Privacy policy

This Privacy Policy explains how ALDER PARLOR GROUP LTD, trading as Waverlen, collects and uses personal information when you visit waverlen.com, place an order, contact us or interact with our marketing. It also explains your choices and rights under applicable UK data protection law.

Who is responsible for your information?

ALDER PARLOR GROUP LTD is the controller responsible for the personal information we use to operate Waverlen. Our company registration number is 17383142 and our registered office is 71–75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

For privacy questions or to exercise your data protection rights, email support@waverlen.com or write to our registered office, marking your correspondence “Privacy”.

Information we collect

When you place an order, we collect information such as your name, email address, billing and delivery addresses, telephone number where provided, products purchased, order value, payment status and transaction references. Payment information is processed through Shopify Payments and the payment services involved in your transaction.

When you contact us, we collect your contact details, correspondence and information needed to resolve your enquiry. For returns or product claims, this may include order details, photographs you provide, return tracking and records of the outcome. Please avoid sending sensitive personal information or unrelated details in photographs or messages.

When you browse our store, information collected through Shopify and any enabled integrations may include your IP address, browser and device details, cookie identifiers, pages viewed, interactions with products, basket activity, referring websites and approximate location inferred from your IP address. Collection through optional tracking technologies depends on your consent where required.

If you subscribe to marketing, we collect your email address, subscription preferences and records of consent or withdrawal. Where enabled and legally permitted, marketing tools may also record interactions with messages, such as clicks or purchases following a campaign.

Where your information comes from

We receive information directly from you when you browse, purchase, subscribe or contact us. We also receive information from Shopify, payment providers, fulfilment partners and delivery carriers, such as payment confirmation, fraud indicators, tracking updates and delivery status.

Where advertising or analytics integrations are enabled and your choices permit their use, we may receive campaign and website interaction information from those services.

If you provide another person's details for a delivery, please ensure that you are entitled to provide them and make this policy available to that person.

Orders, payments and customer service

We use order and contact information to accept and fulfil purchases, process payments, arrange delivery, send order updates, manage cancellations and returns, and provide customer support. Our lawful basis is performance of our contract with you, or taking steps at your request before entering into a contract.

If you do not provide information necessary to process or deliver an order, we may be unable to complete the purchase. Optional marketing consent is not a condition of buying from Waverlen.

Some records of customer enquiries and claims are also retained for our legitimate interests in maintaining service records, resolving disputes and establishing, exercising or defending legal claims.

Legal obligations, security and fraud prevention

We use and retain information where necessary to meet applicable accounting, tax, consumer protection and other legal obligations. Our lawful basis for this processing is compliance with a legal obligation.

We also use relevant transaction, device and account information for our legitimate interests in protecting our store and customers, detecting suspicious transactions, preventing misuse and investigating payment disputes. We assess these interests against your rights and reasonable expectations.

Where information is required for a legal obligation, failure to provide it may prevent us from completing a transaction or fulfilling the relevant request.

Email marketing

We use Klaviyo to manage email marketing and subscriber preferences. We send promotional emails with your consent or, where legally available, under the existing-customer “soft opt-in”.

We rely on the soft opt-in only where we obtained your details directly during a purchase or negotiations for a purchase, the marketing concerns our own similar products, and you were given a clear opportunity to opt out both when your details were collected and in every subsequent marketing email. Where this exception applies, our UK GDPR lawful basis is our legitimate interest in promoting relevant products to customers.

You can stop marketing emails at any time using the unsubscribe facility in a marketing message or by emailing support@waverlen.com. Withdrawing consent does not affect processing that was lawful before withdrawal.

Unsubscribing from marketing does not stop essential communications about purchases, delivery, refunds or an enquiry you have made. We may retain a limited suppression record to respect your marketing preferences.

Cookies, analytics and advertising

Our store uses cookies and similar technologies. Technologies necessary to provide services you request, such as operating the basket and checkout or maintaining security, may operate without optional cookie consent.

We use Shopify's consent banner to collect choices about optional technologies. Optional advertising tracking is subject to your consent. Optional analytics that requires consent is also subject to that choice. You may refuse optional tracking without losing the ability to purchase from our store.

Where integrations with Google, Meta, including Facebook, or TikTok are activated, and you have given any required consent, they may receive device identifiers and information about browsing, product views, basket activity and purchases. This can support audience measurement, advertising attribution and personalised advertising. The information received depends on the integration and its configuration.

Where personal information is processed for consent-based analytics or advertising, our lawful basis is consent. These providers may associate information received from our store with information they already hold, depending on their services and your account settings.

You can review the privacy choices available through the store's consent controls or contact support@waverlen.com for help withdrawing consent. Browser settings can also restrict cookies, although blocking necessary cookies may affect store functionality.

Simply visiting our website or accepting our terms does not constitute consent to optional advertising cookies or marketing emails.

Who receives your information?

We share information needed to operate our store with Shopify, including Shopify Payments and the payment services involved in processing your purchase. Depending on the service, Shopify and payment providers may process information on our behalf or act as separate controllers for their own legal, security and service purposes.

We share necessary order and delivery information with our fulfilment partner, Wiio, suppliers selected by Waverlen, and delivery or return carriers. This can include your name, delivery address, contact details and the products needed to fulfil your order. Goods may be dispatched directly by an overseas fulfilment partner.

Klaviyo receives information needed to manage our marketing communications and preferences. Google, Meta and TikTok receive information where the relevant integrations are enabled and the applicable consent requirements are met.

Other categories of recipient may include providers of business email, store functionality, IT support and security, as well as professional advisers, insurers and public authorities where disclosure is necessary and lawful.

We limit disclosures to information relevant to the recipient's role. Where a provider processes personal information on our behalf, appropriate contractual data protection requirements must apply.

International processing and transfers

Operating our Shopify store and using overseas fulfilment, communications and advertising services can involve processing personal information outside the United Kingdom. Information may be processed in locations including the European Economic Area, Canada, the United States and the countries where our fulfilment partners and suppliers operate.

For a restricted international transfer, UK data protection law requires an applicable transfer mechanism. Depending on the recipient and destination, this may be UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses, together with any required assessment and supplementary measures.

You can contact support@waverlen.com to request information about the destinations and safeguards relevant to your information, including a copy of applicable safeguards subject to necessary redactions.

How long we retain information

We retain personal information for as long as reasonably necessary for the purpose for which it was collected, including any applicable legal requirements. Retention depends on the type of record and the reason it is needed.

Order, payment and accounting records are retained to administer purchases and meet applicable record-keeping obligations. Support, return and product claim records are retained according to the time needed to resolve the matter, manage related issues and address applicable legal claims.

Marketing information is retained while there is a lawful basis to contact you, taking account of your preferences and engagement. Limited opt-out records may be retained to prevent further unwanted marketing.

For technical and tracking information, retention depends on its purpose, the technology used and the relevant service settings. We consider legal requirements, the sensitivity of the information, whether it is still needed and whether a shorter period would achieve the same purpose. Information no longer needed should be deleted or anonymised.

How we protect information

We use reasonable technical and organisational measures appropriate to the information and risks involved, including restricting access to those who need it for their role and using established service providers. No website, transmission method or storage system can guarantee absolute security.

Please do not send full payment card details or passwords by email. If you believe information connected with your Waverlen order has been compromised, contact support@waverlen.com.

Your data protection rights

Depending on the circumstances, you have rights to request access to your personal information, correction of inaccurate information, erasure, restriction of processing and a portable copy of information processed by automated means on the basis of consent or a contract.

You may object to processing based on legitimate interests, including related profiling, on grounds relating to your situation. You have an unconditional right to object to the use of your personal information for direct marketing, including profiling related to that marketing.

Where we rely on consent, you may withdraw it at any time. Some rights are subject to legal conditions or exceptions; for example, we may need to retain certain transaction records to meet a legal obligation even after an erasure request.

To exercise your rights, email support@waverlen.com. We may request information reasonably necessary to confirm your identity. We normally respond within one month, subject to any extension or adjustment permitted by law, and will explain where one applies. Requests are normally handled without charge.

Automated tools and profiling

Shopify, payment services and advertising integrations may use automated tools to identify transaction risks, measure activity or select advertising audiences. The tools used depend on the services enabled. Audience selection may involve profiling based on browsing or purchase activity where legally permitted.

If you believe an automated assessment has affected an order, contact support@waverlen.com so that we can investigate and explain the available review process. Any use of solely automated decisions producing legal or similarly significant effects must comply with applicable data protection requirements and safeguards.

Privacy concerns and complaints

If you have a concern about how we handle your personal information, contact support@waverlen.com so that we can investigate.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator. You do not need our permission to make a complaint.

Changes to this policy

We may update this policy to reflect changes to our services, processing activities or legal requirements. Where required, we will notify you of material changes and obtain fresh consent before using information for a new purpose that requires it. An update to this policy does not itself provide consent for additional processing.