1. Who controls your personal data
The data controller is Aditya Dalvi trading as ArcVault Cards, 13 Albany Court, Stantonbury, Milton Keynes, MK14 6DN, United Kingdom. Privacy enquiries can be sent to enquiry@arcvaultcards.co.uk.
2. Personal data we may collect
Depending on how you use the store, this may include your name, email address, telephone number, delivery and billing address, account identifiers, order details, customer-service messages, stock-alert subscription status, and technical information needed to operate and secure the website.
Payment-card details are entered into Stripe's payment environment. ArcVault Cards does not store your full card number or card security code.
3. Why we use personal data and our lawful bases
- Orders, delivery, refunds and customer accounts: to perform our contract with you and take steps you request before entering a contract.
- Tax, accounting, fraud prevention and legal records: to comply with legal obligations and, where appropriate, our legitimate interests in protecting the business and customers.
- Customer service: to answer questions, handle returns and resolve problems under our contract with you or our legitimate interests in providing support.
- Stock-alert and marketing emails: where you actively sign up, we rely on your consent. You can withdraw that consent at any time.
- Optional first-party website analytics: only after you accept analytics storage. We use it to understand visits, product views, basket additions and checkout starts so we can improve the store.
4. Companies that help us operate the store
We use specialist service providers where needed to run ArcVault. These currently include Cloudflare for hosting, network delivery and security; Supabase for account authentication and database services; Stripe for payment processing; and Resend for transactional and customer-service email delivery. These providers process data under their own security and privacy arrangements and only for the functions we use them to provide.
Some providers may process data outside the United Kingdom. Where UK data-protection law requires safeguards for an international transfer, we rely on the safeguards made available by the relevant provider and applicable law.
5. Cookies, local storage and analytics
ArcVault uses storage that is necessary for core functions such as keeping your basket, maintaining account sign-in sessions and remembering your cookie choice. These essential functions do not depend on optional analytics consent.
With your permission, ArcVault also creates a random first-party browser identifier in local storage and records limited store-activity events such as page views, product views, basket additions and checkout starts. This analytics system is not intended to record keystrokes, message contents or payment-card data, and it is not used for advertising profiling.
Optional analytics does not run until you choose Accept analytics. If you choose Reject non-essential, ArcVault will not create or use the analytics browser identifier for new activity. You can reopen the choice at any time using the Cookie settings link in the site footer.
6. Stock alerts and marketing emails
If you enter your email address in the stock-alert form, you are asking ArcVault to send you stock, launch and product-update emails. Signing up is optional and is not a condition of purchase. You may withdraw consent at any time by using an unsubscribe option where provided or by emailing enquiry@arcvaultcards.co.uk.
7. How long we keep information
We keep personal data only for as long as needed for the purpose for which it was collected and to meet legal, accounting, tax, fraud-prevention and dispute-resolution requirements. In particular, transaction and accounting records may need to be kept for several years under UK tax law. Account and support information is reviewed when it is no longer needed; marketing subscription data is kept until you unsubscribe or it otherwise ceases to be required; analytics data is periodically reviewed, deleted or aggregated when it is no longer reasonably needed for store performance analysis.
8. Security
We use reasonable technical and organisational measures appropriate to a small online retailer, including encrypted HTTPS connections, managed authentication, access controls and specialist payment processing. No internet system can be guaranteed completely secure, but we limit access and avoid collecting payment-card data that we do not need.
9. Your data-protection rights
Depending on the circumstances, UK data-protection law may give you rights to access your personal data, correct inaccurate data, request deletion or restriction, object to certain processing, receive certain data in a portable format, and withdraw consent where processing is based on consent.
To exercise a right, email enquiry@arcvaultcards.co.uk. We may need to verify your identity before acting on a request.
You also have the right to complain to the UK Information Commissioner's Office if you believe your personal data has been handled unlawfully. We would appreciate the opportunity to address your concern first.
10. Changes to this notice
We may update this notice when our services, suppliers or legal obligations change. The latest version will always show its update date at the top of this page.