Privacy policy

Last updated: 29th, July 2026

ORVÁ ("we," "us," "our") respects your privacy and is committed to protecting your personal data. This policy explains what information we collect, why we collect it, and what rights you have under the EU General Data Protection Regulation (GDPR) and other applicable laws.

Who We Are

ORVÁ is the data controller responsible for your personal data

Fulfillment address: Plieņciema iela 17, Mārupe, 2167, Latvia

Contact: hello@puroorva.com

Information We Collect

We collect information you provide directly to us, and information collected automatically when you use our site.

Information you give us:

Name, email address, shipping and billing address

Phone number (if provided)

Payment information (processed securely by our payment provider — we do not store full card details)

Order history and communication with our support team

Information collected automatically:

IP address, browser type, device information

Pages visited, time spent on site, referring website

Why We Collect Your Data (Legal Basis)

We process your personal data for the following purposes:

Purpose

Legal Basis

Processing and fulfilling your orders

Performance of a contract

Customer support and order inquiries

Performance of a contract

Sending marketing emails (with consent)

Consent

Improving our website and services

Legitimate interest

Preventing fraud and abuse

Legitimate interest

Complying with legal and tax obligations

Legal obligation

How We Share Your Data

We do not sell your personal data. We share data only with trusted third parties necessary to run our business, including:

Shopify — our e-commerce platform, which processes and stores order data

[Payment processor, e.g. Shopify Payments / Stripe / PayPal] — for secure payment processing

[Shipping/fulfillment partner] — to deliver your order

[Email marketing platform, e.g. Klaviyo / Mailchimp] — if you've subscribed to our emails

[Analytics provider, e.g. Google Analytics] — to understand site usage

Each of these providers processes your data under their own privacy policies and, where applicable, data processing agreements with us.

International Data Transfers

Some of our service providers may process data outside the EU/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses, in accordance with GDPR.

Data Retention

We retain your personal data only as long as necessary to fulfill the purposes outlined in this policy, including to satisfy legal, accounting, or reporting requirements. Order data is typically retained for 2 years in line with tax and accounting obligations.

Your Rights Under GDPR

If you are located in the EU/EEA, you have the right to:

Access the personal data we hold about you

Rectify inaccurate or incomplete data

Erase your data ("right to be forgotten"), subject to legal exceptions

Restrict how we process your data

Object to processing based on legitimate interest or direct marketing

Data portability — receive your data in a structured, machine-readable format

Withdraw consent at any time, where processing is based on consent

Lodge a complaint with your local data protection authority

To exercise any of these rights, contact us at hello@shoporva.com.

Children's Privacy