Privacy policy

Introduction and Data Controller

This privacy policy explains how Hydrava ("we", "us" or "our") collects, uses, and protects your personal data when you visit or use our online store at hydravastore.myshopify.com, make a purchase, or otherwise communicate with us. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller:
Hydrava
565 Manchester Road
Manchester M27 9QL
United Kingdom
Email: contact@Hydrava.shop
Telephone: +447931081959

We are the data controller responsible for your personal information. This means we determine how and why your personal data is processed. If you have any questions about this privacy policy or how we handle your data, please contact us using the details above.

Personal Information We Collect or Process

When we use the term "personal information" or "personal data," we are referring to information that identifies or can reasonably be linked to you or another person. Personal information does not include information that is collected anonymously or that has been de-identified so that it cannot identify or be reasonably linked to you. We may collect or process the following categories of personal information, including inferences drawn from this personal information, depending on how you interact with our services, where you live, and as permitted or required by applicable law:

Contact details — including your name, address, billing address, shipping address, telephone number and email address.
Financial information — including credit card, debit card and financial account numbers, payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details. (Payment card data is handled directly by our secure payment processor and is not stored on our systems.)
Account information — including your username, password, security questions, preferences and settings (if you create an account with us).
Transaction information — including the items you view, put in your basket, add to your wishlist or purchase, return, exchange or cancel, and your past transactions.
Communications with us — including the information you include in communications with us, for example when sending a customer support enquiry, feedback or product review.
Device information — including information about your device, browser or network connection, your IP address and other unique identifiers.
Usage information — including information regarding your interaction with the services, including how and when you interact with or navigate our website, pages visited, time spent on pages, links clicked and search queries.
Marketing preferences — including your preferences for receiving marketing communications and details about your engagement with our marketing messages (e.g. email opens, clicks).
Cookie and tracking data — information collected via cookies, web beacons, pixels and similar technologies (see Cookies and Tracking section below).
Server logs and technical data — including browser type and version, time zone setting, operating system and platform, and other technology on the devices you use to access our site.

Personal Information Sources

We may collect personal information from the following sources:

Directly from you — when you create an account, visit or use our store, place an order, communicate with us, sign up for marketing, complete forms or surveys, post a review or otherwise provide us with your personal information.
Automatically through our website and services — from your device when you use our products or services or visit our website, and through the use of cookies and similar technologies (subject to your consent where required).
From our service providers — when we engage them to enable certain technology (such as our e-commerce platform, payment processing, email marketing, shipping and delivery) and when they collect or process your personal information on our behalf.
From our partners or other third parties — including advertising networks, analytics providers and social media platforms.
From publicly available sources — where permitted by law.

Lawful Bases for Processing and How We Use Your Personal Information

Under UK data protection law, we must have a lawful basis to process your personal data. Depending on how you interact with us or which of our services you use, we rely on the following lawful bases and use your personal information for the following purposes:

Performance of a Contract

Where you place an order with us, we process your personal data to perform our contract with you. This includes:

Processing your payments and fulfilling your orders;
Arranging for shipping and delivery (our standard delivery time is 3–5 working days; shipping within the United Kingdom is free of charge);
Processing purchases, returns, exchanges or other transactions;
Creating, maintaining and otherwise managing your account (if you choose to register);
Facilitating returns and exchanges under our returns policy (statutory 14-day cancellation right and voluntary 30-day return window from delivery);
Sending you transactional messages and notifications related to your account and orders (order confirmations, dispatch notifications, delivery updates);
Providing customer support and responding to your enquiries.

Legitimate Interests

We process certain personal data on the basis of our legitimate interests (or those of a third party), provided your rights do not override those interests. Our legitimate interests include:

Operating, maintaining and improving our website and online store;
Detecting, preventing and investigating fraud, security incidents, abuse and other harmful or illegal activity;
Protecting the security and integrity of our systems, networks and business operations;
Enforcing our terms and conditions and other legal rights;
Understanding how customers use our website and services through analytics and research, so we can improve user experience and optimise our offerings;
Administering and personalising the content and layout of our website;
Managing and resolving customer service issues and complaints;
Carrying out business administration, including record-keeping, accounting and financial management;
Establishing, exercising or defending legal claims;
Meeting our corporate and social responsibilities and complying with applicable laws and regulations;
Sharing data with third-party service providers who assist us in operating our business (e.g. hosting, payment processing, delivery, email platforms), subject to appropriate safeguards.

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and are satisfied that our use of your data is fair, necessary and proportionate.

Consent

In certain situations, we ask for your consent to process your personal data. This includes:

Setting and reading non-essential cookies and similar tracking technologies on your device (see Cookies and Tracking section below);
Sending you marketing communications by email or other electronic means (e.g. about new products, offers, promotions and events) where you have opted in or where we are otherwise permitted to do so under applicable law;
Collecting and using certain sensitive or special categories of data, if applicable.

Where we rely on your consent, you have the right to withdraw it at any time by contacting us or by using the unsubscribe link in marketing emails. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

Legal Obligation

We may process your personal data where necessary to comply with a legal obligation to which we are subject, including:

Complying with tax, accounting and regulatory requirements (e.g. HMRC, consumer protection laws);
Responding to lawful requests from courts, regulators, law enforcement or other public authorities;
Maintaining records for audit and compliance purposes;
Complying with health and safety obligations.

Vital Interests

In rare circumstances, we may process your personal data to protect your vital interests or those of another person (e.g. in a medical emergency).

Sharing Your Personal Information

We do not sell, rent or trade your personal information to third parties for their own marketing purposes. We may share your personal data with the following categories of recipients, who process it on our behalf or for their own legitimate purposes, subject to appropriate safeguards and in accordance with applicable law:

Service Providers and Processors

We engage trusted third-party service providers to perform functions and provide services on our behalf. These processors access your personal data only to perform tasks on our instructions and are obligated to keep your information secure and confidential. Categories of service providers include:

E-commerce platform and hosting: Our online store is hosted on Shopify Inc., a leading e-commerce platform provider based in Canada. Shopify provides us with the infrastructure to sell products online, process orders and manage customer data. Shopify processes your personal data as a processor on our behalf and also for its own legitimate purposes (e.g. fraud prevention, platform security). Shopify may store and process your data in Canada, the United States and other countries outside the United Kingdom. Shopify relies on Standard Contractual Clauses (SCCs) and other appropriate safeguards approved under UK GDPR for international data transfers. For more information, please see Shopify's privacy policy at https://www.shopify.com/legal/privacy.
Payment processors: We use secure third-party payment service providers to process card and other electronic payments. Your payment card details are transmitted directly to the payment processor using encryption and are not stored on our servers or Shopify's servers. Payment processors comply with the Payment Card Industry Data Security Standard (PCI DSS) and other applicable security standards.
Shipping and delivery providers: We share your name, delivery address and contact details with courier and logistics companies to fulfil your orders. Shipping within the United Kingdom is free of charge, and our standard delivery time is 3–5 working days.
Email and marketing platforms: We use email service providers to send transactional emails (order confirmations, dispatch and delivery notifications) and, where you have consented, marketing communications. These providers process your email address, name and engagement data (e.g. opens, clicks) on our behalf.
Customer service and communication tools: We may use platforms to manage customer enquiries, live chat, helpdesk ticketing and other communication channels.
Analytics and advertising partners: We use analytics services (e.g. Google Analytics) to understand how visitors use our website and to improve our services. We may also work with advertising networks and social media platforms to deliver targeted advertisements. These services may collect data via cookies and similar technologies, subject to your consent where required (see Cookies and Tracking section below).
Fraud prevention and security services: We may share data with third-party services that help us detect, prevent and investigate fraudulent transactions, security threats and other harmful activity.

Legal and Regulatory Authorities

We may disclose your personal data to courts, law enforcement, regulators, government agencies, tax authorities or other third parties where we believe disclosure is necessary:

To comply with a legal obligation, court order, subpoena or other lawful request;
To enforce our terms and conditions or other agreements;
To protect our rights, property or safety, or the rights, property or safety of our customers or others;
To detect, prevent or investigate fraud, security incidents or other illegal activity;
In connection with any legal proceedings or prospective legal proceedings.

Business Transfers

If we are involved in a merger, acquisition, asset sale, reorganisation, bankruptcy or similar business transaction, your personal data may be transferred to the purchaser or successor entity, subject to the same protections described in this privacy policy.

With Your Consent

We may share your personal data with other third parties where you have given us your specific consent to do so.

International Data Transfers

Your personal data may be transferred to, stored at, or processed in countries outside the United Kingdom, including Canada, the United States and other jurisdictions where our service providers operate. These countries may have data protection laws that differ from those in the UK.

Where we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place to protect your information and comply with UK GDPR. These safeguards include:

Adequacy decisions: Transferring data to countries that the UK Government has determined provide an adequate level of data protection (e.g. EEA countries, certain other jurisdictions recognised under UK adequacy regulations).
Standard Contractual Clauses (SCCs): Using the UK's approved Standard Contractual Clauses (also known as model clauses) — legally binding contracts that require the recipient to protect your personal data to UK standards.
Other approved mechanisms: Relying on binding corporate rules, certification schemes or other transfer mechanisms recognised under UK GDPR.

For example, Shopify (our e-commerce platform provider) processes data in Canada and the United States and relies on Standard Contractual Clauses and other safeguards. You may request further information about the safeguards we use for international transfers by contacting us using the details provided in this policy.

Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies (such as web beacons, pixels, tags and scripts) to collect and store information about your visit and use of our services. A cookie is a small text file that is placed on your device when you visit a website. Cookies help us recognise your device, remember your preferences, understand how you interact with our site, and improve your experience.

Types of Cookies We Use

We use the following categories of cookies:

Strictly necessary cookies: These cookies are essential for the operation of our website and enable core functionality such as security, network management, shopping basket, checkout and account access. You cannot opt out of these cookies, as the website would not function properly without them. The lawful basis for these cookies is our legitimate interest in operating a functional and secure website, and performance of our contract with you.
Performance and analytics cookies: These cookies collect information about how visitors use our website, such as which pages are visited most often, how long users spend on pages, and whether they encounter error messages. This information is aggregated and anonymous, and is used to improve how our website works and to understand user behaviour. We use services such as Google Analytics for this purpose. The lawful basis for these cookies is consent (where required) or legitimate interest.
Functionality cookies: These cookies allow our website to remember choices you make (such as your language preference, region or login details) and provide enhanced, more personalised features. The lawful basis for these cookies is consent or legitimate interest.
Targeting or advertising cookies: These cookies are used to deliver advertisements more relevant to you and your interests. They may be set by us or by third-party advertising networks and social media platforms (e.g. Facebook Pixel, Google Ads). They track your browsing activity across websites and build a profile of your interests to show you targeted ads. The lawful basis for these cookies is consent.

Managing Cookies and Your Consent

When you first visit our website, we will show you a cookie consent banner or pop-up allowing you to accept or reject non-essential cookies (performance, functionality and advertising cookies). You may withdraw or change