Privacy Policy

Last updated: 11 June 2026

AVRI LTD, trading as avri ("we", "us", "our"), operates this store and website, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping experience (the "Services"). avri is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use or make a purchase or other transaction using the Services, or otherwise communicate with us. For the purposes of UK data protection law, AVRI LTD is the data controller of your personal information. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use and disclosure of your information as described here.

Personal information we collect or process

When we use the term "personal information", we mean information that identifies or can reasonably be linked to you or another person. It does not include information collected anonymously or that has been de-identified so that it cannot be linked to you. Depending on how you interact with the Services, we may collect or process the following categories of personal information, including inferences drawn from it:

• Contact details including your name, address, billing address, shipping address, phone number and email address.
• Financial information including payment card information, financial account information, transaction details, form of payment, payment confirmation and other payment details. Your full card details are processed securely by our payment provider and are not stored by us.
• Account information including your username, password, preferences and settings.
• Transaction information including the items you view, add to your cart or wishlist, or purchase, return, exchange or cancel, and your past transactions.
• Communications with us including the information you include when you contact us, for example a customer support enquiry.
• Device information including information about your device, browser or network connection, your IP address and other unique identifiers.
• Usage information including how and when you interact with or navigate the Services.

Where we collect personal information from

We may collect personal information from the following sources:

• Directly from you — when you create an account, visit or use the Services, communicate with us, or otherwise provide us with your personal information;
• Automatically through the Services — from your device when you use our Services, and through cookies and similar technologies (see Cookies below);
• From our service providers — when we engage them to enable certain technology, or when they collect or process personal information on our behalf;
• From our partners or other third parties.

How we use your personal information, and our lawful bases

Under UK data protection law we must have a lawful basis for processing your personal information. Depending on how you interact with us, we use your personal information for the following purposes and on the following bases:

• To provide the Services (lawful basis: performance of a contract). To process your payments, fulfil and deliver your orders, manage your account, handle returns and exchanges, send order and account notifications, and respond to your requests.
• To improve and personalise the Services (lawful basis: legitimate interests). To remember your preferences, recommend products, and develop and improve our Services. Our legitimate interest is running and growing our business in a way you would reasonably expect.
• For marketing and advertising (lawful basis: consent, or our legitimate interest in marketing to existing customers). To send you marketing communications by email and to show you relevant advertising. Where the law requires consent, we will ask for it, and you can withdraw it or unsubscribe at any time.
• For security and fraud prevention (lawful basis: legitimate interests and legal obligation). To authenticate your account, provide a secure shopping experience, and detect, investigate and prevent fraudulent, unsafe or unlawful activity.
• To communicate with you (lawful basis: performance of a contract and legitimate interests). To provide customer support and maintain our business relationship with you.
• For legal reasons (lawful basis: legal obligation and legitimate interests). To comply with applicable law, respond to valid legal process, and enforce our terms and policies.

If you choose to register an account, you are responsible for keeping your credentials safe. We recommend you do not share your username or password with anyone.

How we disclose personal information

In certain circumstances we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy, including:

• With Shopify and other service providers who perform services on our behalf, such as IT management, payment processing, data analytics, customer support, cloud storage, fulfilment and shipping.
• With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalised advertising with third-party services based on your online activity. These partners use your information in accordance with their own privacy notices. Depending on where you reside, you may have a right to direct us not to share information about you for targeted advertising.
• When you direct, request or consent to disclosure to third parties, such as to ship your products, or through your use of social media widgets or login integrations.
• With our affiliates or otherwise within our corporate group.
• In connection with a business transaction such as a merger or insolvency; to comply with legal obligations (including responding to lawful requests from authorities); and to enforce our terms or protect our rights and the rights of our users or others.

Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve them. Information you submit to the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services. We also use certain Shopify enhanced features that incorporate data from your interactions with our store and with other merchants. In providing these features, Shopify may act as a controller of your personal information and is responsible for that processing, including responding to requests to exercise your rights in relation to it. To learn more about how Shopify uses your personal information and any rights you may have, visit the Shopify Consumer Privacy Policy at https://privacy.shopify.com/en.

Cookies

We use cookies and similar technologies to operate our website, remember your preferences, understand how the Services are used, and support marketing and advertising. Some cookies are essential for the website to function; others are optional and used only with your consent.

When you first visit our website, you can accept or reject non-essential cookies through our cookie banner, and you can change your preferences at any time. You can also manage cookies through your browser settings, although blocking some cookies may affect how the website works.

Children's data

The Services are intended for adults and are not directed at children. We do not knowingly collect personal information from anyone under the age of 16. If you are the parent or guardian of a child who has provided us with their personal information, please contact us using the details below and we will delete it.

Security and retention of your information

No security measures are perfect or impenetrable, and we cannot guarantee "perfect security". Any information you send us may not be secure while in transit, so we recommend you do not use unsecure channels to send us sensitive or confidential information.

How long we keep your personal information depends on why we hold it — for example, to maintain your account, provide the Services, comply with our legal obligations, resolve disputes, or enforce our agreements and policies. Order and transaction records are generally kept for 6 years to meet UK tax and accounting requirements. When we no longer need your personal information, we securely delete or anonymise it.

Your rights and choices

Under UK data protection law, you have the following rights in relation to your personal information. These rights are not absolute and may apply only in certain circumstances:

• Right to be informed — to know how we use your personal information, as set out in this policy.
• Right of access — to request a copy of the personal information we hold about you.
• Right to rectification — to request that we correct inaccurate or incomplete information.
• Right to erasure — to request that we delete personal information we hold about you.
• Right to restrict processing — to ask us to limit how we process your information in certain circumstances.
• Right to data portability — to receive a copy of certain information in a portable format, or to have it transferred to a third party.
• Right to object — to object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Right to withdraw consent — where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing carried out before withdrawal.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

Managing marketing preferences. You can opt out of marketing emails at any time using the unsubscribe link in our emails. If you opt out, we may still send you non-promotional messages, such as those about your account or orders.

To exercise any of these rights, contact us using the details below. We may need to verify your identity before responding, and we will respond within the timeframe required by law. You may appoint an authorised agent to make a request on your behalf, in which case we may ask for proof of their authority.

Complaints

If you have a complaint about how we handle your personal information, please contact us first using the details below so we can try to resolve it. You also have the right to lodge a complaint with the UK's data protection authority:

Information Commissioner's Office (ICO) Website: ico.org.uk Helpline: 0303 123 1113

International transfers

We may transfer, store and process your personal information outside the United Kingdom. Where we do, and the destination country is not covered by UK "adequacy" regulations, we rely on recognised safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's Standard Contractual Clauses, or equivalent approved mechanisms, to ensure your information is protected.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices or for other operational, legal or regulatory reasons. We will post the revised policy on this website, update the "Last updated" date, and provide notice where required by law.

Contact

If you have any questions about our privacy practices or this Privacy Policy, or you would like to exercise any of your rights, please contact us:

AVRI LTD (trading as avri) Registered in England and Wales, company number 17273621 Registered office: 128 City Road, London, EC1V 2NX, United Kingdom Email: hello@casaavri.com

For the purposes of UK data protection law, AVRI LTD is the data controller of your personal information.