Privacy policy

Who we are

Velvet Ore is a small jewellery studio selling direct to customers through this website. For the purposes of data protection law, Velvet Ore is the controller of the personal information described below. You can reach us at velvetore@mail.grokbot.com.

We sell one product through one checkout. That keeps the amount of data we handle small, and this policy is written to match what actually happens rather than to cover situations that do not.

What we collect

We collect only what is needed to take payment and deliver an order.

• Order details. The name, delivery address, email address and (where provided) telephone number you enter at PayPal checkout, together with the item, size and amount you paid.
• Payment confirmation. PayPal sends us a transaction record confirming that a payment was made, its amount, currency and status. We never see or store your card number, CVV or bank details. Those are entered on PayPal's own pages and are handled by PayPal, not by us.
• Correspondence. If you email us, we keep the message and our reply so we can resolve the question and refer back to it if you write again.
• Basic technical data. Our hosting provider records standard server information such as the requested page, the time of the request and the browser type. It is used to keep the site running and to diagnose faults, not to build a profile of you.

We do not ask for and do not want sensitive information. Please do not send us payment details by email.

Why we use it

• To fulfil your order — taking payment, packing and shipping the bracelet, and sending you the confirmation and tracking details. Without this information we cannot complete a sale.
• To answer you — responding to questions, and handling returns, refunds or a damaged delivery.
• To meet our legal and accounting obligations — keeping records of sales where the law requires it.
• To keep the site working — the server logs described above.

We do not sell your information, we do not rent it, and we do not use it for advertising. We do not send marketing email, because we do not run a mailing list; if that ever changes we will ask you first.

Who else is involved

Three kinds of provider handle data on our behalf, and only for the purposes above:

• PayPal — processes the payment and holds your transaction and card data under its own privacy policy. PayPal is the merchant of record for the payment itself.
• Shipping carriers and postal services — receive the name, address and telephone number needed to deliver the parcel and, where the service includes it, to send tracking updates.
• Our web host — stores these pages and keeps the server logs mentioned above.

We may also disclose information where we are legally required to do so, for example in response to a valid request from a tax authority or a court, or where it is necessary to establish or defend a legal claim. We do not share data with advertising networks or data brokers.

Some of these providers operate outside your country, including in the United States and China. Where your data is transferred internationally it is handled under the provider's own safeguards, and we only transfer what is necessary to complete your order.

Cookies and tracking

This site sets no advertising, analytics or tracking cookies, and it loads no third-party tracking scripts. That is why you are not being asked to dismiss a cookie banner — there is nothing to consent to.

Two things are worth knowing. First, when you click a buy button you leave this site for PayPal's checkout, and PayPal may set its own cookies on its own pages; those are covered by PayPal's cookie policy. Second, our font is served from Google Fonts, which receives the request for the font file, including the IP address your browser connects from. Fonts are cached by your browser after the first visit.

Your browser also stores ordinary technical data such as cached pages. You can clear this at any time through your browser settings without affecting an order you have already placed.

How long we keep it

• Order and payment records — kept for as long as tax and accounting rules require, and in any case no longer than six years after the sale.
• Email correspondence — kept for two years after the last message in the thread, then deleted.
• Server logs — kept briefly by our host, typically no more than a few weeks, then rotated out.

When a retention period ends we delete the data or, where deletion is not immediately possible in backups, we isolate it until it is overwritten in the normal course.

Your rights

Depending on where you live, you may have the right to ask us for a copy of the personal information we hold about you, to have inaccurate information corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. You may also have the right to complain to your local data protection authority.

To make a request, email velvetore@mail.grokbot.com with enough detail for us to identify your order. We answer within 30 days. We may need to confirm that the request comes from the person the data belongs to, and we will not ask for more than is needed to do that. Exercising these rights is free, and we will not treat a request as a reason to refuse you service.

Where we rely on your consent for anything, you can withdraw it at any time. Where we rely on a contract or a legal obligation, withdrawing consent does not undo processing that has already happened.

Children

This site sells adult jewellery and is not directed at children. We do not knowingly collect information from anyone under 16. If you believe a child has sent us personal information, write to us and we will delete it.

Security and changes

This site is served over HTTPS, and the only place payment details are entered is PayPal's own checkout. No system is perfectly secure, but keeping card data away from this site removes the most valuable thing a breach could expose.

If we change how we handle personal information we will update this page and move the date at the top. Material changes will be described here rather than made silently.

Contact

Questions about this policy, or about the information we hold: velvetore@mail.grokbot.com.