1) Who we are & contacts

Controller: FERNROCK LIMITED (trading as “Tolvia”).

We have not appointed a Data Protection Officer. Privacy queries should be addressed to info@tolvia.co.uk.

2) Scope & updates

This notice applies to our website, online store, customer support and marketing communications. We may update it from time to time. If changes are material, we will take reasonable steps to notify you (e.g., by site banner or email if appropriate). The latest version date appears at the top of this page.

3) Data we collect

We do not intentionally collect special category data. Please do not include sensitive personal information in free-text fields.

4) Where data comes from

• Directly from you (checkout, account, forms, support, reviews).
• Automatically via cookies, pixels and similar technologies when you browse our site.
• From service providers (e.g., payment gateway, fraud prevention, delivery carriers, analytics).

5) Purposes & lawful bases

Where we rely on consent, you can withdraw it at any time via cookie settings or the unsubscribe link in emails.

6) Sharing & recipients

We may share data with the following categories of recipients, strictly for the purposes above:

• Payment processing & fraud prevention (card gateway, risk tools, chargeback handling).
• Logistics & fulfilment (warehouses, couriers, delivery partners).
• IT, hosting & security (web hosting, CDN, backup, monitoring, firewall/anti-abuse).
• Analytics & marketing (e.g., Google Analytics 4, Meta, Hotjar, email service providers).
• Professional services (accountants, auditors, legal advisers).
• Authorities where required by law or to enforce our terms.

We do not sell personal data. We do not enable third parties to use your data for their own purposes without your consent.

7) Cookies, analytics & advertising

We use cookies and similar technologies to operate our site, measure performance and, with your consent, personalise ads. Details are set out in our Cookie Policy, including categories (strictly necessary, analytics, advertising) and retention.

8) Payments

We accept Visa and Mastercard. Card payments are processed by our payment gateway provider. We do not store full card numbers or CVV on our servers. We receive limited payment information (e.g., masked card details, transaction IDs) to confirm payment and manage your order.

9) Data retention

10) Security

• HTTPS/TLS encryption, access controls, least-privilege principles, regular updates and backups.
• Use of reputable hosting, CDN and security tooling to mitigate abuse and fraud.
• Vendor due diligence and data processing terms with service providers.

No method of transmission or storage is 100% secure. We take reasonable steps to protect your data.

11) International transfers

Some service providers may be located outside the UK/EEA. Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or other lawful mechanisms.

12) Your rights

Under UK GDPR you have the right to:

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase data in certain circumstances (“right to be forgotten”).
• Restrict or object to processing, including direct marketing.
• Data portability (receive your data in a structured, commonly used format).
• Withdraw consent where processing relies on consent (e.g., analytics/ads cookies, marketing emails).

To exercise your rights, contact info@tolvia.co.uk. We may need to verify your identity before responding.

13) Complaints

If you have concerns about our data practices, please contact us first. You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office (ICO) — ico.org.uk.

14) How to contact us

This Privacy Policy forms part of our Terms & Conditions and should be read alongside our Cookie Policy.