account provision) and consent (marketing emails). Retention: until you ask us to delete the account; gift-card records themselves are kept for the legal and accounting periods set out below.
• Gift-card claim attempts: the last four characters of the code entered, the outcome and the time, kept as an anti-abuse security measure. Lawful basis: legitimate interests (fraud prevention). Retention: 12 months.

Recipients and processors

Stripe and PayPal (payment processing). Resend (delivery of gift-card and transactional emails). Supabase (secure database hosting for gift-card records and purchase details) and the site's hosting provider (website delivery and security logs). Contact-form messages are sent to standard business email and are not stored by a separate third-party form service. No advertising networks, data brokers or profiling services receive your data.

International transfers

Stripe and other providers may process personal data outside the United Kingdom. Transfers rely on UK adequacy regulations where available, otherwise the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. This section will be updated when the remaining providers are confirmed.

Security

Reasonable technical and organisational measures are used, including encryption in transit, restricted administrative access and secrets held only in server-side environment variables. No system can be guaranteed to be absolutely secure, and no such guarantee is given.

Your rights

• Access, rectification and erasure
• Restriction of processing and objection to processing
• Withdrawal of consent at any time, without affecting prior processing
• The right to complain to the UK Information Commissioner's Office (ICO)

Regulatory registration

The controller will complete the ICO self-assessment and register and pay the data-protection fee unless a documented exemption applies.

International order fulfilment

The data controller is DIVAFASHION LTD (company no. 16932732). To deliver shop orders we share your name, address, email and order details with our fulfilment and shipping partners in Türkiye and with couriers and customs authorities. This may transfer your data outside the UK, with appropriate safeguards under UK data-protection law.

Processors we rely on include PayPal (payments), Supabase (hosting and database), Resend (email) and shipping carriers. Order, accounting and legal records are retained for as long as the law requires.

You have the right to access or delete your data and to complain to the UK Information Commissioner's Office (ICO).