Privacy policy

Privacy Policy

Last updated: 8 June 2026

ZYVERO ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share and safeguard your personal information when you visit zyvero.co.uk, place an order, or otherwise interact with us. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the UK Data Protection Act 2018, the EU General Data Protection Regulation (Regulation (EU) 2016/679, "EU GDPR" / "RGPD") and the Spanish Organic Law 3/2018 on Personal Data Protection (LOPDGDD).

1. Who we are (Data Controller)

  • Trading name: ZYVERO (legal entity name pending registration).
  • Registered address: Calle Río Padrón 22, 29651 Fuengirola, Málaga, Spain.
  • Tax ID (NIF): available on written request.
  • Privacy contact: privacy@zyvero.co.uk.

2. Personal data we collect

  • Identification & contact: full name, billing address, delivery address, email, phone number.
  • Order & transaction: products ordered, order value, order history, returns, invoices.
  • Payment: payment confirmation, last four digits of card and brand. We never store full card numbers — these are processed by PCI-DSS-compliant gateways (Shopify Payments, PayPal).
  • Account: username, password (hashed), saved addresses, wishlist, preferences.
  • Communications: emails, chat messages, customer-service tickets.
  • Technical & usage: IP address, device and browser type, pages visited, referring URL, cookies and similar technologies (see Section 10 and our Cookies Policy).
  • Marketing: consent status, opt-in date, segmentation tags.

3. Purposes and legal bases of processing

Under Article 6 of the UK GDPR / RGPD we rely on the following legal bases:

  • Performance of a contract (Art. 6.1.b): processing orders, payments, shipping, returns and customer support.
  • Legal obligation (Art. 6.1.c): keeping accounting records (UK Companies Act / Spanish Código de Comercio Art. 30), tax records, complying with consumer-protection law and lawful requests from authorities.
  • Legitimate interest (Art. 6.1.f): fraud prevention, network security, analytics on aggregated data, defending legal claims, and product improvement. Our balancing assessment is available on request.
  • Consent (Art. 6.1.a): marketing communications by email or SMS, non-essential cookies (analytics, advertising), and any future use of biometric or special-category data. Consent can be withdrawn at any time without affecting prior lawful processing.

4. Recipients and processors

We share personal data only with the processors strictly required to deliver our service. Each is bound by a data-processing agreement under Article 28 GDPR.

  • E-commerce platform: Shopify International Ltd (Ireland) and Shopify Inc. (Canada).
  • Payment processing: Shopify Payments, PayPal (Europe) S.à.r.l. et Cie, S.C.A.
  • Carriers: Royal Mail, DHL Express, UPS, Correos, Seur, GLS — depending on destination.
  • Email and marketing: Shopify Email, and any consented third-party provider disclosed at sign-up.
  • Analytics: Shopify Analytics; Google Analytics 4 only with your cookie consent.
  • Tax and accounting: external accountant and the UK HMRC / Spanish Agencia Tributaria, when legally required.

We do not sell your personal data to third parties.

5. International data transfers

Some processors are located outside the United Kingdom and the European Economic Area (EEA), including Canada and the United States. Transfers are safeguarded by:

  • European Commission and UK adequacy decisions where available (e.g. Canada PIPEDA-covered organisations, EU–US Data Privacy Framework participants).
  • Standard Contractual Clauses (SCCs) approved by the European Commission and the UK International Data Transfer Addendum (IDTA), where adequacy does not apply.
  • Supplementary technical and organisational measures (encryption in transit and at rest, access controls).

A copy of the safeguards in place can be requested at privacy@zyvero.co.uk.

6. Retention

  • Order and invoicing data: 6 years (UK Companies Act 2006 s.388) or 6 years (Spanish Código de Comercio Art. 30) — whichever is longer.
  • Customer account: until you delete the account, then 30 days for recovery and a further 3 years in encrypted backup for legal-defence purposes.
  • Marketing consent records: while consent is active plus 3 years after withdrawal (limitation period for ICO / AEPD claims).
  • CCTV / fraud logs / IP logs: 12 months maximum.
  • Cookie consent records: 13 months from acceptance, then re-prompted.

7. Your rights

Subject to applicable law, you have the right to:

  • Access (UK GDPR Art. 15 / RGPD Art. 15) — obtain a copy of your data.
  • Rectification (Art. 16) — correct inaccurate data.
  • Erasure (Art. 17) — "right to be forgotten".
  • Restriction (Art. 18) of processing.
  • Portability (Art. 20) — receive your data in a structured machine-readable format.
  • Object (Art. 21) — including to direct marketing at any time.
  • Withdraw consent (Art. 7.3) at any time.
  • Not be subject to automated decision-making (Art. 22). We do not carry out solely automated decisions producing legal effects.
  • Lodge a complaint with a supervisory authority — the UK Information Commissioner's Office (ico.org.uk) or the Spanish Agencia Española de Protección de Datos (aepd.es).

To exercise any right, email privacy@zyvero.co.uk. We respond within 30 days (extendable to 90 days for complex requests).

8. Security

We implement appropriate technical and organisational measures including TLS encryption, hashed passwords, segregated access, two-factor authentication on admin accounts, and routine security reviews. No system is 100 % secure: in the unlikely event of a personal-data breach affecting your rights and freedoms, we will notify the competent authority within 72 hours and inform you without undue delay where legally required.

9. Children

Our store is not directed at children. We do not knowingly collect personal data from anyone under 13 (UK) or 14 (Spain). Where we discover such data, we delete it.

10. Cookies

We use cookies and similar technologies in accordance with the UK Privacy and Electronic Communications Regulations 2003 (PECR) and Spanish LSSI-CE Article 22.2. Strictly necessary cookies are placed without consent; all others require your opt-in via the cookie banner. See our full Cookies Policy.

11. Marketing communications

We send marketing emails only with prior opt-in consent. Every email contains a one-click unsubscribe link. You can also email privacy@zyvero.co.uk to opt out.

12. Changes to this Privacy Policy

We may update this policy from time to time. Material changes will be notified by email and/or a prominent banner on the website. The "Last updated" date at the top reflects the latest revision.

13. Contact

For any privacy-related question or to exercise your rights: privacy@zyvero.co.uk or by post to ZYVERO — Privacy, Calle Río Padrón 22, 29651 Fuengirola, Málaga, Spain.