Privacy policy
ÆTHEL DESIGN® Privacy Policy
PART 1 – Introduction, Data Controller, Information We Collect & Legal Basis
Effective Date: [EFFECTIVE DATE]
Last Updated: [DATE]
Privacy Policy
This Privacy Policy explains how CRESTAVERA LIMITED ("we", "our", "us") collects, uses, stores, shares and protects your personal information when you visit the ÆTHEL DESIGN® website, create an account, purchase products, contact us or otherwise interact with our Services.
This Privacy Policy applies to the website operated under the ÆTHEL DESIGN® brand together with all related online services, customer accounts, communications and ecommerce functionality.
Products offered through this website are sold by CRESTAVERA LIMITED.
This Privacy Policy should be read together with our:
- Terms of Service
- Shipping Policy
- Returns, Cancellations & Refunds Policy
- Cookie Policy
- Legal Notice
Where this Privacy Policy relates specifically to personal information, it takes precedence over any inconsistent wording elsewhere on this website.
Nothing in this Privacy Policy limits any rights available to you under applicable data protection legislation.
Data Controller
For the purposes of applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), the Data Protection Act 2018 and other applicable privacy legislation, the Data Controller is:
CRESTAVERA LIMITED
Company Number
16270955
Registered Office
Suite 8
The Monument
45–47 Monument Hill
Weybridge
Surrey KT13 8RN
United Kingdom
VAT Registration Number
GB492448265
Telephone
[CUSTOMER SERVICE TELEPHONE NUMBER]
Throughout this Privacy Policy:
"CRESTAVERA LIMITED", "we", "our" and "us" refer to the legal seller and operator of this website.
"ÆTHEL DESIGN®" refers to the registered United Kingdom trade mark owned by CRESTAVERA LIMITED.
Our Commitment to Privacy
We believe protecting personal information is an essential part of providing a premium customer experience.
We collect only the information reasonably necessary to:
- operate our business;
- fulfil orders;
- provide customer support;
- improve our products and services;
- comply with legal obligations;
- protect our customers against fraud and security threats.
We do not sell your personal information in the ordinary commercial sense.
Where applicable privacy legislation defines certain targeted advertising or advertising identifiers as a "sale" or "sharing" of personal information, we provide the rights and choices required by those laws.
Scope of this Privacy Policy
This Privacy Policy applies whenever you:
- visit our website;
- browse products;
- create a customer account;
- purchase products;
- subscribe to our newsletter;
- contact customer support;
- participate in promotions;
- submit reviews;
- communicate with us;
- interact with our advertising;
- use any services offered through the Store.
It also applies where you communicate with us through:
- email;
- contact forms;
- social media;
- customer support;
- warranty enquiries;
- return requests.
Personal Information
Personal information means information that identifies you or could reasonably be linked to you.
Depending on how you interact with us, we may collect the following categories of information.
Identity Information
This may include:
- name;
- title;
- billing name;
- delivery recipient;
- company name (where applicable).
Contact Information
This may include:
- email address;
- telephone number;
- billing address;
- shipping address;
- country;
- postcode;
- delivery instructions.
Account Information
If you create an account we may collect:
- username;
- encrypted password;
- preferences;
- saved addresses;
- wishlist information;
- communication preferences;
- account settings.
Passwords are never visible to our staff.
Order Information
We may collect information relating to:
- products viewed;
- products added to cart;
- wishlist items;
- completed purchases;
- cancelled orders;
- returned products;
- exchanged products;
- order history;
- shipping selections;
- discount codes used.
Payment Information
Payments are securely processed through Shopify Payments and authorised payment providers.
Depending on your payment method we may receive limited payment-related information including:
- payment confirmation;
- payment status;
- transaction identifier;
- payment provider;
- payment method.
We do not receive or store your complete payment card number.
Customer Service Information
When you contact us we may collect:
- support enquiries;
- emails;
- chat messages;
- warranty claims;
- return requests;
- repair enquiries;
- photographs you voluntarily send;
- videos you voluntarily send;
- compatibility questions;
- other correspondence.
Product Review Information
If you choose to submit a review we may collect:
- review text;
- rating;
- photographs;
- videos;
- product owned;
- purchase verification status.
Device Information
When you visit our website we may automatically collect information including:
- IP address;
- browser type;
- operating system;
- device type;
- language settings;
- referring website;
- session identifiers;
- screen resolution;
- approximate geographic location.
Website Usage Information
We may collect information regarding:
- pages viewed;
- products viewed;
- clicks;
- searches;
- time spent on pages;
- navigation patterns;
- checkout behaviour;
- abandoned carts;
- website performance.
Marketing Information
Where permitted by law we may collect information relating to:
- newsletter subscriptions;
- email engagement;
- advertising interactions;
- campaign responses;
- promotional preferences.
Sources of Personal Information
We collect information from several sources.
Information you provide directly
Including when you:
- place an order;
- create an account;
- subscribe to marketing;
- submit a review;
- contact us;
- request support;
- request a return;
- participate in a promotion.
Information collected automatically
Through:
- cookies;
- similar technologies;
- Shopify platform functionality;
- analytics tools;
- security systems;
- fraud prevention services.
More information is available in our Cookie Policy.
Information from Shopify
Because the Store is hosted on Shopify, Shopify collects and processes certain information necessary for operating the Store.
Shopify may also process information independently where it acts as its own controller.
Further information is available in Shopify's own Privacy Policy.
Information from Service Providers
We may receive information from companies providing services such as:
- payment processing;
- shipping;
- fraud prevention;
- customer communications;
- analytics;
- advertising;
- cloud hosting;
- customer support.
Information from Business Partners
Where appropriate we may receive limited information from advertising or marketing partners that helps us understand the effectiveness of campaigns or improve our Services.
Legal Basis for Processing (UK GDPR & EU GDPR)
Where UK GDPR or EU GDPR applies, we process personal information using one or more lawful bases.
Performance of a Contract
We process information where necessary to:
- accept orders;
- process payments;
- dispatch products;
- provide customer support;
- manage returns;
- fulfil warranties;
- manage customer accounts.
Without this information we may be unable to supply the requested products or services.
Legal Obligation
We process information where necessary to comply with legal obligations including:
- accounting;
- taxation;
- fraud prevention;
- product safety;
- consumer protection;
- law enforcement requests;
- court orders;
- regulatory obligations.
Legitimate Interests
Where appropriate we process information because it is necessary for our legitimate business interests.
Examples include:
- improving our website;
- analysing website performance;
- preventing fraud;
- protecting customers;
- improving products;
- responding to customer enquiries;
- managing reviews;
- maintaining security;
- operating the business efficiently.
Whenever we rely upon legitimate interests we carefully balance those interests against your rights and freedoms.
Consent
Where required by law we rely upon your consent.
This may include:
- marketing emails;
- optional cookies;
- analytics cookies;
- advertising cookies;
- certain personalised advertising.
You may withdraw consent at any time.
Withdrawal of consent does not affect processing already carried out before consent was withdrawn.
Vital Interests
In exceptional situations we may process information where necessary to protect the vital interests of an individual.
This legal basis is expected to apply only rarely.
How We Use Personal Information
Depending upon how you interact with us we may use personal information to:
- process and fulfil orders;
- provide customer support;
- authenticate customer accounts;
- verify payments;
- prevent fraud;
- detect security threats;
- manage returns and warranties;
- improve products;
- improve website performance;
- personalise shopping experiences;
- provide newsletters where permitted;
- administer promotions;
- comply with legal obligations;
- maintain business records;
- protect our legal rights;
- resolve disputes.
We always seek to process only the amount of personal information reasonably necessary for the relevant purpose.
PRIVACY POLICY
PART 2 – Cookies, Analytics, Advertising, Third-Party Services & Automated Decision Making
Cookies and Similar Technologies
Like most modern ecommerce websites, the ÆTHEL DESIGN website uses cookies and similar technologies to provide, protect, improve and personalise the Services.
Cookies are small text files placed on your device when you visit a website. They allow websites to remember information about your visit and help provide a more efficient browsing experience.
Depending on your location and the choices you make through our cookie banner, we may also use similar technologies including:
- local storage;
- pixels;
- tags;
- web beacons;
- software development kits (SDKs);
- session identifiers;
- browser storage technologies.
Some technologies are provided directly by CRESTAVERA LIMITED, while others are provided by Shopify or trusted third-party service providers.
Additional information about the cookies we use, their purpose, duration and how to manage them is available in our Cookie Policy.
Categories of Cookies
We use the following categories of cookies.
Strictly Necessary Cookies
These cookies are essential for the operation of the Store.
They enable functions such as:
- shopping cart functionality;
- secure checkout;
- account authentication;
- fraud prevention;
- website security;
- remembering privacy preferences;
- load balancing;
- session management.
These cookies cannot normally be disabled because the website would not function correctly without them.
Functional Cookies
Functional cookies remember choices you make in order to improve your shopping experience.
Examples include remembering:
- preferred language;
- preferred currency;
- country selection;
- accessibility settings;
- recently viewed products;
- wishlist preferences;
- customer account preferences.
Analytics Cookies
Analytics cookies help us understand how visitors use our website.
They allow us to measure:
- page visits;
- popular products;
- navigation paths;
- checkout behaviour;
- website performance;
- user experience;
- error reporting.
Analytics information is normally aggregated and does not directly identify individual visitors.
Advertising Cookies
Advertising cookies help us:
- measure advertising performance;
- understand customer interests;
- display relevant advertisements;
- avoid showing the same advertisement repeatedly;
- evaluate marketing campaigns.
These cookies may also be used by advertising partners to display advertisements on other websites.
Where required by law, advertising cookies are only activated after you have provided consent.
Cookie Consent
Where required by applicable law, non-essential cookies are only placed on your device after you have provided consent through our cookie banner or cookie preference centre.
You may:
- accept all cookies;
- reject non-essential cookies;
- customise your preferences;
- withdraw consent at any time.
Changing your preferences will not affect cookies that were lawfully placed before your preferences were changed but will affect future processing where required by law.
You can reopen your cookie preferences at any time using the "Cookie Settings" link available on our website.
Browser Controls
Most web browsers allow you to:
- block cookies;
- delete cookies;
- receive warnings before cookies are stored;
- control tracking technologies.
Please note that disabling certain cookies may affect website functionality.
Some features of the Store may no longer operate correctly if essential cookies are disabled.
Analytics
To understand how visitors use our website and improve our Services, we use website analytics technologies.
Depending on the tools enabled on the Store, analytics providers may collect information such as:
- pages viewed;
- products viewed;
- session duration;
- browser information;
- operating system;
- approximate location;
- referring website;
- interactions with website features;
- technical performance information.
Analytics information helps us:
- improve navigation;
- improve website performance;
- understand customer behaviour;
- identify technical problems;
- improve product pages;
- improve checkout performance;
- improve customer experience.
Where required by law, analytics technologies operate only after appropriate consent has been obtained.
Advertising and Marketing
Where permitted by law and subject to your consent where required, we may use personal information to provide relevant marketing and advertising.
This may include:
- personalised advertising;
- remarketing campaigns;
- conversion measurement;
- campaign performance reporting;
- customer segmentation;
- audience measurement;
- abandoned cart reminders;
- product recommendations.
Advertising technologies may use information regarding:
- products viewed;
- products purchased;
- shopping behaviour;
- website interactions;
- campaign responses.
We do not use advertising technologies to make legally significant decisions about individuals.
Marketing Communications
Where permitted by law, we may send:
- newsletters;
- product announcements;
- promotional offers;
- educational content;
- customer updates;
- event invitations.
Marketing communications are sent only where:
- you have subscribed;
- applicable law permits;
- another lawful basis applies.
You may unsubscribe from marketing emails at any time using the unsubscribe link contained in our emails.
Unsubscribing from marketing does not affect transactional communications relating to:
- orders;
- deliveries;
- returns;
- warranties;
- security;
- product recalls;
- legal notices.
Personalised Shopping Experience
Where permitted by law, we may use information about your previous interactions with the Store to improve your shopping experience.
This may include displaying:
- recently viewed products;
- recommended accessories;
- compatible products;
- products related to previous purchases;
- relevant educational content.
These recommendations are intended to improve your shopping experience and are not intended to produce legal or similarly significant effects.
Automated Decision Making
Certain parts of the Services may use automated systems to assist us in operating the Store efficiently.
Examples include:
- fraud detection;
- payment security;
- spam prevention;
- website security;
- product recommendations;
- inventory management;
- marketing optimisation;
- analytics reporting.
These automated systems assist our decision-making but are not used to make decisions that produce legal or similarly significant effects solely by automated means.
Where applicable law provides additional rights regarding automated decision-making, those rights remain unaffected.
Artificial Intelligence
We may use artificial intelligence and machine learning technologies to improve our Services.
Examples may include:
- fraud detection;
- customer service assistance;
- product recommendations;
- website search;
- analytics;
- content improvement;
- translation;
- marketing optimisation.
Where AI technologies process personal information, they remain subject to this Privacy Policy and applicable data protection legislation.
We do not use AI to make legally binding decisions about individuals without appropriate human oversight where required by applicable law.
Third-Party Service Providers
To operate our business efficiently we use carefully selected third-party service providers.
These providers perform services on our behalf under contractual obligations requiring them to protect personal information appropriately.
Depending on how you interact with our Services, personal information may be processed by providers performing services including:
- ecommerce platform services;
- payment processing;
- fraud prevention;
- cloud hosting;
- website security;
- customer support;
- order fulfilment;
- parcel delivery;
- returns processing;
- accounting;
- email communications;
- marketing;
- analytics;
- website optimisation;
- customer reviews;
- product recommendations;
- legal and professional advice.
We do not permit service providers to use your personal information for their own unrelated commercial purposes unless they act as an independent controller under applicable law.
Shopify
Our online store is powered by Shopify.
Shopify provides:
- ecommerce infrastructure;
- website hosting;
- checkout;
- payment services;
- fraud prevention;
- customer accounts;
- analytics;
- order management;
- other services necessary to operate the Store.
Shopify processes certain personal information on our behalf.
In some situations Shopify also acts as an independent controller of personal information under its own Privacy Policy.
Additional information regarding Shopify's processing of personal information is available through Shopify's Privacy Policy and Privacy Portal.
Payment Providers
Payments are processed by Shopify Payments and other authorised payment providers.
Payment providers may collect information necessary to:
- authorise transactions;
- prevent fraud;
- comply with financial regulations;
- process refunds;
- comply with anti-money laundering obligations.
CRESTAVERA LIMITED does not receive or store complete payment card details.
Shipping Providers
To deliver your order we share necessary delivery information with shipping providers.
This may include:
- your name;
- delivery address;
- telephone number;
- email address where appropriate;
- parcel information.
Shipping providers use this information solely for the purposes of delivering your order and associated services.
Customer Support Providers
Where appropriate we may use secure third-party customer support platforms to manage enquiries, warranty claims and customer communications.
These providers process information solely for the purpose of assisting us in providing customer support.
Professional Advisers
We may disclose personal information where reasonably necessary to:
- accountants;
- solicitors;
- insurers;
- auditors;
- regulators;
- law enforcement agencies;
- courts;
- government authorities.
Such disclosures are made only where legally required or reasonably necessary to protect our legitimate interests or comply with applicable law.
Business Transfers
If CRESTAVERA LIMITED undergoes:
- a merger;
- acquisition;
- restructuring;
- investment transaction;
- sale of assets;
- insolvency process;
personal information may be transferred as part of that transaction where permitted by applicable law.
Any successor organisation will remain bound by appropriate privacy obligations.
External Websites
Our website may contain links to third-party websites.
Those websites operate independently of CRESTAVERA LIMITED.
We encourage you to review the privacy policies of every website you visit.
We are not responsible for the privacy practices of third-party websites that we do not own or control.
PART 3 – International Transfers, Security, Data Retention & Your Privacy Rights
International Transfers
As an international ecommerce business, we may transfer, store or process your personal information outside the country in which you reside.
Your personal information may be processed by:
- CRESTAVERA LIMITED;
- Shopify;
- payment providers;
- shipping providers;
- customer support providers;
- analytics providers;
- cloud service providers;
- other carefully selected service providers acting on our behalf.
These providers may operate in countries outside:
- the United Kingdom;
- the European Economic Area (EEA);
- your country of residence.
Whenever personal information is transferred internationally, we take reasonable steps to ensure that appropriate safeguards are in place.
Where UK GDPR or EU GDPR applies, transfers outside the United Kingdom or the European Economic Area are made using recognised transfer mechanisms, which may include:
- UK International Data Transfer Agreements (IDTA);
- UK Addendum to the European Commission's Standard Contractual Clauses;
- European Commission Standard Contractual Clauses (SCCs);
- transfers to countries recognised as providing an adequate level of protection;
- another lawful transfer mechanism recognised under applicable legislation.
Further information regarding Shopify's international processing of personal information is available through Shopify's own Privacy Policy.
Data Security
Protecting customer information is an important part of our business.
We maintain appropriate technical and organisational measures designed to protect personal information against:
- unauthorised access;
- accidental loss;
- unlawful destruction;
- unauthorised disclosure;
- alteration;
- misuse.
Security measures may include:
- encrypted HTTPS connections;
- Shopify's PCI DSS compliant payment infrastructure;
- encrypted payment processing;
- access controls;
- strong authentication procedures;
- limited employee access;
- fraud monitoring;
- security logging;
- software updates;
- regular backups;
- secure hosting environments.
Only personnel and service providers who require access to personal information in order to perform their responsibilities are authorised to access it.
Although we take reasonable steps to protect personal information, no method of transmission over the Internet or electronic storage can be guaranteed to be completely secure.
Accordingly, while we strive to protect your information, we cannot guarantee absolute security.
If we become aware of a personal data breach affecting your information, we will take appropriate action in accordance with applicable data protection legislation, including notifying regulators and affected individuals where legally required.
Data Retention
We retain personal information only for as long as reasonably necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.
Retention periods may vary depending upon:
- legal obligations;
- accounting requirements;
- taxation requirements;
- warranty obligations;
- dispute resolution;
- fraud prevention;
- product safety;
- regulatory requirements.
Typical retention periods include:
Customer Orders
Normally retained for up to 7 years following the end of the relevant financial year to comply with accounting and tax obligations.
Customer Accounts
Retained until:
- you delete the account;
- we close inactive accounts;
- or longer where necessary for legal or security reasons.
Customer Service Enquiries
Normally retained for up to 3 years after the enquiry has been resolved.
Warranty and Return Records
Retained for the duration of the applicable warranty period and for a reasonable period afterwards to resolve disputes or comply with legal obligations.
Marketing Preferences
Retained until:
- you unsubscribe;
- withdraw consent;
- or we determine the information is no longer required.
Website Analytics
Analytics information is generally retained for a limited period determined by our analytics configuration and business requirements.
Security Logs
Security information may be retained where reasonably necessary to investigate fraud, abuse or security incidents.
Where information is no longer required, we will securely delete, anonymise or otherwise dispose of it in accordance with our retention procedures.
Children's Privacy
Our Services are intended for adults.
We do not knowingly collect personal information from children.
If we become aware that personal information has been collected from a child contrary to applicable law, we will take reasonable steps to delete that information.
Parents or legal guardians who believe a child has provided us with personal information may contact us using the details provided at the end of this Privacy Policy.
Your Privacy Rights
Depending upon where you live, you may have some or all of the rights described below.
These rights are not absolute and may be subject to exceptions provided by applicable law.
Where permitted, we may request information necessary to verify your identity before responding to a request.
Right of Access
You may request confirmation of whether we process your personal information.
Where applicable, you may request a copy of the personal information we hold about you.
Right to Rectification
If your personal information is inaccurate or incomplete, you may request that we correct or update it.
Right to Erasure
You may request deletion of your personal information where applicable law provides that right.
Please note that we may retain certain information where required to:
- comply with legal obligations;
- complete transactions;
- resolve disputes;
- prevent fraud;
- enforce agreements;
- exercise or defend legal claims.
Right to Restrict Processing
In certain circumstances you may request that we temporarily restrict our processing of your personal information.
Right to Object
Where we rely upon legitimate interests, you may object to our processing.
You also have the right to object to processing for direct marketing purposes.
If you object to direct marketing, we will stop using your personal information for that purpose.
Right to Data Portability
Where applicable, you may request a copy of certain personal information in a structured, commonly used and machine-readable format.
Where technically feasible and legally applicable, you may request that it be transferred directly to another service provider.
Right to Withdraw Consent
Where processing is based upon your consent, you may withdraw that consent at any time.
Withdrawal does not affect processing carried out before consent was withdrawn.
Right to Lodge a Complaint
If you believe we have processed your personal information unlawfully, you may complain to us.
You also have the right to lodge a complaint with the appropriate data protection authority.
Contact details are provided later in this Privacy Policy.
Additional Rights for UK and European Customers
If UK GDPR or EU GDPR applies, you may also have rights relating to:
- restriction of processing;
- objection to profiling;
- objection to automated decision making where applicable;
- international transfers;
- transparency regarding processing.
These rights are exercised subject to the conditions contained in applicable legislation.
California Privacy Rights
Residents of California may have additional rights under applicable California privacy legislation.
Depending on the circumstances, these rights may include:
- knowing what personal information is collected;
- requesting deletion;
- requesting correction;
- requesting access;
- requesting portability;
- opting out of certain targeted advertising or sharing activities;
- limiting the use of certain sensitive personal information where applicable.
We do not discriminate against individuals for exercising applicable privacy rights.
Where required, requests submitted through authorised agents will be processed in accordance with applicable law.
Canadian Privacy Rights
Canadian customers may request access to personal information that we hold about them and may request corrections where information is inaccurate.
Depending on the applicable province and legislation, additional privacy rights may also apply.
Québec Residents
Residents of Québec may exercise the privacy rights available under applicable Québec privacy legislation, including Law 25.
Requests relating to personal information may be submitted using the contact details provided below.
Identity Verification
Before responding to a privacy request, we may ask you to verify your identity.
This helps protect your information from unauthorised access.
Verification requirements will depend on:
- the type of request;
- the sensitivity of the information;
- the level of risk involved.
We will request only the information reasonably necessary to verify identity.
Authorised Representatives
Where applicable law permits, you may authorise another person to exercise privacy rights on your behalf.
We may request evidence that:
- the representative has authority to act for you; and
- your identity has been appropriately verified.
Exercising Your Rights
You may exercise your privacy rights by contacting us using the details provided at the end of this Privacy Policy.
Where available, you may also use privacy controls provided through:
- your customer account;
- cookie preference centre;
- unsubscribe links;
- Shopify Privacy Portal where Shopify acts as an independent controller.
We will respond within the time periods required by applicable law.
If we are unable to fulfil a request, we will explain the reason where legally permitted.
PART 4 – Complaints, Supervisory Authorities, Policy Updates & Contact Information
Complaints
We take the protection of your personal information seriously.
If you have any questions, concerns or complaints about how we collect, use or protect your personal information, we encourage you to contact us first.
We will investigate your enquiry fairly and respond as promptly as reasonably possible.
Where appropriate, we may ask you for additional information to help us understand your request or verify your identity before responding.
We aim to resolve privacy concerns without unnecessary delay.
Supervisory Authorities
If you are not satisfied with our response, you may have the right to lodge a complaint with the data protection authority responsible for your country or region.
United Kingdom
Information Commissioner's Office (ICO)
Website
Telephone
0303 123 1113
European Economic Area
If you reside within the European Economic Area, you may lodge a complaint with the supervisory authority responsible for your country of residence, your place of work or the place where the alleged infringement occurred.
A list of European supervisory authorities is available at:
https://edpb.europa.eu/about-edpb/about-edpb/members_en
California
Residents of California may also exercise privacy rights available under applicable California privacy legislation.
Canada
Canadian residents may contact the Office of the Privacy Commissioner of Canada or the relevant provincial privacy authority where applicable.
Québec
Residents of Québec may also exercise applicable rights under Québec privacy legislation.
International Customers
Where local legislation provides additional privacy protections beyond those described in this Privacy Policy, those protections continue to apply.
Nothing in this Privacy Policy limits any mandatory rights available under applicable privacy legislation.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
Reasons for updating this Privacy Policy may include:
- changes in applicable legislation;
- changes to Shopify functionality;
- introduction of new products or services;
- implementation of new technologies;
- changes to our business operations;
- improvements to our privacy practices;
- regulatory guidance;
- security improvements.
When we make changes, we will:
- update the "Last Updated" date shown at the beginning of this Privacy Policy;
- publish the revised version on this website;
- provide additional notice where required by applicable law.
Where changes materially affect how personal information is processed, we will provide notice where legally required before those changes take effect.
Continued use of the Services after a revised Privacy Policy becomes effective means the updated Privacy Policy applies to future use of the Services.
Changes do not apply retrospectively where doing so would be contrary to applicable law.
Contacting Us
Questions about this Privacy Policy or our privacy practices may be sent to:
CRESTAVERA LIMITED
Company Number
16270955
Registered Office
Suite 8
The Monument
45–47 Monument Hill
Weybridge
Surrey KT13 8RN
United Kingdom
VAT Registration Number
GB492448265
Subject line (recommended)
Privacy Request
Telephone
[CUSTOMER SERVICE TELEPHONE NUMBER]
Please note that our registered office is used for statutory correspondence and is not a warehouse or product returns address.
Privacy Requests
If you wish to exercise any privacy rights described in this Privacy Policy, please include, where possible:
- your full name;
- the email address associated with your account or order;
- your order number (if applicable);
- the privacy right you wish to exercise;
- sufficient information for us to identify the relevant records.
We may request reasonable evidence to verify your identity before processing certain requests.
Verification procedures are intended to protect your personal information against unauthorised access.
Typical Response Times
Where applicable law specifies a response period, we will comply with that legislation.
In most cases we aim to acknowledge privacy requests within five business days.
Where legally permitted, complex requests may require additional time.
If additional time is required, we will notify you where applicable law requires.
Privacy by Design
CRESTAVERA LIMITED is committed to integrating privacy into the design, operation and improvement of the ÆTHEL DESIGN website and related services.
When introducing significant new technologies or services that involve personal information, we consider appropriate privacy and security measures during planning and implementation.
Where appropriate, we also review our relationships with service providers to ensure that personal information is processed in accordance with applicable legal requirements.
Data Minimisation
We seek to collect only the personal information reasonably necessary to:
- fulfil your order;
- provide customer support;
- improve our products and services;
- comply with legal obligations;
- operate our business.
We do not knowingly collect unnecessary categories of personal information.
Where possible, information is anonymised, aggregated or deleted when no longer required.
Accuracy of Information
We encourage customers to keep their personal information accurate and up to date.
You may update certain information through your customer account or by contacting us.
Keeping your information current helps us:
- deliver orders correctly;
- provide customer support;
- process returns;
- communicate important product information;
- maintain account security.
Data Categories Summary
Depending on how you interact with the Services, we may process categories of information including:
- Identity information
- Contact information
- Customer account information
- Order information
- Payment information
- Customer service communications
- Warranty information
- Return information
- Product review information
- Device information
- Website usage information
- Marketing preferences
- Security information
- Fraud prevention information
- Cookie and analytics information
Not every customer will provide every category of information.
Categories of Third-Party Recipients
Depending upon the Services you use, personal information may be shared with categories of recipients including:
- Shopify
- Payment providers
- Shipping carriers
- Fraud prevention providers
- Cloud hosting providers
- Website infrastructure providers
- Analytics providers
- Marketing service providers
- Customer support providers
- Professional advisers
- Regulators
- Courts
- Government authorities
- Law enforcement agencies
Only the minimum information reasonably necessary for the relevant purpose is shared.
Privacy Principles
CRESTAVERA LIMITED is committed to processing personal information in accordance with recognised privacy principles, including:
- Lawfulness
- Fairness
- Transparency
- Purpose limitation
- Data minimisation
- Accuracy
- Storage limitation
- Integrity
- Confidentiality
- Accountability
These principles guide the way we collect, use, protect and manage personal information throughout our business.
Relationship with Other Policies
This Privacy Policy forms part of the legal framework governing the ÆTHEL DESIGN website.
It should be read together with our:
- Terms of Service
- Shipping Policy
- Returns, Cancellations and Refunds Policy
- Cookie Policy
- Legal Notice
Where there is any inconsistency regarding the processing of personal information, this Privacy Policy takes precedence.
Final Statement
Protecting customer privacy is an ongoing responsibility rather than a one-time legal obligation.
We continually review our privacy practices, security measures and internal procedures to help ensure that personal information is handled responsibly, transparently and in accordance with applicable law.
If you have any questions about this Privacy Policy or how your personal information is handled, we encourage you to contact us.
We are committed to responding openly, fairly and respectfully.