Privacy policy

Avrenza Group Ltd (trading as Avrenza), company number SC896291, registered office Avrenza Group Ltd, 1/2 71 Fairley Street, Glasgow, Scotland, G51 2SN, is the controller of the personal data described here. Contact us about privacy at info@avrenza.co.uk.

• Account data: name, email address, password hash (we never see your password), telephone number.
• Order data: items bought, prices, delivery and billing addresses, order status and history.
• Payment data: the last four digits and card type returned by Stripe. Full card numbers never reach our systems.
• Enquiry data: anything you send us through our contact form or by email.
• Supplier application data: company details, contact details, product information and any price list you upload.
• Technical data: IP address, device and browser type, and pages viewed, collected in server logs for security and troubleshooting.

• To take payment and deliver your order — performance of a contract.
• To operate accounts, order history and saved addresses — performance of a contract.
• To answer enquiries and handle supplier applications — legitimate interests in running and growing the business.
• To prevent fraud and secure the site — legitimate interests in protecting customers and our platform.
• To meet accounting, VAT and consumer-law obligations — legal obligation.
• To send marketing emails — your consent, which you may withdraw at any time using the unsubscribe link.

We do not sell personal data. We use a small number of processors who act only on our instructions:

• Supabase — database, authentication and file storage hosting for this site.
• Stripe — payment processing; Stripe is an independent controller for fraud prevention purposes.
• Resend — transactional email delivery, such as order confirmations and enquiry notifications.
• Our delivery carriers — the name, address and telephone number needed to deliver your parcel.

Where a processor handles data outside the UK, the transfer is covered by the UK International Data Transfer Addendum or an adequacy decision.

• Order and transaction records: 6 years after the end of the financial year, as HMRC requires.
• Account data: while your account is open, then 12 months after you ask us to close it.
• Contact enquiries: 24 months from your last message.
• Supplier applications and uploaded price lists: 24 months from the decision, unless we go on to trade with you.
• Marketing consents: until you withdraw them, plus a suppression record so we do not contact you again.
• Server and security logs: 90 days.

You have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent at any time. To exercise any of these, email info@avrenza.co.uk; we respond within one month.

If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Access to customer data is restricted to staff who need it, database access is protected by row-level security, uploaded supplier price lists are held in a private store reachable only by short-lived signed links, and all traffic to this site is encrypted with TLS.

We use only essential cookies until you tell us otherwise. Our cookie policy explains each cookie and lets you change your choice at any time.