Shopping with Ellvan
Privacy & cookies
How we use information to run the shop, and the choices you have.
Prepared 21 October 2026 · UK customers
1. Who is responsible
ELLVAN STUDIOS LTD (company 17420825), trading as Ellvan Cards, is responsible for the personal information described in this notice. Contact contact@ellvancards.com or write to 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. The registered office is for correspondence only, not product returns.
2. Information we use
We receive the name, email, order reference and message you send through our contact form or email. Orders and accounts can include contact, billing/delivery details, items, payments/status, delivery tracking and support history. Shopify manages authentication and checkout; our account pages request your own customer details, order information and saved-product wishlist after sign-in. Do not send passwords or full payment-card details in messages.
A guest bag and wishlist are stored on your device. A signed-in wishlist stores product handles on your Shopify customer record, so it can follow you across devices. Joining our mailing list uses your email and confirmation status. Website/security logs can include IP address, request details, device/browser information and errors. If you allow analytics, Google receives usage and device information associated with analytics identifiers.
We receive information directly from you, from your use of the site, and from Shopify, payment and delivery services involved in your order. We do not receive your full card number through our storefront API. We do not sell your personal information.
3. Why we use it
Contract or steps you request before a contract: processing an order, account sign-in, displaying your order history, delivery, returns and requested support. Legal obligations: tax/accounting records and responding to valid legal requirements. Legitimate interests: keeping the service secure, preventing fraud, resolving complaints and maintaining reliable records; we balance these needs against your rights.
Consent: optional email marketing and optional analytics/performance measurement. The newsletter requires a confirmation email before subscription. Buying, creating an account or saving a wishlist does not automatically subscribe you. You may withdraw marketing consent at any time using the unsubscribe link in marketing emails or by contacting us. Transactional order/support messages are separate from marketing.
You have the right to object to direct marketing at any time. You can also object to processing based on legitimate interests; we will consider your circumstances and the applicable law. Withdrawing consent does not affect earlier lawful processing. You do not have to allow analytics to shop. If you do not provide information necessary for an order, account or reply, we may be unable to provide that service.
4. Who receives information
Shopify provides catalogue, customer accounts, wishlist storage, checkout and order infrastructure. Its payment providers process payments; delivery services receive the details necessary to deliver parcels. Vercel hosts the website and processes operational requests/logs. Resend sends contact/newsletter confirmation messages and holds confirmed mailing-list contacts. Our support inbox is handled through our email providers, including Google/Gmail where enquiries are forwarded. Google Analytics is used only after the optional analytics choice.
Authorised staff, professional advisers and service providers may access information needed for their role. We may disclose relevant information where required by law, to establish or defend legal claims, or for a lawful business transfer with appropriate protections. Shopify and payment providers may also act as independent controllers for certain payment, fraud or platform activities; their own privacy notices explain those uses.
5. International processing
Our providers operate internationally, including in the United States and other countries outside the UK. Where UK data-protection law requires safeguards, transfers must use an applicable adequacy arrangement or suitable contractual safeguards, such as the UK international data transfer agreement/addendum. Contact us for information about the safeguards applicable to your data. We do not promise that all website, payment or email data stays in the UK.
6. How long information is kept
We retain information only as long as needed for its purpose, applicable record-keeping duties and legal claims. Order/payment/accounting records may need to be retained for statutory accounting periods and related disputes. Support messages are retained as needed to resolve the enquiry and any follow-up claim. Account/wishlist data is kept while required to provide the account or until deletion, subject to lawful record retention.
Mailing-list details are kept while subscribed; a minimal suppression record may remain after opt-out so we do not send unwanted marketing. Provider logs, backups and analytics follow the configured provider retention periods. Device-stored bag, guest wishlist and consent preferences persist until cleared or replaced. You can ask us for the retention criteria or provider settings relevant to a specific record; deleting an account does not necessarily delete records we must legally keep.
8. Your choices & rights
Depending on the applicable law and processing basis, you can ask to access, correct or erase data, restrict processing, object, or receive a portable copy. Some rights have exceptions, for example records required by law. Email contact@ellvancards.com; we may need proportionate identity verification before disclosing account information. We normally respond within one month, subject to lawful extensions, and will explain if we cannot fulfil a request.
We do not use the storefront to make solely automated decisions with legal or similarly significant effects. Payment providers can use fraud/security checks under their own notices. If you have concerns about a blocked order or your data, contact us for review. Parents/guardians can contact us about information submitted by a child.
You may complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113. You can contact the ICO without first complaining to us. We review this notice when our services change; significant new uses will be explained before they start where required.