Privacy Policy
We collect only what we need to deliver your order and run the store. We never sell your data.
1. Who we are
The controller responsible for your personal data on this website (the "Store") is:
OVVION (Pvt) Ltd
Colombo, Sri Lanka
Email: info.ovvion@gmail.com
Phone: +94788949449
For anything related to privacy, email info.ovvion@gmail.com with the subject "Privacy".
2. What we collect and why
When you place an order
- Data: name, email address, phone number, shipping address, the items you buy, order note, and a record of the payment (PayPal transaction ID, amount, status). We also store the IP address used to place the order.
- Why: to process, ship and support your order, send order and shipping updates, handle returns, and prevent fraud.
- Legal basis: performance of a contract (Art. 6(1)(b) GDPR); keeping accounting records (legal obligation, Art. 6(1)(c)); fraud prevention and security (legitimate interests, Art. 6(1)(f)).
Card and bank details: payments are processed by PayPal. If you pay by card, you enter the card details in PayPal's secure form. We never see or store your full card number, expiry date or CVC.
When you contact us
- Data: name, email, order number (optional) and your message.
- Why / basis: to answer you (Art. 6(1)(b) or 6(1)(f) GDPR).
When you join the newsletter or "Notify me" list
- Data: your email address and when you signed up.
- Why / basis: to email you about drops and news, based on your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time by replying "unsubscribe" or emailing us, and we will delete your address.
When you browse
Our hosting provider automatically processes technical data needed to deliver the site and keep it secure (IP address, browser type, pages requested, date and time) in short-lived server logs, based on our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). We do not use advertising trackers or third-party analytics cookies. Fonts are hosted on our own server, so no data is sent to Google Fonts.
3. Who we share it with
We share data only with providers that help us run the Store, under data-processing agreements:
| Provider | Purpose |
|---|---|
| PayPal (Europe) S.à r.l. et Cie, S.C.A. | Payment processing, fraud checks, payment receipts |
| Vercel Inc. | Website hosting and server logs |
| Our database provider (e.g. Neon / Supabase) | Secure storage of orders and messages |
| Email delivery provider (e.g. Resend) | Sending order confirmations and shipping updates |
| Postal and courier services | Delivering your parcel (name, address, phone) |
PayPal acts as an independent controller for the payment itself; see PayPal's Privacy Statement. We may also disclose data where required by law (for example to tax authorities).
4. International transfers
Some providers process data outside the European Economic Area (for example in the United States). Where this happens, transfers are protected by the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
5. How long we keep it
- Order and invoice records: as long as tax and accounting law requires (typically up to 10 years).
- Unpaid / abandoned checkout records: deleted or anonymised within 90 days.
- Contact messages: up to 2 years after the conversation ends.
- Newsletter: until you unsubscribe.
- Server logs: kept by our host for a short period (usually under 30 days).
6. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy;
- have inaccurate data corrected;
- have data erased (unless we must keep it, e.g. for tax records);
- restrict or object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time (this does not affect earlier processing);
- complain to your local data protection supervisory authority.
To exercise any right, email info.ovvion@gmail.com. We reply within one month.
7. Cookies and local storage
We only use storage that is strictly necessary for the Store to work (for example, remembering your bag). Details are in our Cookie Policy.
8. Security
The site is served only over encrypted HTTPS. Order data is stored in an access-controlled database; staff access requires a Google account on an approved list plus 2-step verification, and every staff action is logged.
9. Children
The Store is not directed at children under 16, and we do not knowingly collect their data.
10. Changes
We may update this policy when our services or the law change. The date at the top shows the latest version.