Privacy Policy

This policy explains what personal data we collect when you visit cotriven.shop or buy from us, why we collect it, who we share it with and the rights you have. We keep it as short as we can while being complete.

Who we are

The data controller is GRINDSTORE LIMITED, trading as COTRIVEN, a company registered in England and Wales (company number 07280106), registered office Summerhill House, Sculthorpe Road, Fakenham, Norfolk, England, NR21 9HA. For any privacy question or request, email support@cotriven.shop with “Privacy” in the subject line.

What we collect

• Order details: name, delivery and billing address, email address, phone number, the items you bought, prices, currency and delivery method.
• Payment information: card and wallet payments are processed by our payment providers (Stripe and, where offered, PayPal). We receive a confirmation, the payment method type, the last four digits of a card and its expiry date. We never receive or store full card numbers or security codes.
• Account details (optional): if you create an account, your email, password (stored encrypted), saved addresses and order history.
• Messages: what you send us by email, phone or the contact form, including your order number if you give it.
• Technical data: IP address, browser type and pages requested, recorded in our hosting provider’s server logs for security and fraud prevention; and the essential cookies described in our Cookie Policy.

We do not use advertising cookies, tracking pixels or third-party analytics, and we do not sell or rent personal data.

Why we use it (and our legal basis)

We only send you emails about your orders. We do not send marketing emails unless you have separately asked to receive them, and you can unsubscribe at any time.

Who we share it with

• Payment providers — Stripe Payments Europe Ltd / Stripe, Inc. and PayPal (Europe) S.à r.l. et Cie, S.C.A. / PayPal, Inc., which process payments and screen for fraud as independent controllers under their own privacy policies.
• Production and delivery partners — the print partner that produces your order and the postal and courier services that deliver it receive your name, delivery address and, where the carrier needs it for delivery updates, your email or phone number.
• Hosting and email — our website host (Hostinger) and email provider store data on our behalf under data processing terms.
• Translation — if you choose a language other than English, the text of the page you are viewing is sent to Google’s translation service through the GTranslate plugin so it can be translated in your browser. Your order and account details are not part of that text.
• Authorities and advisers — where the law requires it, or to establish or defend legal claims.

International transfers

Some of these providers process data outside the UK and the European Economic Area, including in the United States. Where they do, transfers are protected by adequacy decisions (including the EU–US Data Privacy Framework and the UK extension, where the provider is certified) or by standard contractual clauses.

How long we keep it

• Order and payment records: 6 years after the end of the financial year of the order, to meet UK tax and accounting rules.
• Customer service messages: 2 years after the matter is closed.
• Accounts: until you ask us to delete your account (order records are kept as above).
• Server logs: up to 30 days.

Your rights

Depending on where you live, you can ask to access your data, correct it, delete it, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Email support@cotriven.shop and we will respond within one month. We may need to confirm your identity first.

You can also complain to a data protection authority: in the UK the Information Commissioner’s Office (ico.org.uk); in the EU the authority in your country, for example Datatilsynet in Denmark or your Land data protection authority in Germany. We would appreciate the chance to help first.

California and other US state residents: you have the right to know what personal information we collect, to request deletion or correction, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioural advertising.

Security

The whole site runs over HTTPS. Payments are handled by PCI DSS-compliant providers, account passwords are stored encrypted, and access to order data is limited to the people who need it to fulfil and support your order.

Children

Our store is intended for adults. We do not knowingly collect data from children under 16.

Changes

If we change this policy we will update the date at the top of this page. Significant changes will be highlighted on the site.