Privacy Policy

Last updated: 14 September 2026

This policy explains how ALUVIA LTD collects and uses personal data when you browse aluvia.uk, place an order or contact us. It is written for the United Kingdom and follows the UK GDPR and the Data Protection Act 2018.

1. Who we are

ALUVIA LTD is the data controller for the personal data described in this policy.

  • Legal name: ALUVIA LTD
  • Company number: 17377697
  • Registered address: 167-169 Great Portland Street, Fifth Floor, London, England, W1W 5PF
  • E-mail: [email protected]
  • Phone: +44 7712 486503
  • Website: aluvia.uk

Write to us at the e-mail address above about anything in this policy, including any request about your data.

2. Data we collect

We collect only what we need to sell and deliver furniture.

  • Order and delivery details. When you place an order we ask for your full name, e-mail address, phone number, delivery address, town or city and postcode, together with any notes you add about access, parking or a preferred delivery slot.
  • Order records. The items ordered, quantities, prices, order reference, delivery date and any returns or warranty claims.
  • Correspondence. Messages you send us by e-mail or phone, and our replies.
  • Payment data. Card and payment details are entered on, and processed by, our payment provider. We never see or store full card numbers; we receive only the outcome of the payment and a masked reference.
  • Technical data. Standard server log data such as IP address, browser type and the pages requested, generated automatically when you visit the site.

3. Health data

We do not ask for and do not collect data about your health, including anything about back problems, posture or other physical conditions. Our product descriptions list construction and adjustment ranges only. Please do not send us health information; if you do, we will delete it rather than keep it on file.

4. Purposes and legal bases

  • Fulfilling your order — taking payment, arranging delivery, handling assembly queries, returns and warranty claims. Legal basis: performance of a contract with you.
  • Contacting you about an order — confirming details, agreeing a delivery slot, checking access for bulky items. Legal basis: performance of a contract.
  • Answering enquiries sent by e-mail or phone before you buy. Legal basis: legitimate interests, namely responding to people who contact us.
  • Keeping the site secure and working, preventing fraud and abuse. Legal basis: legitimate interests in protecting our site and customers.
  • Marketing e-mails, if you have asked to receive them. Legal basis: consent.
  • Accounting and tax records, and responding to lawful requests from authorities. Legal basis: compliance with a legal obligation.

5. Sharing with third parties

We share personal data only with the categories of recipient below, and only with what they need.

  • Couriers and freight carriers. Your name, delivery address, postcode, phone number and delivery notes are passed to the carrier handling your order. Bulky and heavy items travel on a dedicated two-person service, which requires your phone number so the crew can call ahead.
  • Payment provider. Processes your card payment and carries out fraud and anti-money-laundering checks as its own controller.
  • Suppliers and manufacturers. Contacted with the minimum details needed for a direct despatch, a spare part or a warranty claim.
  • IT and hosting providers that run our website, e-mail and order records on our instructions.
  • Professional advisers such as accountants, and public authorities where the law requires disclosure.

We do not sell personal data and we do not share it with third parties for their own marketing.

6. International transfers

Our data is normally held in the United Kingdom or the European Economic Area. If a provider we use stores or accesses data outside the UK, we rely on UK adequacy regulations for that country or, where none apply, on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with additional safeguards where needed. Ask us by e-mail for details of the safeguards in place for a specific transfer.

7. How long we keep data

  • Order and delivery records: six years after the end of the tax year in which the order was placed, to meet accounting and tax obligations.
  • Warranty and returns records: for the length of the warranty and two years afterwards.
  • Enquiries that do not lead to an order: up to twelve months.
  • Marketing consent records: until you withdraw consent, and then a minimal record that you opted out.
  • Server logs: up to twelve months.

When a retention period ends we delete the data or anonymise it so it can no longer identify you.

8. Security

The site is served over HTTPS. Access to order records is limited to staff who need it and is protected by individual accounts and multi-factor authentication. Payment pages are handled by our payment provider, so card details never pass through our systems. We keep backups and review access regularly. No system is perfectly secure, but we will tell you and the Information Commissioner's Office if a breach is likely to put your rights at risk.

9. Cookies

This site uses only what is strictly necessary to work: your basket is held in the memory of the page you have open and is cleared when you close or reload it. We do not set advertising or analytics cookies and we do not use tracking pixels. If we add optional cookies in future, we will ask for your consent first and offer a way to change it.

10. Your rights

Under the UK GDPR you have the right to:

  • Access — get a copy of the personal data we hold about you.
  • Rectification — have inaccurate or incomplete data corrected.
  • Erasure — have data deleted where we no longer need it.
  • Restriction — ask us to pause processing while a dispute is resolved.
  • Portability — receive data you gave us in a structured, machine-readable format, or have it sent to another controller.
  • Objection — object to processing based on legitimate interests, and to direct marketing at any time.
  • Withdraw consent — where processing relies on consent.

E-mail [email protected] to use any of these rights. We reply within one month and may ask for proof of identity first. Using your rights is free.

11. Withdrawing consent

Where we rely on consent, you can withdraw it at any time by e-mailing us or using the unsubscribe link in any marketing message. Withdrawing consent does not affect processing carried out before you withdrew it, and it does not stop us keeping records we must keep by law.

12. Complaints

Please contact us first so we can put things right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office, at ico.org.uk, by phone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Age restriction

This site is intended for adults. We do not knowingly sell to or collect data from anyone under 18. If you believe a child has given us personal data, e-mail us and we will delete it.

14. Changes to this policy

We update this policy when our practices or the law change. The current version is always on this page with the date it was last updated at the top. Material changes affecting how we use your data will be notified by e-mail where we hold your address.