Privacy policy

Haven, trading as SOFALUX (UK) LTD (company number 08790862), operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). Haven is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use, store and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services, or otherwise communicate with us. It also explains your privacy rights and how you can exercise them under applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy will take precedence with respect to the collection, processing and disclosure of your personal information, subject to applicable law.

Please read this Privacy Policy carefully. By using or accessing any of the Services, you acknowledge that you have read this Privacy Policy. Where consent is required by law, we will seek your consent separately rather than treating access to the Services as consent to all forms of data processing.

Personal Information We Collect or Process

When we use the term "personal information", we mean information that identifies you or can reasonably be linked to you or another individual. Personal information does not include information that has been anonymised so that it can no longer identify an individual.

Depending on how you interact with the Services, where you live and as permitted or required by applicable law, we may collect or process the following categories of personal information:

• Contact details: Your name, billing address, delivery address, telephone number and email address.
• Financial and payment information: Payment method, payment card details, transaction details, payment confirmations and other information necessary to process payments. Payments may be processed securely by Shopify and our payment service providers. We may not have access to or store complete payment card details.
• Account information: Your username, password, account preferences, settings and other information associated with your customer account.
• Transaction information: Details of the products you view, add to your basket or wishlist, purchase, return, exchange or cancel, together with your order history and related transactions.
• Communications: Information you provide when contacting us, including customer service enquiries, feedback, complaints and other correspondence.
• Device information: Information about your device, browser, operating system, internet connection, IP address and other online identifiers.
• Usage information: Information about how and when you interact with the Services, including pages visited, products viewed, links clicked and other browsing activity.
• Marketing preferences: Your preferences for receiving marketing communications and, where applicable, information about your interactions with our advertising or promotional content.

We will only collect and process personal information where we have a lawful basis to do so and where the processing is necessary for the relevant purpose.

Personal Information Sources

We may collect personal information from the following sources:

• Directly from you: When you create an account, browse or use the Services, place an order, contact us, subscribe to marketing communications or otherwise provide information to us.
• Automatically through the Services: Through your device and browser when you visit or use our website, including through cookies and similar technologies where permitted by law.
• From our service providers: From organisations that provide services on our behalf, such as payment processing, website hosting, analytics, customer support, fulfilment and delivery.
• From our business partners and other third parties: Where they lawfully provide information to us in connection with our Services, advertising, payment processing or other business activities.

How We Use Your Personal Information

Depending on how you interact with us and which Services you use, we may process your personal information for the following purposes.

Providing, Tailoring and Improving the Services

We use personal information to operate and provide the Services, fulfil our obligations to you and improve your shopping experience. This may include:

• Processing and fulfilling orders and payments.
• Arranging delivery, returns, refunds and exchanges.
• Creating and managing customer accounts.
• Remembering your preferences and items in your basket.
• Sending order confirmations, delivery updates and other service-related notifications.
• Responding to customer enquiries and providing customer support.
• Enabling product reviews and customer feedback where available.
• Recommending products and personalising your shopping experience.
• Analysing website performance and improving our products, website and services.

Where necessary, we process personal information to perform our contract with you, take steps at your request before entering into a contract, pursue our legitimate interests or comply with legal obligations.

Marketing and Advertising

Where permitted by law, we may use your personal information to send marketing and promotional communications by email, text message or other channels, and to display advertisements for our products or services.

This may include information about products you have viewed, purchased or added to your basket, as well as your interactions with our website and promotional content.

Where required, we will obtain your consent before sending electronic marketing communications or using cookies and similar technologies for advertising purposes. You can withdraw your consent or opt out of marketing communications at any time using the unsubscribe option in our messages or by contacting us.

Opting out of marketing will not prevent us from sending essential non-marketing communications, such as order confirmations, delivery updates or important information about your account.

Security and Fraud Prevention

We may use personal information to verify transactions, authenticate accounts, protect payments, detect and investigate suspected fraud, prevent unlawful or harmful activity and maintain the security of our website and Services.

If you create an account, you are responsible for keeping your login credentials secure. We recommend that you do not share your username, password or other access details with anyone else.

Communicating with You

We use personal information to respond to your questions, manage customer service requests, resolve complaints, provide updates about your orders and maintain our relationship with you.

Legal and Regulatory Reasons

We may process personal information to comply with applicable laws and regulations, respond to lawful requests from public authorities, establish or defend legal claims, resolve disputes and enforce our terms, policies and legal rights.

Lawful Bases for Processing

Under the UK GDPR, we must have a lawful basis for processing your personal information. Depending on the circumstances, we may rely on the following bases:

• Contract: Where processing is necessary to fulfil an order or provide Services you have requested.
• Legal obligation: Where processing is necessary to comply with applicable laws, including accounting, tax and consumer protection requirements.
• Legitimate interests: Where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. These interests may include improving our Services, managing our business, preventing fraud and protecting our website.
• Consent: Where you have given consent for a specific purpose, such as certain marketing communications or the use of non-essential cookies.
• Vital interests or public tasks: Where applicable in the limited circumstances permitted by law.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

How We Disclose Personal Information

We may disclose your personal information to third parties where necessary for the purposes described in this Privacy Policy, subject to applicable law.

These recipients may include:

• Shopify and technology providers: To host and operate our website, maintain our systems, process data and provide the Services.
• Payment providers: To securely process payments, refunds and related transactions.
• Delivery and fulfilment providers: To prepare, dispatch and deliver orders and process returns.
• Analytics and customer support providers: To help us understand website usage, improve our Services and respond to customer enquiries.
• Advertising and marketing partners: Where we use these services to manage campaigns, measure advertising performance or show relevant advertisements, subject to applicable consent and opt-out requirements.
• Business partners and affiliates: Where necessary for legitimate business purposes and permitted by law.
• Professional advisers: Such as accountants, auditors, insurers and legal advisers, where reasonably necessary.
• Authorities and other third parties: Where disclosure is required by law, necessary to protect our rights or the rights of others, or connected with legal proceedings or a business transaction such as a merger, restructuring or sale of assets.

We do not disclose personal information to third parties without a lawful basis. Where third parties process personal information on our behalf, we take appropriate steps to ensure that suitable contractual and security safeguards are in place.

Relationship with Shopify

The Services are hosted by Shopify, which processes personal information relating to your access to and use of our store to provide, maintain and improve the Services.

Information you submit through our store may be transmitted to Shopify and to other service providers involved in operating the website, processing payments, fulfilling orders and providing related services. These providers may process information in countries outside the United Kingdom.

We may also use Shopify features that help us understand customer activity, improve our store, personalise the shopping experience and support marketing and advertising activities. The personal information used for these features and the applicable privacy arrangements will depend on the Shopify services and settings enabled on our store.

In certain circumstances, Shopify may process personal information for its own purposes and act as an independent controller. Shopify is responsible for handling requests relating to processing for which it acts as controller.

For further information about how Shopify processes personal information and the rights available to you, please consult Shopify's privacy resources:

• Shopify Privacy Policy: https://www.shopify.com/legal/privacy
• Shopify Privacy Portal: https://privacy.shopify.com/

Cookies and Similar Technologies

Our website may use cookies and similar technologies to operate the store, remember your preferences, maintain your basket, understand how visitors use the website and, where enabled, support analytics and advertising.

Some cookies are necessary for the website to function. Other cookies, including certain analytics and advertising cookies, may require your consent under applicable law.

Where required, we will provide a cookie banner or preference tool that allows you to manage your choices. You can also manage cookies through your browser settings, although disabling certain cookies may affect the functionality of our website.

The cookies and similar technologies used on our store may change depending on the features, applications and services we use. Further information should be provided in our cookie settings or any separate Cookie Policy available on the website.

Third-Party Websites and Links

The Services may contain links to websites, applications or online platforms operated by third parties. If you follow a link to a service that we do not control, you should review its privacy policy, security practices and terms and conditions.

We are not responsible for the privacy, security, accuracy or reliability of third-party websites or services. Any information you provide directly to those third parties will be handled in accordance with their own policies.

Our inclusion of a link does not necessarily imply that we endorse the third-party website, its owner or its content.

Children's Data

The Services are intended for a general shopping audience and are not directed at children. We do not knowingly collect personal information from children where doing so would be contrary to applicable law.

If you are a parent or legal guardian and believe that a child has provided us with personal information inappropriately, please contact us using the details below. We will review the matter and take appropriate steps, including deleting the information where required by law.

Security and Retention of Your Information

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security. You should avoid sending sensitive or confidential information through unsecured communication channels.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, maintain customer accounts, fulfil orders, resolve disputes, prevent fraud and comply with legal, accounting and regulatory obligations.

The appropriate retention period depends on the nature of the information, the purpose of processing and any applicable legal requirements. When personal information is no longer required, we will take appropriate steps to delete it or anonymise it, subject to applicable law.

Your Rights and Choices

Depending on your location and the circumstances of the processing, you may have rights in relation to your personal information under applicable data protection law.

These may include the following rights.

Right of Access

You may request confirmation of whether we process your personal information and obtain a copy of the information we hold about you, together with certain information about how we use it.

Right to Rectification

You may ask us to correct personal information that is inaccurate or incomplete.

Right to Erasure

You may ask us to delete your personal information in certain circumstances. This right is subject to exceptions, including where we need to retain information to comply with legal obligations or establish or defend legal claims.

Right to Restrict Processing

You may ask us to restrict the processing of your personal information in certain circumstances.

Right to Data Portability

Where applicable, you may request a copy of personal information you have provided to us in a commonly used, machine-readable format and ask us to transfer it to another organisation, where the legal requirements for this right are met.

Right to Object

You may object to certain processing activities, including processing based on our legitimate interests. You have an absolute right to object to the use of your personal information for direct marketing.

Right to Withdraw Consent

Where we rely on your consent, you may withdraw it at any time. This will not affect processing carried out lawfully before your consent was withdrawn.

Managing Marketing Preferences

You can opt out of promotional emails by using the unsubscribe link in the email. If you receive marketing text messages, you can follow the instructions provided in those messages where available or contact us directly.

Even if you opt out of marketing, we may continue to send essential communications relating to purchases, deliveries, refunds, accounts or other transactions.

How to Exercise Your Rights

You can exercise your rights by contacting us using the details provided in the Contact section below.

We may need to verify your identity before responding to a request. Where permitted by law, we may refuse or limit a request if an applicable exemption applies. We will respond within the time limits required by applicable law.

You will not be discriminated against for exercising your data protection rights.

If you are acting on behalf of another person, we may ask you to provide evidence that you are authorised to make the request.

For information about rights relating to personal information processed by Shopify in its own capacity, please consult Shopify's privacy resources.

Complaints

If you have concerns about how we collect, use or handle your personal information, please contact us first using the details provided below so that we can investigate and respond.

If you are in the United Kingdom, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:

Information Commissioner's Office
Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113

If you are located in the European Economic Area, you may be able to complain to the data protection supervisory authority in your country of residence, place of work or the place of the alleged infringement.

International Transfers

Your personal information may be transferred to, stored in or processed in countries outside the United Kingdom, including countries where Shopify and our service providers operate.

Where a transfer is subject to UK data protection law, we will take appropriate steps to ensure that the transfer complies with applicable legal requirements. Depending on the circumstances, these safeguards may include transferring information to a country recognised as providing an adequate level of protection, using an applicable international data transfer agreement or addendum, or relying on another lawful transfer mechanism.

You may contact us for further information about the safeguards applicable to relevant international transfers, subject to applicable law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our business practices, website features, service providers, legal obligations or regulatory requirements.

Any updated version will be published on this page, with the "Last updated" date amended accordingly. Where required by law, we will provide additional notice of material changes.

We encourage you to review this Privacy Policy periodically to remain informed about how we handle personal information.

Contact

If you have any questions about this Privacy Policy, our privacy practices or wish to exercise your data protection rights, you can contact us using the details below.

Trading name: Haven
Legal entity: SOFALUX (UK) LTD
Company number: 08790862
Registered office: 38–40 Waingate, Sheffield, South Yorkshire, S3 8LB, United Kingdom
Email: havensofas@use.startmail.com

For the purposes of applicable data protection law, SOFALUX (UK) LTD is the data controller responsible for the personal information processed in connection with Haven, except where another organisation acts as a controller in its own right.