Your details are used to make, deliver and support your order. We don't sell or rent them to anyone.
Online payments are handled by Stripe. We never see or store your card number or CVV.
Our website runs no advertising pixels or analytics. Your bag and saved pieces stay on your device.
Ask for a copy of your data, correct it, delete it or withdraw consent. We acknowledge every request within 48 hours.
01About this policy
Aquadoir is run by two businesses: [UK COMPANY NAME], trading as Aquadoir ("Aquadoir UK"), company number [UK COMPANY NUMBER], registered office [UK REGISTERED OFFICE ADDRESS]; and Aquadoir India ([LEGAL NAME OF THE INDIAN BUSINESS]), [REGISTERED ADDRESS], Ahmedabad, Gujarat, India. This policy explains how we ("we", "us") collect, use, share and protect your personal data when you visit aquadoir.com from outside India and the UK, place an order, sign up for our emails or contact us.
Aquadoir UK is the controller of your data when you browse our website, sign up for our emails or contact us, and for orders sent from our UK studio, which are most orders. If a piece for your order is sent from our studio in India, Aquadoir India is the controller for that order. Our two businesses share your data only as needed to sell, send and support your order.
If you are in the European Union, our representative under Article 27 of the General Data Protection Regulation (GDPR) is [EU REPRESENTATIVE NAME AND ADDRESS]. You can contact them, as well as us, about any data protection matter. Please read this policy with our Terms of Use and Cookies Policy.
02The information we collect
We collect only what we need to sell you clothing, deliver it and look after you afterwards.
| Type of data | What it includes | When we collect it |
|---|---|---|
| Contact details | First and last name, email address, phone number | At checkout, or when you contact us |
| Delivery details | Delivery address, city, state or county, PIN or postcode, country, and any delivery notes you add | At checkout, and when you check delivery options for your bag |
| Order details | Pieces, sizes and quantities, prices, currency, promo code, delivery option, order number and status, invoice | When you place an order |
| Payment details | Payment method, payment status and the transaction reference from our payment provider (Stripe). We never receive your full card number or CVV. | When you pay |
| Return and refund details | Reason for a return or exchange, and photos or videos you send us | When you ask for a return, exchange or refund |
| Messages | Emails, WhatsApp or Instagram messages, call notes, and the photos you send us | When you contact us |
| Technical details | IP address, browser and device type, and the pages requested, as recorded in standard server logs; your approximate country, worked out from your IP address | Automatically when you visit |
| WhatsApp order updates | Whether you want your receipt and tracking details on WhatsApp, and the phone number they go to | At checkout, only if you tick the box |
| Account details | If you create an account: title, first and last name, email address, country, phone number if you add it, your password (stored only in a protected, hashed form), saved addresses, saved pieces and your newsletter choice | Only if you create an account, and when you change it in My Account |
| Newsletter details | Title, first and last name, country, email address, and your consent to receive our emails | Only if you sign up through the newsletter form |
An account is optional: you can always order as a guest. If you create one, your password is stored only in a protected (hashed) form that no one at Aquadoir can read (see Your account). We do not ask for, and you should not send us, sensitive information such as health or biometric data, or government identity numbers. We do not need them to process your order.
03Your account
An account is optional; you can always order as a guest. If you create one, we keep the account details listed above together with the orders linked to it: those you place while signed in, and earlier orders placed with the same email address once you have confirmed that address is yours.
- What it is for: signing you in, showing your orders and where they are, filling in checkout with your saved addresses, and keeping your saved pieces on every device you sign in to.
- Emails about your account: a code to confirm your email address when you create the account or change it, a code if you reset your password, and a note whenever your password or email address changes or the account is deleted. These are service emails, not marketing.
- Keeping it safe: your password is stored only in a protected (hashed) form; signing in keeps one secure cookie on your device (see our Cookies Policy); after five wrong passwords, signing in with that email pauses for 15 minutes; and changing your password signs you out on your other devices.
- Where it is held: on our store system (WooCommerce, on panel-aqdo.aquadoir.com), with your orders.
- Your control: you can see and change your details, addresses, saved pieces and newsletter choice, sign out of every device, or delete the account at any time in My Account. Deleting it removes the account, your saved addresses and saved pieces straight away; records of past orders are kept as described in How long we keep it.
We use these details to provide the account you asked for (performance of our contract with you) and, for the security checks, in our legitimate interests in keeping accounts safe.
04How we use it, and our legal basis
| What we use it for | Legal basis (GDPR and similar laws) |
|---|---|
| Processing your order: confirming it, checking prices and stock, taking payment, invoicing | Performance of our contract with you |
| Delivering your order, including customs declarations, and sending tracking updates | Performance of our contract with you |
| Customer care, returns, exchanges, refunds and complaints | Performance of our contract, and legal obligations under consumer law |
| Keeping accounting and tax records | Legal obligation |
| Preventing fraud and misuse, and keeping our website secure | Our legitimate interests in protecting our customers and business |
| Showing prices in your currency and the right version of our policies, based on your country | Our legitimate interests in running a store that works for you |
| Improving what we make, from overall trends without identifying you | Our legitimate interests in improving our products |
| Sending your receipt and tracking details on WhatsApp, if you tick the box at checkout (never for marketing) | Performance of our contract with you, at your request |
| Providing your account, if you create one: signing in, your orders, saved addresses and saved pieces | Performance of our contract with you |
| Keeping accounts secure: confirming email addresses and limiting repeated wrong passwords | Our legitimate interests in protecting our customers and business |
| Sending our newsletter | Your consent, which you can withdraw at any time |
Where we rely on legitimate interests, we have balanced them against your rights and you can object (see Your rights). We do not make decisions about you based solely on automated processing.
05Cookies and on-device storage
Our own pages set no cookies, except one that keeps you signed in if you use an account. They run no advertising or analytics tools, and keep your bag, saved pieces and currency in your browser's own storage on your device. Some content from other services, and the secure payment page, may set their own cookies. All of this, and how to control it, is explained in our Cookies Policy.
If you are in the European Economic Area, optional features that store information on your device, such as remembering pieces you have viewed, stay off unless you turn them on.
06Who we share it with
| Who | Why | What they receive |
|---|---|---|
| Stripe (payment provider) | To process card payments, prevent payment fraud and send refunds to the original card | Name, email, billing address, order amount and reference. Stripe collects your card details directly and is certified to the highest level (Level 1) of the PCI DSS card security standard. |
| Aquadoir UK and Aquadoir India (our two businesses) | To sell, send and support your order from the studio that holds the stock, and to answer your messages | Name, contact and delivery details, order details and messages |
| International tracked couriers and DHL Express, and their delivery partners in your country | To deliver orders and collect returns | Name, phone, email, delivery address, and parcel details, including the contents and value needed for customs |
| Website and store hosting | Our website is hosted by Netlify, and our order system (WooCommerce) runs on hosted servers that store orders and send order emails | Order, contact and delivery details; technical details in server logs |
| Newsletter sign-ups (Netlify Forms) | To receive and keep sign-ups made through the newsletter form | The title, name, country and email address you enter, and the time you signed up |
| Location lookup (ipapi.co, with api.country.is as a backup) | To show prices in your currency and the right version of our policies | Your IP address. We receive only a country code back. |
| WhatsApp and Instagram (Meta) | Only if you choose to message us there: to answer your questions; and on WhatsApp, only if you tick the box at checkout: to send your receipt and tracking details | Your phone number or profile name, and the messages and photos you send us; for order updates, your name, phone number, the order details and the tracking number |
| Instagram (Meta) and Behold | To show our latest Instagram posts on the homepage and the Fashion Show page | Your IP address and browser details, when the images load. We share none of your order or contact details. |
| Google Fonts and flagcdn.com | To display our typefaces, and the flag of your country next to "Ship to" in the footer | Your IP address and browser details, when a page loads |
| YouTube or Vimeo | Only on journal articles that contain a video | Your IP address and browser details, and any cookies they set (see our Cookies Policy) |
| Email providers | To send order confirmations, delivery updates and replies to your messages | Name, email address and the content of the message |
| Professional advisers | Accountants, auditors and lawyers, for tax filings, audits and legal advice | Only what is needed for the task |
| Authorities | When required by law or a lawful request, for example from tax authorities, courts or the police | Only what the law requires |
We never sell, rent or trade your personal data, and we do not use it for advertising. Each provider receives only what it needs, and is bound by contract or by its own legal duties to protect it. If our business is ever sold or restructured, your data may pass to the new owner, who must honour this policy; we will tell you before that happens.
07International transfers
Your data is handled in the United Kingdom and, for orders or pieces sent from our studio in India, in India. Some of our providers process data in the United States and elsewhere.
- From the EU to the UK: the European Commission has recognised the UK as providing adequate protection for personal data (adequacy decision renewed in December 2025).
- To India: India has no EU or UK adequacy decision, so transfers between our two businesses are protected by the European Commission's standard contractual clauses and the UK International Data Transfer Agreement.
- To the United States and elsewhere: we rely on the EU-US Data Privacy Framework (and its UK Extension) for certified US providers, or on standard contractual clauses.
You can ask us for a copy of the safeguards we use.
08How long we keep it
| Data | How long we keep it | Why |
|---|---|---|
| Orders, invoices and payment records | 6 years from the end of the financial year of the order (up to 8 years for orders sent from India) | Tax and accounting laws in the UK and India require it |
| Messages, and return photos and videos | 3 years after your last contact with us | To handle follow-ups and any claims |
| Your account (details, saved addresses and saved pieces) | Until you delete it, which you can do at any time in My Account | To provide the account you asked for; your orders are kept as above |
| Newsletter sign-up | Until you unsubscribe | Afterwards we keep only your email on a do-not-contact list, so we never email you by mistake |
| Server and security logs | Up to one year | Security and fraud prevention |
| Information on your device | Until you clear it | It never leaves your device unless you place an order, or save pieces while signed in to an account (see our Cookies Policy) |
If we need data for longer for a legal claim or investigation, we keep it only for that purpose. After that, we delete it or make it anonymous.
09How we protect it
We protect your personal data with security measures appropriate to the data we hold, including:
- encrypted (HTTPS) connections for every page and every order;
- the keys that connect our website to our order system stay on our server and are never sent to your browser;
- prices, stock and delivery charges are checked again on our server when you order, so an order cannot be changed in your browser;
- online payments are handled entirely by Stripe, so card and banking details never reach our systems;
- account passwords are stored only in a protected (hashed) form, signing in pauses after repeated wrong passwords, and the sign-in cookie cannot be read by scripts on the page;
- access to order data is limited to the people who need it to serve you.
No way of sending or storing data online is completely secure, so we cannot guarantee absolute security. If a personal data breach is likely to put your rights at risk, we will report it to the relevant authorities as the law requires, and if the risk to you is high, we will tell you without undue delay what happened and what you can do.
We will never ask for your OTP, card PIN, CVV or banking password by phone, email, SMS or WhatsApp, and we never ask you to pay to "release" a parcel or receive a refund. If someone does, it is not us. Please report it to care@aquadoir.com.
10Your rights
Wherever you live, you can ask us for a copy of your data, to correct it or delete it, and to stop using it for marketing. Depending on where you live, the law gives you further rights:
- European Economic Area and Switzerland: under the GDPR (and the Swiss Federal Act on Data Protection) you can access, rectify and erase your data, restrict or object to its use, receive it in a portable format, and withdraw consent. You can also complain to the data protection authority in the country where you live or work.
- United States: where your state's privacy law applies to us, you can ask to know, access, correct and delete your personal information. We do not sell your personal information, share it for cross-context behavioural advertising, or use sensitive personal information in ways that require an opt-out, and we will not treat you differently for using your rights.
- Other countries (for example Canada, Australia, Japan, Singapore and the United Arab Emirates): where your national privacy law gives you rights, such as to access and correct your personal information, we honour them, and you can complain to your national privacy regulator if you are unhappy with our response.
How to use your rights
If you have an account, you can see and correct your details, and delete the account, yourself at any time in My Account.
Email care@aquadoir.com with the subject "Privacy request", from the email address you used for your order. We may ask you to confirm your identity first. Using your rights is free. We acknowledge every request within 48 hours and respond within one month (or sooner where your local law requires it); if a request is complex, we may need longer where the law allows and will tell you why.
11Children
Our website and products are meant for adults, and you must be 18 or over to place an order. We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.
12Marketing emails
We send news and new releases by email only if you sign up through the newsletter form on our website, where you give your title, name, country and email address and tick the consent box. Every marketing email has an unsubscribe link and our postal address, or you can email us to stop them.
Even if you unsubscribe, we will still send messages about your orders, such as confirmations, delivery updates and replies about returns and refunds.
13Links to other websites
Our website links to other sites and services, such as Instagram, WhatsApp, Stripe and courier tracking pages. Their privacy practices are their own and are not covered by this policy, so please read their privacy policies before sharing personal data with them.
14Changes to this policy
We may update this policy when our services or the law change. The "Last updated" date at the top shows the latest version. If we make a significant change to how we use your personal data, we will tell you by email (if we have your address) or with a clear notice on our website before it takes effect.
15Contact us
For any question, request or complaint about your personal data, contact us or, in the EU, our representative. We reply within 48 hours.
- SELLER (MOST ORDERS)
- [UK COMPANY NAME], trading as Aquadoir
Company number [UK COMPANY NUMBER]
[UK REGISTERED OFFICE ADDRESS] - SELLER (ORDERS SENT FROM INDIA)
- Aquadoir India ([LEGAL NAME OF THE INDIAN BUSINESS])
[REGISTERED ADDRESS], Ahmedabad, Gujarat, India - CUSTOMER CARE
- care@aquadoir.com
+44 7442644643 - PRIVACY CONTACT
- care@aquadoir.com (subject: "Privacy request")
- EU REPRESENTATIVE (GDPR ART. 27)
- [EU REPRESENTATIVE NAME AND ADDRESS]
- EU RESPONSIBLE PERSON (PRODUCT SAFETY)
- [EU RESPONSIBLE PERSON NAME AND ADDRESS]