GDPR Compliance

Last Updated: July 22, 2026

At Selavira, we respect your privacy and are committed to handling personal data responsibly and transparently.

This page supplements our www.selavira.com/policies/privacy‑policy and explains how individuals in the United Kingdom, European Economic Area (“EEA”), and other applicable regions may exercise their data‑protection rights.

Depending on the circumstances, our processing may be governed by the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations 2003 (“PECR”), and the European Union General Data Protection Regulation (“EU GDPR”).

Nothing on this page limits a right available under applicable data‑protection law.

1. Data Controller For personal data processed in connection with the Selavira online store, Selavira acts as the data controller unless another party is identified as an independent or joint controller for a particular service.

Data Controller: Selavira
Business Type: Independently Operated UK Online Dress Retail
Store Website: www.selavira.com
Business Address: Arndale Centre, Manchester, England M4 3AB, United Kingdom
Privacy Email: hello@selavira.com
Telephone: tel: +44 886 664 7635

Our online store is hosted by Shopify. Depending on the processing activity, Shopify and other service providers may act as processors on our behalf or as independent controllers for their own services.

Information about Shopify’s privacy practices and controls is available through the www.privacy.shopify.com/en .

2. Personal Data We May Process Depending on how you interact with us, we may process: Identity information: Name and account identifiers Contact information: Email address, telephone number, billing address, and shipping address Order information: Products, sizes, colours, quantities, purchase history, delivery details, returns, and refunds Payment‑related information: Payment status, transaction identifiers, payment method, and limited card details received from payment providers Account information: Login details and account preferences, if an account is created Communications: Customer Support messages, privacy requests, complaints, and related correspondence Technical information: IP address, browser, device, operating system, cookie identifiers, and website interaction information Marketing information: Communication preferences and interactions with permitted marketing Return evidence: Photographs or videos submitted concerning an incorrect, damaged, or defective product

Selavira does not store complete payment card numbers on its own website servers. Complete payment credentials are handled by Shopify and the applicable payment provider.

Please do not send special‑category information, government identification documents, complete payment card numbers, medical information, or other sensitive information unless we specifically and lawfully request it.

3. Sources of Personal Data We may receive personal data: Directly from you when you browse, order, create an account, contact us, or submit a request Automatically through cookies and similar technologies From Shopify From payment providers and fraud‑prevention services From fulfilment providers and shipping carriers From analytics, advertising, or marketing providers where those services are enabled and permitted From social media or referral services when you interact with those services

4. Purposes and Lawful Bases Process orders, payments, delivery, returns, and refunds Typical Data: Identity, contact, order, delivery, and transaction data Lawful Basis: Performance of a contract

Respond to product, order, and Customer Support inquiries Typical Data: Identity, contact, order, and communication data Lawful Basis: Performance of a contract and legitimate interests in providing Customer Support

Prevent fraud and protect website and payment security Typical Data: Transaction, device, technical, account, and order data Lawful Basis: Legitimate interests, legal obligations, and recognised legitimate interests where applicable

Maintain tax, accounting, and business records Typical Data: Order, payment, refund, identity, and contact data Lawful Basis: Legal obligations

Operate and improve our website Typical Data: Technical, usage, device, and communication data Lawful Basis: Legitimate interests and consent where required for non‑essential technologies

Send direct marketing Typical Data: Contact details, marketing preferences, and purchase information Lawful Basis: Consent or another lawful electronic‑marketing basis where permitted

Use non‑essential analytics or advertising cookies Typical Data: Cookie, device, interaction, and approximate‑location data Lawful Basis: Consent where required

Establish, exercise, or defend legal claims Typical Data: Relevant order, payment, delivery, return, and communication records Lawful Basis: Legitimate interests and legal obligations

Where we rely on legitimate interests, we consider whether the processing is necessary, proportionate, and appropriately balanced against the individual’s rights and freedoms.

5. Consent Where processing is based on consent, consent must be freely given, specific, informed, and capable of being withdrawn.

You may withdraw consent at any time by: Using the unsubscribe link in a marketing email Changing available Cookie Preferences Contacting us at hello@selavira.com

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Cookies and Similar Technologies Our website may use essential cookies to operate checkout, shopping‑cart, account, security, and fraud‑prevention functions.

With the applicable consent, we may also use non‑essential cookies, pixels, tags, or similar technologies for analytics, personalisation, advertising, and marketing measurement.

Visitors in regions requiring prior consent should be provided with a Cookie Banner or Cookie Preferences control before non‑essential technologies are activated.

Cookie consent should be capable of being withdrawn as easily as it was provided. Blocking essential cookies may prevent checkout or other necessary website functions from operating correctly.

7. Direct Marketing Where permitted, we may send information about products, store updates, and promotions.

You have an absolute right to object to the use of your personal data for direct marketing. If you unsubscribe or object, we will stop using the applicable contact details for direct marketing, although we may retain a limited suppression record to ensure your preference is respected.

Marketing preferences do not prevent us from sending non‑promotional messages concerning orders, payments, delivery, returns, refunds, security, or privacy requests.

8. How We Share Personal Data We may share personal data when reasonably necessary with: Shopify and website‑hosting providers Payment processors, digital wallets, and card networks Fraud‑prevention and transaction‑security providers Suppliers, fulfilment providers, and shipping carriers Customer Support and communication providers Analytics and advertising providers where enabled and permitted Professional advisers, including accountants, insurers, and legal advisers Regulators, courts, law‑enforcement bodies, or other authorities where required or permitted by law

Service providers acting as processors are expected to process personal data only under applicable instructions and contractual protections. Some providers may act as independent controllers and process information under their own privacy notices.

9. International Data Transfers Selavira is based in the United Kingdom and serves customers in multiple countries. Shopify and other service providers may process or store personal data outside the United Kingdom or EEA.

Where a restricted international transfer requires a safeguard, we may rely on an applicable: UK adequacy regulation or EU adequacy decision International Data Transfer Agreement UK Addendum to the European Commission Standard Contractual Clauses European Commission Standard Contractual Clauses Binding corporate rules Another lawful transfer mechanism or applicable exception

You may contact us for additional information about the transfer safeguards applicable to your personal data.

10. Data Retention We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including: Order fulfilment and Customer Support Returns, refunds, and payment disputes Fraud prevention and security Tax, accounting, and regulatory obligations Establishing, exercising, or defending legal claims

Retention periods depend on the type of data, the processing purpose, legal limitation periods, and applicable record‑keeping requirements.

When personal data is no longer reasonably required, we may delete, anonymise, or securely dispose of it.

11. Data Security We use reasonable technical and organisational measures designed to protect personal data from unauthorised access, loss, misuse, alteration, or disclosure.

However, no online transmission, website, or electronic storage method can be guaranteed to be completely secure.

Customers should protect account credentials and should not send complete payment card numbers, passwords, or one‑time verification codes through email or other unsecured communications.

12. Your UK GDPR and EU GDPR Rights Subject to applicable law and any relevant exceptions, you may have: Right of access: Request confirmation and a copy of your personal data Right to rectification: Request correction of inaccurate or incomplete data Right to erasure: Request deletion in circumstances where the right applies Right to restriction: Request that certain processing be restricted Right to data portability: Receive eligible data in a structured, commonly used, machine‑readable format Right to object: Object to processing based on legitimate interests or direct marketing Right to withdraw consent: Withdraw consent where processing relies on consent Rights concerning automated decisions: Request safeguards where a solely automated decision has a legal or similarly significant effect Right to complain: Raise a complaint with us or an applicable supervisory authority

These rights are not absolute. A request may be limited where an applicable legal exception, retention obligation, third‑party right, or legal claim applies.

Right to Object to Direct Marketing You have the right to object at any time to the processing of your personal data for direct marketing. To object, use the unsubscribe link in a marketing email or contact hello@selavira.com.

13. How to Exercise Your Rights To submit a data‑protection request, email hello@selavira.com with the subject line “Data Protection Request.”

Please describe the right you wish to exercise and provide enough information to locate the relevant records. Helpful information may include your order number or the email address used to place an order.

We may request reasonable information to verify your identity and prevent unauthorised disclosure. Verification information will be used only to review and respond to the request.

Requests are ordinarily handled without charge. Where permitted by law, a reasonable fee may apply or a request may be refused if it is manifestly unfounded or excessive. If this occurs, we will explain the applicable reason and available complaint rights.

14. Response Time We will respond to a valid rights request without undue delay and ordinarily within one calendar month after receiving the request or completing any reasonably required identity verification.

If a request is complex or multiple requests are submitted, the response period may be extended by up to two additional calendar months where permitted. We will notify you within the initial one‑month period and explain the reason for the extension.

15. Automated Decision‑Making We and our service providers may use automated tools to assist with fraud prevention, payment security, website analytics, or permitted product and marketing personalisation.

Selavira does not intend to make decisions based solely on automated processing that produce legal or similarly significant effects unless the processing is legally permitted and appropriate safeguards are provided.

If you believe a significant decision was made solely through automated processing, contact us to request information and any review rights available under applicable law.

16. Data Protection Complaints to Selavira You may raise a data‑protection complaint by emailing hello@selavira.com with the subject line “Data Protection Complaint.”

Please include: Your name and contact information A description of the concern Relevant dates, order numbers, or previous correspondence The outcome you are seeking, where applicable

We will: Acknowledge the complaint within 30 days of receipt Take appropriate steps to investigate without undue delay Keep you appropriately informed about the handling of the complaint Provide the outcome after the investigation is completed

Submitting a complaint to Selavira does not prevent you from contacting an applicable supervisory authority.

17. Right to Lodge a Complaint with a Supervisory Authority If you are in the United Kingdom, you may complain to the Information Commissioner’s Office (“ICO”): Regulator: Information Commissioner’s Office Website: www.ico.org.uk/make‑a‑complaint/ Telephone: 0303 123 1113

If you are in the EEA, you may have the right to complain to the data‑protection supervisory authority in the country where you live, work, or believe an infringement occurred.

We encourage you to contact us so we can review the concern, but contacting Selavira first is not a condition for lodging a complaint with a supervisory authority.

18. Related Policies For additional information, please review: www.selavira.com/policies/privacy‑policy www.selavira.com/policies/terms‑of‑service www.selavira.com/policies/shipping‑policy www.selavira.com/policies/refund‑policy

19. Changes to This Page We may update this page to reflect changes in our processing activities, Shopify settings, services, or applicable data‑protection requirements.

Updates will be posted on this page with a revised “Last Updated” date.

20. Contact Information For privacy questions, rights requests, or data‑protection complaints, please contact us:

Data Controller: Selavira
Website: www.selavira.com
Business Address: Arndale Centre, Manchester, England M4 3AB, United Kingdom Privacy Email: hello@selavira.com
Support Phone: tel: +44 886 664 7635
Support Hours: Monday – Saturday: 9:00 AM – 6:00 PM UK Time (GMT/BST)
Sunday: Closed