1) Who we are & contacts

Controller: FERNROCK LIMITED, trading as “Tolvia”, is responsible for deciding how and why your personal data is processed when you use our website, place an order or contact us. In this Privacy Policy, “Tolvia”, “we”, “us” and “our” refer to FERNROCK LIMITED.

As the controller, we are responsible for ensuring that personal data is handled lawfully, fairly and transparently. We use personal data mainly to operate our online store, process orders, arrange delivery, manage customer support, prevent fraud, comply with legal obligations and improve the website.

We have not appointed a Data Protection Officer. Privacy queries, data rights requests and questions about this policy should be addressed to info@tolvia.co.uk.

When to contact us

You can contact us if you want to access your data, correct your details, unsubscribe from marketing, ask how your information is used, report a privacy concern or request deletion where applicable. To protect your account and personal data, we may need to verify your identity before responding to certain requests.

2) Scope & updates

This notice applies to our website, online store, customer accounts, checkout process, customer support communications, returns, refunds, warranty claims, marketing communications, analytics, fraud prevention and other services connected with tolvia.co.uk.

This policy applies whether you browse the website without purchasing, create an account, place an order as a guest, contact us by email or phone, submit a review, subscribe to marketing or otherwise interact with our services.

We may update this Privacy Policy from time to time to reflect changes in our website, services, technologies, legal obligations, business operations or data protection practices. If changes are material, we will take reasonable steps to notify you, for example by a site banner, updated notice or email where appropriate.

The latest version date appears at the top of this page. We encourage you to review this policy periodically so that you remain informed about how we process personal data.

3) Data we collect

The personal data we collect depends on how you use the website. We collect information needed to provide the store, process your order, communicate with you, comply with our obligations, protect our services and improve the customer experience.

Account and checkout information

When you create an account or place an order, we may collect your name, email address, phone number, billing address, delivery address, order contents, shipping method, order notes and other details required to process the transaction and deliver the goods.

Payment-related information

We do not store full card numbers or CVV codes on our servers. Card payments are handled by secure third-party payment providers. We may receive limited payment information, such as transaction references, payment status, card type, last four digits, expiry month/year where applicable and fraud-prevention signals.

Support and service information

If you contact us, we may keep a record of your message, email address, phone number, order number, attachments, photos, delivery information, return details or warranty claim details so that we can respond and maintain an appropriate service record.

Technical and browsing information

When you use the website, we may collect technical information automatically through cookies, server logs, analytics tools and security tools. This helps us operate the website, remember your preferences, detect errors, understand site performance and protect against fraud or misuse.

We do not intentionally collect special category data, such as health information, biometric data, religious beliefs or political opinions. Please do not include sensitive personal information in free-text fields, order notes, support messages or reviews unless it is strictly necessary.

4) Where data comes from

Most personal data we process is provided directly by you or generated when you use the website. Some information may also be received from trusted service providers who help us operate the store, process payments, deliver products, prevent fraud or analyse website performance.

• Directly from you when you use checkout, create an account, fill in forms, contact support, submit reviews, subscribe to marketing or provide information during returns and warranty processes.
• Automatically through cookies, pixels, server logs and similar technologies when you browse our site, interact with pages, use the basket or complete checkout.
• From service providers such as payment gateways, fraud prevention tools, delivery carriers, hosting providers, analytics platforms, customer support tools and marketing platforms.
• From banks or payment networks where relevant to payment authorisation, refunds, failed payments, fraud prevention, chargebacks or disputes.
• From delivery partners where they provide tracking updates, delivery confirmations, failed delivery notices or return-to-sender information.

We may combine information from these sources where necessary to process an order, resolve an issue, prevent fraud, maintain accurate records or comply with legal obligations.

5) Purposes & lawful bases

UK GDPR requires us to have a lawful basis for processing personal data. The table below explains the main purposes for which we process personal data and the lawful bases we rely on.

Legitimate interests

Where we rely on legitimate interests, we balance our interests against your privacy rights. Our legitimate interests may include preventing fraud, securing the website, improving our services, maintaining business records, managing customer relationships and protecting our legal position.

Consent

Where we rely on consent, such as for certain analytics cookies, advertising cookies or marketing emails, you can withdraw consent at any time. Withdrawing consent does not affect processing that took place before withdrawal.

Contract necessity

Some information is required to fulfil your order. If you do not provide required checkout information, we may be unable to process payment, deliver products, provide customer support or complete your requested transaction.

Where we rely on consent, you can withdraw it at any time via cookie settings, browser settings or the unsubscribe link in emails.

6) Sharing & recipients

We may share personal data with trusted third parties where necessary to operate the website, process orders, take payments, deliver goods, provide support, prevent fraud, comply with law or protect our rights. We only share information that is reasonably required for the relevant purpose.

• Payment processing & fraud prevention providers, including card gateways, acquiring services, risk tools and chargeback handling providers.
• Logistics & fulfilment providers, including warehouses, couriers, postal operators, delivery partners and return processing services.
• IT, hosting & security providers, including web hosting, CDN, backup, monitoring, firewall, anti-abuse, performance and technical support services.
• Analytics & marketing providers, such as Google Analytics 4, Meta, Hotjar, email service providers and advertising measurement tools where used and permitted.
• Professional services, including accountants, auditors, legal advisers, insurers and compliance consultants.
• Authorities, regulators, courts or law enforcement where required by law, to respond to lawful requests or to enforce our terms and protect our rights.

Service providers

Our service providers are required to process personal data only for agreed purposes and to apply appropriate safeguards. Where required, we use contracts or data processing terms to protect personal data shared with suppliers.

Business changes

If our business is sold, reorganised, merged or transferred, personal data may be shared with advisers, prospective buyers or successor organisations where necessary and lawful. We will continue to protect your data in accordance with applicable law.

We do not sell personal data. We do not enable third parties to use your personal data for their own independent marketing purposes without your consent.

7) Cookies, analytics & advertising

We use cookies and similar technologies to operate our site, remember preferences, support checkout functionality, measure performance, understand how visitors use the website and, with your consent where required, personalise or measure advertising.

Cookies may be set by Tolvia or by third-party services we use, such as analytics, advertising, security, payment, hosting or performance tools. Some cookies are essential for the website to work properly, while others are optional and depend on your consent settings.

Types of cookies we may use

• Strictly necessary cookies: required for core functions such as basket, checkout, account login, security and consent management.
• Analytics cookies: help us understand website traffic, page performance, user journeys and technical issues.
• Advertising cookies: help measure campaigns, attribute conversions and support relevant advertising where consent is given.
• Preference cookies: remember choices such as currency, region, cookie preferences or display settings.

Managing cookies

You can manage cookie preferences through our cookie banner where available. You can also block or delete cookies using your browser settings. If you disable certain cookies, some website features may not function correctly.

Further details are set out in our Cookie Policy, including cookie categories, purposes and retention periods where applicable.

8) Payments

We accept Visa and Mastercard. Card payments are processed by our payment gateway provider using secure payment infrastructure. We do not store full card numbers or CVV codes on our servers.

We receive limited payment information needed to confirm payment, manage your order, issue refunds, investigate payment issues and comply with accounting and fraud-prevention obligations. This may include transaction IDs, payment status, card brand, masked card details, authorisation result and payment provider references.

Payment security

Payment providers may use encryption, tokenisation, fraud screening, Strong Customer Authentication, 3-D Secure, device checks and other security tools. Your bank or card issuer may also process personal data when authorising or declining a transaction.

Fraud prevention

To protect customers and our business, payment and order details may be checked for fraud risk. Orders may be held, cancelled or refunded if payment information appears suspicious, inconsistent, unauthorised or otherwise high risk.

Refunds and chargebacks

If a refund, payment dispute or chargeback occurs, we may process relevant order, payment, delivery and communication records to investigate and respond. Please see our Payment Policy and Return & Refund Policy for more information.

9) Data retention

We keep personal data only for as long as reasonably necessary for the purposes explained in this policy, including order fulfilment, customer support, legal compliance, accounting, fraud prevention, dispute handling and business administration.

Retention may vary

Actual retention periods may vary depending on the nature of the data, legal requirements, disputes, fraud prevention needs, warranty claims, accounting rules or whether you have asked us to delete certain information.

Deletion and anonymisation

When personal data is no longer needed, we may delete it, anonymise it or securely archive it. Anonymised data that can no longer identify you may be used for analytics, reporting and business planning.

10) Security

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction. Security measures are designed to reflect the nature of the data, the risks involved and the services we provide.

• HTTPS/TLS encryption for secure transmission of data between your browser and our website.
• Access controls, account permissions and least-privilege principles for administrative systems.
• Use of reputable hosting, CDN, firewall, monitoring and security tooling to mitigate abuse and fraud.
• Regular updates, backups and maintenance of website systems where applicable.
• Vendor due diligence and data processing terms with service providers where required.
• Fraud prevention, rate-limiting, bot protection and logging to help detect suspicious activity.

Your role in security

You should keep your account login details secure, use a strong password, avoid sharing your account, log out on shared devices and contact us if you believe your account or order information has been compromised.

No absolute guarantee

No method of transmission or storage is 100% secure. While we take reasonable steps to protect your data, we cannot guarantee that unauthorised access, cyber incidents or technical failures will never occur.

11) International transfers

Some service providers may be located outside the UK or EEA, or may use infrastructure located in other countries. This means personal data may be transferred internationally when necessary for website hosting, payment processing, analytics, customer support, security, marketing or other business operations.

Where personal data is transferred internationally, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations or other lawful transfer mechanisms.

Third-party platforms

Some analytics, advertising, payment, email or hosting providers may process data in countries outside the UK. Their processing may also be subject to their own privacy policies and technical safeguards.

Why transfers may be needed

International transfers may be necessary to provide reliable website services, process payments, send emails, measure performance, prevent fraud, maintain backups, deliver customer support or use specialist technology providers.

12) Your rights

Under UK GDPR, you have rights in relation to your personal data. These rights may depend on the circumstances, the type of data involved and the lawful basis for processing.

• Access your personal data and obtain a copy.
• Rectify inaccurate or incomplete data.
• Erase data in certain circumstances, sometimes called the “right to be forgotten”.
• Restrict processing in certain circumstances.
• Object to processing based on legitimate interests or to direct marketing.
• Data portability, where applicable, to receive certain data in a structured, commonly used and machine-readable format.
• Withdraw consent where processing relies on consent, such as analytics cookies, advertising cookies or marketing emails.

How to exercise your rights

To exercise your rights, contact info@tolvia.co.uk. Please provide enough information for us to identify you and understand your request. We may need to verify your identity before responding, especially where the request relates to account, order or payment information.

When rights may be limited

Some rights are not absolute. For example, we may need to keep certain order, invoice, payment, fraud-prevention or legal records even if you ask us to delete your data. We may also refuse or limit requests where permitted by law, such as where a request is manifestly unfounded, excessive or conflicts with legal obligations.

Marketing opt-out

You can unsubscribe from marketing emails using the unsubscribe link in the email or by contacting us. Service messages related to orders, payments, delivery, returns, security or legal notices may still be sent where necessary.

13) Complaints

If you have concerns about our data practices, please contact us first so that we can try to resolve the issue. You can contact us at info@tolvia.co.uk and include details of your concern, your contact information and any relevant order or account information.

You also have the right to complain to the UK supervisory authority:
Information Commissioner’s Office (ICO) — ico.org.uk.

What to include in a complaint

To help us review your concern, please include a clear description of the issue, the personal data involved, what outcome you are seeking and any relevant dates, emails or order numbers. We will review privacy complaints and respond within a reasonable timeframe.

14) How to contact us

If you have questions about this Privacy Policy, want to exercise your rights, update your information, unsubscribe from marketing, report a privacy concern or ask how your personal data is used, please contact us using the details below.

This Privacy Policy forms part of our Terms & Conditions and should be read alongside our Cookie Policy.