Privacy policy
Contents – Privacy Policy of the Aderlo online shop (aderlo.co.uk)
- Data controller
- How to contact us
- Purposes, lawful bases and retention periods
- Categories of personal data we process
- Who we share your data with
- International transfers
- Your rights
- Profiling and automated decision-making
- Cookies and similar technologies
- 9.1 What cookies are
- 9.2 Types of cookies
- 9.3 Managing cookies
- Server logs
- Social media
- Data security
- Changes to this Privacy Policy
- Final provisions
Privacy Policy of the Aderlo online shop (aderlo.co.uk)
Version effective from 1 November 2026.
This Privacy Policy explains how we collect, use and protect the personal data of people who use the online shop at https://aderlo.co.uk (the “Shop” or the “Website”).
We care about the privacy of our customers and users. Below you will find detailed information about why and how we use your personal data, on what lawful basis, for how long, and what rights you have.
1. Data controller
- The controller of your personal data is:
GAPLI ECOMMERCE LTD (trading as Aderlo), a private limited company registered in England and Wales under company number 17081100
Registered office: 590 Kingston Road, London SW20 8DN, England
(“we”, “us”, “our”, the “Controller” or “Aderlo”).
- We process personal data of Shop users in the United Kingdom in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (“PECR”).
2. How to contact us
- For any questions about data protection or to exercise your rights, you can contact us:
- by email: office@aderlo.co.uk
- by post: GAPLI ECOMMERCE LTD, 590 Kingston Road, London SW20 8DN, United Kingdom
- For questions about your orders, cancellations, returns or complaints, please email orders@aderlo.co.uk.
3. Purposes, lawful bases and retention periods
We process personal data for the following purposes:
3.1 Processing orders and contracts of sale
- Purpose: accepting and fulfilling your order, entering into and performing the contract of sale, handling payment, delivering the goods, and handling cancellations, returns and complaints.
- Lawful basis: Article 6(1)(b) UK GDPR (performance of a contract with you, or steps taken at your request before entering into a contract).
- Retention: for the time needed to fulfil the order and then for as long as needed to establish, exercise or defend legal claims – generally 6 years after the contract has been performed, which is the usual limitation period for contractual claims.
3.2 Customer Account
- Purpose: registering and maintaining your Customer Account and providing its features.
- Lawful basis: Article 6(1)(b) UK GDPR (performance of the agreement for the Account service).
- Retention: until you delete your Account or ask us to delete it, and after that for the limitation period for claims.
3.3 Legal obligations (accounting and tax)
- Purpose: complying with our obligations under tax, accounting and record-keeping laws (issuing invoices and keeping accounting records).
- Lawful basis: Article 6(1)(c) UK GDPR (compliance with a legal obligation).
- Retention: for the periods required by the tax and accounting laws that apply to us – generally 6 years from the end of the financial year to which the records relate, in line with the record-keeping rules of HM Revenue & Customs and the Companies Act 2006 – or longer if the law requires.
3.4 Direct marketing – newsletter
- Purpose: sending you marketing communications by email (newsletter), including information about products, promotions and new arrivals.
- Lawful basis: Article 6(1)(a) UK GDPR (your consent), together with regulation 22 of PECR.
- Retention: until you withdraw your consent or unsubscribe.
3.5 Direct marketing – legitimate interests
- Purpose: marketing our own products within the Shop (for example product recommendations and personalising our offer).
- Lawful basis: Article 6(1)(f) UK GDPR (our legitimate interest in direct marketing of our own products).
- Retention: until you object to processing for this purpose.
3.6 Handling correspondence and enquiries
- Purpose: handling enquiries sent through the contact form, by email or by post.
- Lawful basis: Article 6(1)(f) UK GDPR (our legitimate interest in responding to correspondence).
- Retention: for the duration of the correspondence and then for as long as needed to establish, exercise or defend legal claims.
3.7 Legal claims
- Purpose: establishing, exercising or defending legal claims arising from our business.
- Lawful basis: Article 6(1)(f) UK GDPR (our legitimate interest).
- Retention: until the relevant claims become time-barred (generally 6 years).
3.8 Analytics and keeping the Website working properly
- Purpose: statistical and diagnostic analysis, keeping the Website working correctly and securely, and improving our services.
- Lawful basis: Article 6(1)(f) UK GDPR (our legitimate interest); where analytics relies on cookies or similar technologies that are not strictly necessary, we use them only with your consent (Article 6(1)(a) UK GDPR and regulation 6 of PECR).
- Retention: aggregated and anonymised data may be kept indefinitely; personal data until you withdraw your consent or successfully object.
4. Categories of personal data we process
- Depending on the purpose, we may process the following categories of personal data:
- identification data: first name, surname, company name (for business customers),
- address data: delivery address, billing address,
- contact data: email address, telephone number,
- billing data: VAT number (for business customers who ask for an invoice),
- order data: order history, details of products bought, payment status (we do not receive or store your card details),
- technical data: IP address, device identifier, browser type, operating system, data from cookies and similar technologies,
- data about your use of the Website: products viewed, time spent on pages, clicks, data entered in forms.
- Providing personal data is voluntary, but in some cases it is necessary:
- to place an order: name, delivery address, email address and telephone number – without them we cannot fulfil your order,
- to register an Account: email address and password – without them we cannot create your Account,
- where required by law: for example the details needed to issue an invoice.
5. Who we share your data with
- We may share personal data with the following categories of recipients:
- payment provider: Stripe Payments UK Ltd, 9th Floor, 107 Cheapside, London EC2V 6DN, United Kingdom – to the extent needed to process payments and refunds and to prevent payment fraud (privacy policy: https://stripe.com/gb/privacy); Stripe may transfer data to companies in the Stripe group in the United States as described in section 6,
- companies fulfilling orders on our behalf: for storing, picking, packing and dispatching goods and receiving returns – only the data needed for delivery and returns (name, delivery address, telephone number, email address, order contents),
- email service providers: to send messages about your orders, including order confirmations and acknowledgements of cancellation,
- courier companies: to deliver your order,
- IT and hosting providers: companies providing hosting, server maintenance and IT administration services,
- analytics providers: web analytics services (for example Google Analytics), only with your consent,
- marketing service providers: companies supporting our email and advertising campaigns,
- Google (Google Customer Reviews): if you have consented to marketing cookies, after an order we may show you an optional invitation to a Google Customer Reviews survey; if you opt in, Google receives your email address, order number, delivery country, estimated delivery date and product identifiers,
- accountants and tax advisers: to keep our accounting records,
- law firms: where needed to establish, exercise or defend legal claims,
- public authorities: where required by law (for example tax authorities, courts, law enforcement).
- We only use processors that provide sufficient guarantees of appropriate technical and organisational measures (Article 28 UK GDPR). We engage them under written data processing agreements.
- We do not sell your personal data.
6. International transfers
- We are established in the United Kingdom. Some of our service providers – for example IT, database hosting and email providers, and companies that help us fulfil orders – are located in, or store data in, the European Economic Area (EEA). The UK has adequacy regulations for the EEA countries, which recognise that they provide an adequate level of data protection, so these transfers do not need additional safeguards.
- Some of our service providers are based outside the UK and the EEA (for example in the United States). Where your data is transferred to such countries, we rely on:
- adequacy regulations or decisions, including the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) for certified US organisations, or
- the International Data Transfer Agreement or the International Data Transfer Addendum to the EU standard contractual clauses approved for the UK, or
- other appropriate safeguards provided for in the UK GDPR.
- You can obtain a copy of the safeguards we use by contacting us.
7. Your rights
- You have the following rights in relation to your personal data:
- Right of access (Article 15 UK GDPR) – to find out whether we process your personal data and, if so, to get a copy of it and information about how we use it.
- Right to rectification (Article 16 UK GDPR) – to have inaccurate data corrected and incomplete data completed.
- Right to erasure (“right to be forgotten”) (Article 17 UK GDPR) – to have your data deleted where the conditions in the UK GDPR are met (for example where the data is no longer needed for the purposes for which it was collected).
- Right to restriction of processing (Article 18 UK GDPR) – to ask us to restrict processing in the cases set out in the UK GDPR.
- Right to data portability (Article 20 UK GDPR) – to receive your data in a structured, commonly used and machine-readable format and to have it transmitted to another controller (for data processed by automated means on the basis of consent or contract).
- Right to object (Article 21 UK GDPR) – to object at any time to processing based on our legitimate interests (Article 6(1)(f) UK GDPR), including for direct marketing. If you object to direct marketing, we will stop processing your data for that purpose.
- Right to withdraw consent (Article 7(3) UK GDPR) – where we process your data on the basis of consent, you can withdraw it at any time. This does not affect the lawfulness of processing before the withdrawal.
- Right to complain – you have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, https://ico.org.uk. We would, however, appreciate the chance to deal with your concerns first, so please contact us.
- To exercise your rights, contact us using the details in section 2. We will respond without undue delay and in any event within one month of receiving your request (this may be extended by up to two further months for complex or numerous requests; we will tell you if this applies).
8. Profiling and automated decision-making
- We may use profiling for marketing purposes, which means tailoring content and offers to your preferences based on your activity in the Shop (products and categories viewed, purchase history).
- This marketing profiling does not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 UK GDPR.
- We do not make decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.
9. Cookies and similar technologies
9.1 What cookies are
- Cookies are small text files stored on your device (computer, tablet, smartphone) when you use the Website. We also use similar technologies, such as your browser’s local storage.
- We use cookies and similar technologies to make the Website work properly, to remember your preferences and to understand how the Website is used.
9.2 Types of cookies
- The Website uses the following types of cookies:
- Strictly necessary cookies – enable the basic functions of the Website, such as signing in, adding products to your basket and completing an order. The Website cannot work properly without them. They do not require your consent (regulation 6(4) of PECR).
- Analytics cookies – collect information about how the Website is used (for example the number of visits and the most popular pages) and help us improve it. We use them only with your consent.
- Marketing cookies – track your activity in order to show you personalised advertising and content. We use them only with your consent.
- Functional cookies – remember the settings you have chosen (for example your display preferences and recently viewed products). We use them only with your consent.
- Full details, including a list of the cookies we use, are set out in our Cookie Policy.
9.3 Managing cookies
- When you first visit the Website, you will see a cookie banner which lets you:
- accept all cookies,
- reject optional cookies,
- choose individual categories of cookies.
- You can change your cookie settings at any time using the “Manage cookies” link in the footer of the Website or in your browser settings.
- Information on managing cookies in the most popular browsers is available from the browser providers:
- Deleting or blocking strictly necessary cookies may make some parts of the Website difficult or impossible to use.
10. Server logs
- The server hosting the Website automatically records requests sent to it (server logs). Logs may include:
- the IP address of the device making the request,
- the date and time of the request,
- the URL of the requested resource,
- information about the browser and operating system (user agent),
- the HTTP response code,
- the address of the page you came from (referrer).
- Server logs are used only for administrative, technical and security purposes. We do not use them to identify individual people.
- Lawful basis: Article 6(1)(f) UK GDPR (our legitimate interest in keeping the Website secure and reliable).
11. Social media
- The Website may contain links to our profiles on social media (for example Facebook, Instagram, TikTok).
- When you visit a social media website, the privacy rules of that social media provider apply.
- The Website may use social media plug-ins (for example “Like” or “Share” buttons). They are loaded only after you give your consent (via a two-click mechanism or the cookie banner).
12. Data security
- We use appropriate technical and organisational measures to protect the personal data we process, in particular against:
- unauthorised access,
- accidental loss or destruction,
- unauthorised disclosure,
- unlawful processing.
- These measures include in particular:
- encrypting connections to the Website using SSL/TLS,
- access controls for personal data,
- regular backups,
- regular security reviews,
- data protection training for our staff.
13. Changes to this Privacy Policy
- We may update this Privacy Policy, in particular to reflect:
- changes in data protection law,
- changes to our services or the features of the Website,
- guidance from supervisory authorities (including the ICO).
- The updated Privacy Policy will be published on the Website with the date from which it applies.
- Customers with an Account will be informed of significant changes by email.
14. Final provisions
- Matters not covered by this Privacy Policy are governed by the applicable data protection laws, in particular the UK GDPR, the Data Protection Act 2018 and PECR.
- This Privacy Policy applies from 1 November 2026.