Privacy policy
Last updated: 24 August 2026
This policy explains what personal data Travertina collects, why we collect it, how long we keep it, and what rights you have. If anything here is unclear, email us at contact@travertina.co.uk and we will explain it.
1. Who we are
Travertina is a trading name of Adrien Cluzel.
- Registered address: 18 rue des Maraîchers, 33800 Bordeaux, France.
- Business registration number (SIRET): 82502918400033.
- Telephone: +33673726581 (Customer service is open every day, 8am to 5pm UK time, in English.)
- Email: contact@travertina.co.uk.
We are the data controller for the personal data described in this policy.
Because we are established in France and offer goods to customers in the United Kingdom, two sets of law apply to us at the same time: the UK GDPR together with the Data Protection Act 2018, and the EU GDPR together with French data protection law. This policy is written to satisfy both. Where the two regimes differ, we apply the stricter requirement, except where a legal obligation binding on us in France sets a different rule. Section 4 explains one such case.
We have not appointed a Data Protection Officer. We are not required to do so, and our processing does not meet the thresholds that would make one mandatory.
2. What personal data we collect
When you place an order: your name, billing address, delivery address, email address and telephone number. We also record what you bought, when, and the value of the order.
When you contact us: your name, email address, and whatever you choose to tell us in your message.
When you browse the site: your IP address, your browser type and operating system, the pages you view and how you reached us. See section 8 on cookies.
When you sign up to hear from us: your email address, and your marketing preferences.
We do not collect special category data, and we do not ask for it. Please do not send us health, biometric or other sensitive information.
We never see your full card number. Card details go directly to the payment provider.
We need your name, delivery address, email address and telephone number to fulfil an order. Without them we cannot accept it. Everything else is optional.
3. Why we process your data, and on what legal basis
| What we do | Legal basis |
|---|---|
| Take and fulfil your order, arrange delivery, handle returns and answer your questions | Performance of a contract |
| Keep invoices and accounting records | Legal obligation |
| Send marketing emails to people who have signed up | Consent |
| Send occasional emails about similar products to people who have bought from us | Legitimate interests, together with the soft opt-in rule in PECR |
| Place non-essential cookies | Consent |
| Keep the site secure and prevent fraud | Legitimate interests |
| Establish, exercise or defend legal claims, including where our terms have been breached | Legitimate interests |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights, and concluded that it is not. You may object at any time. See section 10.
Marketing, and how to stop it
If you have bought from us, we may email you about similar products. Every message carries an unsubscribe link, and you were offered the chance to decline when you ordered. For anything else, we email you only if you have opted in.
You can withdraw consent at any time, using the unsubscribe link or by emailing us. Withdrawing consent does not affect anything we did lawfully beforehand, and it does not affect the emails we need to send about an order you have already placed.
Automated decision-making
We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal or similarly significant effects.
4. How long we keep it
| Data | Retention period |
|---|---|
| Orders, invoices and accounting records | 10 years |
| Customer account | Until you delete it, or after 3 years without activity, whichever comes first. |
| Marketing contacts | 3 years from your last contact with us |
| Correspondence with customer service | 3 years |
| Cookies | 13 months at most |
The 10 year period for accounting records comes from French commercial law, which binds us as a French business. UK tax law would require 6 years. French law binds us as a French business, so this is the period we must apply.
At the end of these periods the data is deleted, or anonymised so that it can no longer be linked to you.
5. Who we share it with
We do not sell or rent your personal data. We share it only with the suppliers we need to run the shop, and only with the data they need:
| Supplier | Purpose | Data shared |
|---|---|---|
| Shopify Inc. | Hosting the shop and processing payments | Order and account data |
| Payment providers | Taking payment | Payment data, handled directly by them |
| Carriers and fulfilment partners | Delivering your order | Name, delivery address, telephone number |
| Email provider | Sending order confirmations and marketing | Name, email address |
These suppliers act on our instructions under a written contract, and may not use your data for their own purposes. Payment providers act as controllers in their own right and have their own privacy policies, which we encourage you to read.
We will also disclose personal data where the law requires it, where a competent authority makes a valid request, or where it is necessary to establish, exercise or defend a legal claim.
Payment security. Card data is encrypted and handled in line with the Payment Card Industry Data Security Standard (PCI-DSS), maintained by the PCI Security Standards Council. We never have access to your full card number at any point.
6. Sending data outside the UK and the EEA
Some of our suppliers are outside the United Kingdom and the European Economic Area.
Shopify Inc. is established in Canada. Canada holds an adequacy decision from the European Commission, and the equivalent UK adequacy regulations, for commercial organisations.
Where a transfer is not covered by adequacy, we rely on Standard Contractual Clauses for transfers from the EEA, and on the UK International Data Transfer Addendum issued by the Information Commissioner for transfers from the United Kingdom. You may ask us for a copy of the safeguards in place.
Only the data strictly necessary is transferred. For delivery, that means your name, delivery address and telephone number, and nothing else.
7. Security
We take reasonable precautions and follow recognised industry practice to protect your data against loss, misuse, unauthorised access, disclosure, alteration and destruction.
Traffic between your browser and our site is encrypted using TLS. No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we apply PCI-DSS requirements and additional recognised measures.
8. Cookies
Cookies on this site are governed by the Privacy and Electronic Communications Regulations 2003.
Strictly necessary cookies are set without asking you, because the site cannot work without them. Everything else, including analytics and advertising cookies, is set only after you agree through the banner shown on your first visit. You can change your choices at any time from that banner, or through your browser settings.
Essential cookies used by our platform include:
| Cookie | Purpose |
|---|---|
_session_id |
Unique session identifier, allowing the shop to keep track of your session |
_secure_session_id |
Secure session identifier |
cart |
Keeps the contents of your basket, lasting 2 weeks |
storefront_digest |
Records whether you have access to the shop when it is password protected |
We also use analytics cookies, including _shopify_visit and _shopify_uniq,
which count visits and unique visitors. These do not identify you by name, but they contain a unique identifier and are treated as personal data. The same applies to cookies set by Google, through Google Ads, which tell us
which adverts brought people to the site. Refusing these cookies does not stop
you shopping with us.
9. Children
This site is not directed at children. In the United Kingdom, a child aged 13 or over may give their own consent to online services; below that age, consent must come from a person with parental responsibility. In France, the equivalent age is 15.
Purchases must be made by someone with the legal capacity to enter into a contract, or with the permission of a parent or guardian. If you believe a child has given us personal data, contact us and we will delete it.
10. Your rights
You have the right to:
- be informed about how we use your data, which is what this policy is for
- access the data we hold about you
- have inaccurate data corrected
- have your data erased in certain circumstances
- restrict how we use your data
- object to processing based on legitimate interests, and to object to direct marketing at any time, with no exceptions and no need to give a reason
- receive your data in a portable form, and have it transmitted to another controller
- withdraw consent at any time, where we rely on it
- set instructions on what happens to your data after your death, under French law
To exercise any of these, email contact@travertina.co.uk. We will reply within one month. We may ask you to confirm your identity first, so that we do not disclose your data to someone else.
There is no charge, unless a request is manifestly unfounded or excessive.
If you are not satisfied
Please raise it with us first, so that we have the chance to put it right. You also have the right to complain to a supervisory authority at any time.
In the United Kingdom: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. ico.org.uk
In France: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07. cnil.fr
Complaining to a regulator does not affect your right to a legal remedy.
11. Changes to this policy
We may update this policy. Changes take effect when published here, and the date at the top of the page tells you when it was last revised. Where a change materially affects how we use your data, we will tell you directly.
If our business is acquired or merged, your data may transfer to the new controller, under the same protections set out here. We will tell you before that happens.
12. Contact
For anything relating to this policy or to your personal data, write to us at contact@travertina.co.uk, or to Travertina, Adrien Cluzel, 18 rue des Maraîchers, 33800 Bordeaux, France.