Privacy policy
Privacy Policy
Last updated: 19 October 2026
How D'ORVÉN CO handles your personal data under the EU General Data Protection Regulation (GDPR), as applied in Cyprus. Our store runs on Shopify, ships worldwide and sells in USD.
1. Who we are
The data controller is:
- SICLOPAY LTD, a private limited company registered in Cyprus, trading as D'ORVÉN CO
- Registration number HE 472015
- Spyrou Kyprianou Avenue 14, Office 1, 3070 Lemesos, Cyprus
- dorvencostore@gmail.com
2. What we collect
- Contact and identity — name, email, phone, billing and shipping address, country.
- Order and transaction — items, order value in USD, order number and date, shipping method, carrier and tracking, returns, refunds, chargebacks.
- Payment — method type, currency, transaction ID, authorisation result, last four card digits, billing address. We never see or store full card numbers, expiry dates or CVV codes — card details go straight to our PCI-DSS compliant payment providers.
- Account — email, password (hashed by Shopify; we cannot read it), saved addresses, order history, preferences.
- Technical — IP address and approximate region, browser, operating system, device, cookie and pixel identifiers.
- Usage — pages and products viewed, search terms, carts, abandoned checkouts, clicks on our emails and ads.
- Communications — your emails and messages, support and return requests, reviews, our replies.
We do not ask for special category data (health, ethnicity, religion, political opinions, biometrics); please do not send it.
3. How we collect it
Directly from you when you order, subscribe, review a product or contact us; automatically via cookies, pixels and server logs (essential Shopify cookies; with consent, Meta and Google pixels); and from our processors — Shopify, payment providers, shipping partners, email providers, advertising and analytics platforms.
4. Why we use it — purposes and legal bases
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Processing orders, taking payment, delivery, returns and refunds; running your account; order, dispatch and tracking notices | Contract — Art. 6(1)(b) |
| Answering questions, complaints and support requests | Contract — Art. 6(1)(b) for order matters; else legitimate interests — Art. 6(1)(f) |
| Securing the store; preventing fraud, payment abuse and chargebacks | Legitimate interests — Art. 6(1)(f) in protecting our business and customers |
| Abandoned-cart and abandoned-checkout reminder emails | Consent — Art. 6(1)(a); for existing customers, legitimate interests — Art. 6(1)(f) under the soft opt-in |
| Newsletters, offers and other marketing email | Consent — Art. 6(1)(a), withdrawable any time |
| Analytics and advertising cookies and pixels; conversion measurement, audiences and retargeting with Meta Ads and Google | Consent — Art. 6(1)(a), via our cookie banner |
| Improving the store and our range using aggregated or pseudonymised data | Legitimate interests — Art. 6(1)(f); consent covers the cookies used |
| Accounting, invoicing, VAT and tax records; consumer-law duties; lawful requests from authorities; handling rights requests | Legal obligation — Art. 6(1)(c) under Cypriot and EU law |
| Establishing, exercising or defending legal claims | Legitimate interests — Art. 6(1)(f) in protecting our legal position |
For legitimate interests we have done a balancing assessment; ask for a summary, or object (section 8).
5. Who we share it with
Only with parties who need it, under written contracts with Art. 28 GDPR terms:
- Shopify — platform and hosting for store, account and order data.
- Payment providers — to authorise and settle payments, refund, prevent fraud.
- Shipping and fulfilment partners — warehouses, postal operators and couriers worldwide, receiving delivery details, order contents and customs data.
- Email marketing providers — transactional email, newsletters, abandoned-cart and checkout flows.
- Advertising and analytics providers, including Meta and Google — measurement, conversion tracking, audiences and retargeting, where you consented; they may act as independent or joint controllers.
- Professional advisers — accountants, auditors, tax advisers, insurers, lawyers, bound by confidentiality.
- Public authorities — tax, customs, regulatory or law-enforcement bodies and courts, where legally required or to defend claims.
- A successor entity, if our business or assets are merged, acquired or reorganised.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
6. International transfers
Your data may be processed outside the European Economic Area, including in the US, Canada and the UK. Every transfer relies on a Chapter V GDPR safeguard:
- a European Commission adequacy decision (Art. 45) — e.g. the UK, Switzerland, or US organisations certified under the EU-U.S. Data Privacy Framework;
- the EU Standard Contractual Clauses (Art. 46), with a transfer impact assessment and measures such as encryption;
- the UK International Data Transfer Agreement or UK Addendum for UK transfers;
- an Art. 49 derogation where necessary to perform your contract, such as giving your address to a carrier abroad.
Ask for a copy at dorvencostore@gmail.com.
7. How long we keep it
| Data | Retention |
|---|---|
| Order, invoice, payment and accounting records | As required by Cypriot and EU tax law — generally 6 years from the end of the tax year |
| Account data | While active, plus up to 24 months of inactivity, then deleted or anonymised — sooner on request |
| Marketing data | Until you unsubscribe or withdraw consent; we then keep a suppression record only, so we do not contact you again |
| Abandoned-cart and checkout records | Up to 12 months, or until you unsubscribe or request erasure |
| Technical, cookie and analytics data | Up to 24 months |
| Customer service correspondence | 3 years from last contact, longer if a dispute is open |
| Fraud, chargeback and security records | 6 years |
8. Your rights
- Access your data and receive a copy (Art. 15).
- Rectification of inaccurate or incomplete data (Art. 16).
- Erasure where we no longer need the data or you withdraw consent (Art. 17) — except records we must keep by law, e.g. invoices.
- Restriction while a dispute over accuracy or legal basis is resolved (Art. 18).
- Objection to processing based on legitimate interests, and to direct marketing at any time, absolutely and without a reason (Art. 21).
- Portability — your data in a machine-readable format, sent to another controller where feasible (Art. 20).
- Withdraw consent any time, without affecting processing already carried out (Art. 7(3)).
- Lodge a complaint with a supervisory authority (Art. 77).
To exercise a right, email dorvencostore@gmail.com free of charge. We may ask to verify your identity (usually the email and order number of your purchase). We respond within one month; for complex or repeated requests we may extend by two further months, telling you within the first month and why.
You can complain to our lead supervisory authority, the Office of the Commissioner for Personal Data Protection, Cyprus — dataprotection.gov.cy — or to the authority in the country where you live or work, or where the issue arose.
9. Cookies and tracking
- Strictly necessary — cart, checkout, login, security, fraud prevention. Set without consent, as the store cannot work otherwise.
- Functional — language, currency, your consent choices.
- Analytics — traffic and usage measurement, including Shopify and Google analytics.
- Advertising — the Meta pixel and Google tags for conversion tracking, audiences and retargeting.
All but the strictly necessary cookies are set only after you consent via our cookie banner. Change or withdraw your choices any time in the cookie preferences control, or block cookies in your browser — blocking necessary cookies breaks the cart and checkout. Where we can recognise a signal such as Global Privacy Control, we treat it as withdrawal of consent.
10. Marketing and unsubscribing
We send marketing email — newsletters, offers, and abandoned-cart and checkout reminders — only to people who opted in, or existing customers on the soft opt-in basis (section 4). Stop it any time by clicking unsubscribe in any marketing email, or emailing dorvencostore@gmail.com; we action it within 72 hours. Transactional order messages continue — we must send those to perform your contract.
11. Security
Our Art. 32 GDPR measures include TLS/HTTPS encryption in transit and at rest; PCI-DSS compliant payments with no full card numbers held by us; need-to-know access controls and multi-factor authentication on admin accounts; vetted processors under written agreements; and logging, monitoring and patching by Shopify and our providers. No system is wholly secure. If a breach is likely to risk your rights and freedoms, we notify the Cyprus Commissioner within 72 hours of becoming aware and tell you directly where the risk is high (Arts. 33–34).
12. Children
Our store is not directed at children under 16 and we do not knowingly collect their data. Purchases must be made by someone 16 or over, or by a parent or guardian. If you believe a child under 16 has given us data, email dorvencostore@gmail.com and we will delete it.
13. Changes to this policy
We may update this policy; the "Last updated" date shows when the current version took effect. For material changes — a new purpose or category of recipient — we give advance notice by email or on the store, and where the change relies on consent we ask first.
14. Contact
SICLOPAY LTD (trading as D'ORVÉN CO), registration number HE 472015, Spyrou Kyprianou Avenue 14, Office 1, 3070 Lemesos, Cyprus — dorvencostore@gmail.com.