Privacy policy

Current service status

VelaCart does not currently create customer accounts or operate an email-marketing sign-up. A shopping bag is stored temporarily in the current browser session. When checkout starts, VelaCart creates a pending order record containing the delivery and contact details supplied by the customer; payment status is confirmed separately by Stripe.

A customer may submit an order number and postcode to the tracking form, or an Amazon Shipping tracking ID to the carrier-tracking form. The checkout order record can include the recipient name, phone number, full delivery address, delivery preferences and optional WhatsApp consent. The separate customer-facing tracking database uses an order number, a one-way fingerprint of the postcode and a non-specific destination label rather than exposing the full address. Hosting infrastructure may also process normal technical request information such as IP address, time, device or browser data and security logs.

Who is responsible for personal data

The data controller is Vela Cart, trading as VelaCart, at 117 St Paul’s Avenue, Harrow, Middlesex, HA3 9PT. Privacy questions and data-rights requests can be sent to velacart.co.uk@gmail.com.

Information a live shop may need

• Identity and contact details, such as name, delivery and billing address, email and telephone number.
• Optional WhatsApp number and consent choice where a customer requests order or delivery updates through WhatsApp.
• Courier preferences, such as property type, safe-place choice, access information, weekend availability and additional delivery notes.
• Order, delivery, return, refund and customer-service records.
• Stripe payment references and status—not complete card details held by VelaCart.
• Website, device, security and preference data, including cookies where used.
• Marketing preferences and campaign engagement only where marketing is enabled.

Purposes and lawful bases

VelaCart uses information to take steps requested before a purchase and fulfil the resulting contract; comply with tax, consumer-protection, product-safety and other legal duties; and pursue legitimate interests in securing the shop, preventing fraud, supporting customers and improving non-essential parts of the service. Optional analytics storage is activated only with consent. Marketing will require a separate lawful choice before it is introduced.

Optional WhatsApp updates

WhatsApp is optional. If a customer actively selects WhatsApp updates, VelaCart may use the supplied number only for service messages about that order, such as delivery questions or fulfilment updates. This choice is not consent to marketing, and the order can still be placed without selecting WhatsApp.

A customer can ask VelaCart to stop WhatsApp service messages at any time. WhatsApp and its providers may process message and device information under their own terms when this channel is used.

Who information may be shared with

Stripe will process payment, billing, contact, fraud-prevention and checkout information when secure checkout is enabled. VelaCart will receive the resulting payment status and references, but not the complete card number or card security code. Other carefully selected providers may support hosting, delivery, fulfilment, email, customer support, professional advice and legal compliance. Where an order is dispatched by a fulfilment centre, wholesaler, supplier or courier, VelaCart may provide the name, delivery address, required contact details, order contents and delivery instructions reasonably necessary to fulfil and track that order. Those details must not be used by the partner for unrelated marketing.

VelaCart will document provider contracts, minimise the information shared and use appropriate UK international-transfer safeguards where a provider processes information outside the UK.

VelaCart will not sell personal data. Personal information may be disclosed where required by law, to protect legal rights, or in a business reorganisation with appropriate protections.

Retention and security

Optional first-party analytics events are kept for no longer than 13 months and Stripe webhook-processing logs for no longer than 90 days. Automated housekeeping removes older records.

Order, payment and tax records may be retained for up to six years where needed for accounting, legal obligations, fraud prevention or disputes. The owner email centre records which service template was sent, its recipient, subject, optional order note, sending status and administrator for customer-support and dispute records. Optional WhatsApp contact details and courier instructions are reviewed for removal when they are no longer needed for fulfilment, support, chargebacks or a live dispute. Routine support correspondence is normally reviewed for deletion after 24 months. Proof-of-delivery material should be removed when no longer needed for delivery evidence, chargebacks or a live dispute.

Information may be kept longer when a law, regulator, tax authority, court claim, safety recall or active dispute requires it. It will not be kept indefinitely without a documented reason.

Courier evidence photographs are stored separately from the public website and are retrieved only after the matching order number and postcode are verified. Administrators are instructed not to add unnecessary names, addresses or other personal details to the photograph caption.

Reasonable technical and organisational safeguards will be used, but no online service can promise absolute security. Customers should never send complete card details or passwords through ordinary email.

Your UK data-protection rights

Depending on the circumstances, individuals may have rights to be informed, access data, correct it, erase it, restrict or object to processing, receive portable data, and raise concerns about automated decisions. Consent can be withdrawn where consent is the lawful basis.

• Requests can be sent to velacart.co.uk@gmail.com; identity may need to be verified proportionately.
• Individuals can complain to VelaCart first and may also complain to the Information Commissioner's Office.

Cookies and changes to this notice

The storefront does not intentionally set advertising cookies. Hosting may use necessary security or session technology; the site uses local storage for the cookie choice, session storage for the shopping bag and, only with active permission, a random analytics session identifier. Optional first-party events measure page, product, search, basket and checkout-start activity without names, emails or card details. Full details are in the Cookie Policy.

Non-essential analytics remains off until a visitor makes an active choice. Rejecting it is as easy as accepting it, and permission can be withdrawn at any time through Cookie settings.

This policy will be updated when commerce providers and operating processes are confirmed. Material changes will be presented clearly and the current effective date will remain visible.