Privacy notice

We collect the details needed to take an order, deliver it and answer your messages. We do not sell personal data, and we do not hand it to anyone for their own marketing.

The advertising tool of this site — the Meta pixel — is switched on only if you agree to it on the cookie card. Saying no changes nothing about how the shop works for you.

We are a company established in the United Kingdom and we sell to consumers in the European Union. This notice is therefore written under the EU General Data Protection Regulation, which applies to us under its Article 3(2), and under the UK General Data Protection Regulation and the Data Protection Act 2018. Wherever you live, you can use the rights described further down.

The data controller — the company that decides how your personal data is used — is Venistra Trading Ltd, registered office London, United Kingdom. It is the seller: it buys the goods it sells, takes your order, confirms it by phone, ships it, collects payment on delivery and deals with returns and guarantee claims.

The same company built this website and runs it, runs its advertising on Facebook and Instagram, and holds the advertising accounts. Whatever your question is — an order, a parcel, a return or your data — Venistra Trading Ltd is the one to ask, at team@venistra.com.

Anything that concerns your personal data goes to a separate address, privacy@venistra.com, read by the person responsible for it. The desk is open every day, 08:00–20:00 Central European Time; we answer data requests within 30 days.

It depends on what you do on the site:

• When you place an order on the offer page for your country: your name, your phone number, the delivery address with postcode and town, the product you chose and its price.
• When you send us a message: your name, your email address, the order number if you give one, and whatever you put in the message.
• Automatically: the IP address an order or a message came from, and basic technical details about your browser, used among other things to recognise fake orders.
• Your cookie choice: the answer you gave on the cookie card and the day you gave it.
• Only with your consent: the data the Meta pixel collects, as described in the cookie notice.

Data protection law asks us to name a legal basis for each use. Here they are, one by one:

• Handling your order — the confirmation call, passing delivery details to the courier, returns and guarantee claims. Basis: the contract between you and us, and the steps before it that you asked for.
• Answering your messages — replying to what you sent through the contact form or by email. Basis: steps taken at your request, and our legitimate interest in supporting customers.
• Keeping records — the accounts and tax records the law obliges a company to keep. Basis: a legal obligation.
• Stopping abuse — checking orders, IP addresses and phone numbers for signs of fraud before goods leave. Basis: our legitimate interest in protecting the business and its customers.
• Measuring our adverts — the Meta pixel tells us whether a visit came from one of our adverts on Facebook or Instagram and whether it ended in an order. Basis: your consent, which you can withdraw whenever you like.

This is the whole list. Nobody outside it receives anything.

• Vercel Inc., United States — our hosting provider and the registrar of our domain: it hosts this website and delivers its pages. It processes the technical request data every website receives, and holds the runtime logs in which an order or a message first lands. Processor, under a data processing agreement.
• Your data comes to us. Where a service provider works for us — for the telephone confirmation of your order, or for technical operations — it acts on our instructions, sees only what that task needs and may not use it for anything of its own.
• The courier or postal operator in your country — receives your name, delivery address, phone number and the amount to collect at the door, because a parcel cannot be delivered without them. We tell you which operator on the confirmation call, or whenever you ask.
• Customs authorities, where a parcel crosses a border that requires a declaration — the details that country's rules oblige us to state.
• Meta Platforms Ireland Limited, Dublin, Ireland — only if you accept advertising cookies. See the next section.

We advertise on Facebook and Instagram, so this deserves its own section rather than a line in a list.

Nothing from Meta loads until you answer the cookie card, and it loads only if you say yes to advertising cookies. Before that, and if you say no, the pixel script is not fetched at all: no Meta cookie is written and nothing is sent to Meta from these pages.

With your consent, the pixel sends Meta Platforms Ireland Limited a PageView for each page you open and, once per order, a Lead event from the thank-you page of a country offer, with the value and the currency of the order and the name of the product. Meta receives these together with the technical data the pixel reads from your browser and its own cookies (_fbp, and Meta's cookies such as fr).

For collecting that data on our pages and transmitting it to Meta, Venistra Trading Ltd and Meta Platforms Ireland Limited are joint controllers (Article 26 GDPR, as the Court of Justice of the EU held in case C-40/17, Fashion ID). What Meta does with the data afterwards — for its advertising reports and for showing adverts — is under Meta's own responsibility and its privacy policy (facebook.com/privacy/policy).

With the same consent, when you send an order our server also reports that Lead event to Meta directly (the Conversions API), so it is counted even if your browser blocks the pixel: the value and currency of the order, the product, your IP address and browser, and your phone number, name, town and postcode in hashed form (SHA-256, a one-way code that Meta can match with its own accounts but cannot turn back into your data). Without your yes to advertising cookies, nothing about your order reaches Meta. We do not upload customer lists to Meta, and we never send it the content of a message.

The order data reach the seller in the United Kingdom. The European Commission has adopted an adequacy decision for the United Kingdom, so that transfer needs no further safeguard.

Vercel Inc. is in the United States: the transfer relies on the EU–US Data Privacy Framework and on the standard contractual clauses adopted by the European Commission in Decision 2021/914, together with encryption in transit and access limited to the people who need it. Meta may process pixel data in the United States under the same framework.

No other country receives your data. Ask at privacy@venistra.com and we will send you a copy of the safeguards that cover it.

Real periods, counted from the event named, not "as long as necessary":

• A completed order, with its accounting and delivery record: 6 years from the end of the financial year, the period for which a UK company keeps its company and tax records.
• An order that was never confirmed — the phone rang out, or you decided against it on the call: 90 days, then it goes.
• Messages sent through the contact form or by email: 24 months after the last reply, so a guarantee question can be traced back to what was said.
• Technical logs — IP address, browser, the pages a request touched: 12 months, kept for security and for tracing abuse.
• Your cookie answer: 12 months from the day you gave it, after which the card asks again.
• Withdrawal and refund records: 6 years, with the accounting records they belong to.

This shop sells household goods, garden tools and reading glasses to adults. It is not aimed at anyone under 16, we do not advertise to that age group, and we do not knowingly collect their personal data.

If you are a parent or guardian and believe a child has sent us something, tell us at privacy@venistra.com and we will delete it.

At no cost, you can ask us to:

• Show you what we hold about you and give you a copy.
• Correct anything that is wrong or incomplete.
• Erase your data where we have no legal duty to keep it.
• Restrict what we do with it while a question is being settled.
• Hand it over in a machine-readable format, to you or to another company.
• Stop any use based on our legitimate interests, and any marketing use, without telling us why.
• Withdraw your consent to advertising cookies, at any moment, as explained in the cookie notice.

Tell us first, at privacy@venistra.com — most things are settled in one exchange of emails.

You do not have to stop there. You may complain to the data protection authority of the country where you live or work, or where you think the problem happened; every EU country has one, and the complaint is free. The seller's own authority is the UK Information Commissioner's Office (ico.org.uk).

For anything about personal data: privacy@venistra.com. For an order, a parcel or a return: team@venistra.com.

If we change the way data is used, this page and its date change with it. A change that affects you materially — a new recipient, a new purpose — is also announced on the site, and we do not apply it retrospectively to data already collected.