Privacy policy

ProVenience Supplies Ltd is the data controller for the personal data described here. We are registered with the Information Commissioner's Office. This policy covers this website and the orders placed through it.

What we collect

• Order and account data — your name, email address, delivery and billing addresses, phone number, order history and any notes you leave for the courier.
• Payment data — handled by our payment provider. Card numbers never reach our servers; we store only the last four digits and the card type so you can recognise a past order.
• Messages you send us — anything you put in the contact form, an email or a phone call we make a note on.
• Technical data — the IP address, device and browser your request arrives with, which any web server sees and our host logs to keep the site online and defend it against attack. We do not currently run analytics, so there is no record of the pages you browsed tied to you.
• Things kept on your device — your basket, your signed-in session, your saved addresses and order history, and your wishlist. These stay in your browser and are not transmitted to us.
• A basket identifier we do receive — one cookie, provenience_cart_id, holding a meaningless string that points at your basket on our side. Unlike the items above it is sent to our server with every request, because a page rendered on our side has no other way to tell whose basket it is. It carries no personal data and is not used to profile or track you. Both groups are set out in full on the cookies page.

We do not collect special category data, and we do not ask for any.

Why we use it, and on what basis

• To take and deliver your order — because we need to in order to perform our contract with you.
• To answer your questions and handle returns — contract, and our legitimate interest in running a shop people can talk to.
• To keep the site working, secure and free of fraud — our legitimate interest, balanced against how little of it identifies you personally.
• To meet our legal obligations — tax and accounting records in particular.
• To send marketing — only with your consent, which you can withdraw in one click from any message we send.

Cookies and similar technologies

Two groups. Most of what the shop keeps — your basket, your session, your saved addresses, your wishlist — stays in your browser and never reaches us. One cookie, provenience_cart_id, does reach us: it holds an identifier for your basket, nothing else, and it is sent with every request so a page built on our server knows whose basket to show. Both are strictly necessary and neither is shared or sold.

We run no analytics, no advertising or retargeting tags, and no third-party tracking scripts. There is no consent manager yet because nothing we store requires consent; one goes in before anything non-essential is ever added. Full detail on the cookies page.

Who we share it with

Only the organisations that make an order happen, and only the parts of your data they need:

• Couriers and delivery partners — name, address, phone number.
• Our payment provider — the payment details you enter with them.
• Our hosting and email providers, as data processors under contract.
• HMRC and other authorities, where the law requires it.

We do not sell personal data, and we do not share it for anyone else's marketing.

Where it is stored

Our systems are hosted within the UK and the European Economic Area. Where a processor operates outside that area, the transfer is covered by the UK's International Data Transfer Agreement or equivalent safeguards.

How long we keep it

• Order and invoice records: seven years, because tax law requires it.
• Account details: until you close your account, then 30 days.
• Contact form messages: two years, so we can pick up a thread you started.
• Marketing consent records: for as long as you are subscribed, and two years after you unsubscribe so we can prove you did.

Your rights

Under UK GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to have it sent to another provider. Withdrawing consent is always as easy as giving it. Ask us and we will respond within one calendar month.

If you think we have got it wrong, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can fix it.

Changes to this policy

We update this page when what we do with data changes. The date it last changed is shown at the top of the page.