Privacy policy

Evita Beauty Store is the data controller for the personal data collected through this shop. We are based in the United Kingdom and you can reach us about anything on this page at hello@evitabeauty.co.uk.

• Contact and delivery details: your name, email, address and phone number when you order.
• Order history: what you bought, when, and how it was delivered.
• Account details: your email and a securely hashed password if you create an account.
• Messages you send us through the contact form or by email.
• Reviews: the name and text you choose to publish, plus your email address, which is never shown and is used only to check for a verified purchase.
• Your email address if you join the newsletter.
• Basic technical data, such as your IP address and browser type, recorded in server logs to keep the shop running and secure.

We never see or store your full card number. Payments are handled by Stripe, and card details go straight from your browser to them.

• To take and deliver your order, including payment, receipts and delivery updates. This is a contract with you.
• To keep tax and accounting records. This is a legal obligation, so order records are kept for six years.
• To send the newsletter. This runs on your consent, and you can withdraw it any time by unsubscribing.
• To answer your questions and handle returns. This is part of our contract with you and our legitimate interest in supporting customers properly.
• To keep the shop secure and prevent fraud. This is our legitimate interest.

Only the partners needed to run the shop, each under a data processing agreement:

• Stripe, to process payments.
• Delivery carriers, to bring your order to you.
• Our email provider, to send order confirmations and the newsletter.
• Our hosting provider, which stores the shop's data.
• Meta (Facebook and Instagram), which receives pixel and server-side events so we can measure our advertising. See the Cookies section for what that involves.

We never sell your data.

Some of our processors, including Stripe, handle data in the United States. Where data leaves the UK, it travels under the safeguards UK GDPR requires, such as the International Data Transfer Agreement or the UK addendum to EU standard contractual clauses.

• Order records: six years, to meet UK tax rules.
• Account details: until you delete your account or ask us to.
• Newsletter: until you unsubscribe.
• Support messages: up to two years, so we can see the history if you come back to us.

Strictly necessary, so the shop works:

• A session cookie, so you stay signed in to your account.
• Storage on your own device for your shopping bag, so it survives a closed tab.

Advertising, so we can measure whether our ads work:

• The Meta Pixel (Facebook and Instagram), which sets the _fbp and _fbc cookies and tells Meta when someone visits a page or buys something after seeing one of our ads.
• Our servers also send order and browsing events directly to Meta (the Conversions API), matched with details such as a hashed email address, so the same visit is never counted twice.

You can block or delete these cookies in your browser settings and the shop still works. Meta's own privacy policy covers what it does with the data it receives.

You can ask us at any time to:

• show you the data we hold about you,
• correct it, delete it or restrict how we use it,
• give you a portable copy,
• stop a use based on legitimate interests, or
• withdraw consent, for example from the newsletter.

Email hello@evitabeauty.co.uk and we will respond within one month, usually much faster.

If you are not happy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

If we change how we handle personal data, we update this page and change the date at the top. For anything significant, we will email you if we have your address.