Privacy policy

Who we are

Evra is the trading name of [PLACEHOLDER: legal name of the business]. We run the website myevra.com.

We are the controller of the personal data described in this notice. That means we decide how and why it is used, and we are responsible for looking after it.

Our address

[PLACEHOLDER: registered or geographic business address]

Email for privacy questions

[PLACEHOLDER: privacy contact email]

ICO registration number

[PLACEHOLDER: ICO registration number, if the fee applies]

We have not appointed a data protection officer. Please send any question about this notice or your data to the email address above.

This notice covers myevra.com, our forms and the emails we send. It does not cover brands' own websites, which you reach through "Buy from brand" buttons. They have their own privacy notices.

What we collect and why

Here is each way we collect personal data, what we collect, why, and our lawful basis under UK data protection law. How long we keep each kind of data is in How long we keep it.

Where our lawful basis is legitimate interests, we have weighed our interests against your rights and freedoms and believe ours are not outweighed. You can ask us for more detail, and you have the right to object.

You do not have to give us any personal data to browse Evra. If you want a reply to a message, we need your name and email address. If you want our newsletter, we need your email address. When our checkout opens, we will need your delivery details to send you an order.

When you visit the website

What we collect

Your IP address, the page you asked for, the date and time, the address of the page that sent you, and details your browser sends, such as its type and version. Our host, Netlify, records these in its logs automatically, as web servers do.

Why

To deliver the website to you, find and fix faults, and protect the site from attacks and misuse.

Lawful basis

Legitimate interests: running a website that works and is secure.

When you send us a message

What we collect

Your name, email address, the topic you choose, your order number if you give one, and your message. With every form, Netlify also stores the date and time, your IP address, your browser details and the page you sent it from.

Why

To read and reply to your message, and to deal with any question, request or complaint in it. Netlify checks every form for spam using a service called Akismet.

Lawful basis

Legitimate interests: answering the people who contact us, and keeping our forms free of spam. If your message is about an order, contract. If it is a data protection request or complaint, legal obligation.

When you send a partner enquiry

What we collect

Your company name, your name, your work email address, your product category, your website and your message, plus the same technical details Netlify stores with every form.

Why

To reply to you, find out whether your products could be a good fit for Evra, and talk to you about listing them.

Lawful basis

Legitimate interests: finding and working with partner brands. Where you ask us to consider a listing, also the steps needed before entering into a contract with you.

When you sign up to our newsletter

What we collect

Your email address, the date and time you signed up, and a reference to the exact sign-up wording you saw (for example "newsletter-v1-2026-10"), plus the same technical details Netlify stores with every form.

Why

To send you emails about new products and offers now and then, and to keep a record that you agreed to receive them.

Lawful basis

Consent. You can withdraw it at any time with the unsubscribe link in every email, or by contacting us. Withdrawing does not affect emails we sent before.

We keep sign-ups in Netlify until we choose an email service. [PLACEHOLDER: the newsletter email provider, and whether its emails record when they are opened or links are clicked. If they do, say so here and ask for consent at sign-up]

The newsletter is for adults. [PLACEHOLDER: minimum age to sign up, 16 or 18, and show it on the sign-up form]

If you accept analytics cookies

What we collect

How you use the site: the pages you view, the page that sent you to us, your type of device and browser, your screen size and language, your approximate location worked out from your IP address, and a random ID kept in the _ga cookies that tells one browser's visits from another's. When you send a form, Google Analytics records which form was sent, never what you typed.

Why

To understand how people use Evra, so we can improve it.

Lawful basis

Consent, which you give in the cookie banner or Cookie settings. You can withdraw it at any time in Cookie settings.

Google Analytics does not load unless you accept it, so nothing is sent to Google before then. We have also set it up to collect less: advertising features, Google signals and ad personalisation are off; we remove the part of each page address after "?" or "#", except the standard tags that say which campaign brought you to us; and we do not load it on our search page, so what you search for never reaches Google. Google says Google Analytics 4 does not log or store IP addresses. Our cookie policy lists the cookies it uses.

Your basket, saved items and colour theme

These are kept only in your browser's storage on your device. They are never sent to us, and we cannot see them. To show your basket and saved items, your browser downloads the same product list that every visitor gets. That request does not include your basket or your list.

They stay until you clear them. Because we do not hold them, we cannot recover them if they are deleted. Our cookie policy explains how to clear them. We do not offer customer accounts at the moment.

When you click "Buy from brand"

Some products are sold by the brand on its own website. When you click "Buy from brand", you leave Evra. Your browser tells the brand's website that you came from myevra.com, but not which page you were on. From then on, the brand, and any affiliate network that records the sale, are responsible for what they collect, under their own privacy notices. [PLACEHOLDER: the affiliate networks we use, if any, and whether Buy from brand links carry a tracking ID]

When you buy from Evra, once our checkout opens

Our checkout is not open yet, so we do not take orders or payments. When it opens, we will collect what we need to sell and deliver your order: your name, delivery address, email address, what you ordered and whether you have paid. [PLACEHOLDER: other order details, such as a phone number for delivery, and the payment provider, which should take card details directly so we never see your full card number]

Our lawful bases will be contract (to take, deliver and support your order), legal obligation (to keep sales and tax records) and legitimate interests (to prevent fraud). We will update this notice with the full details before checkout opens.

When you make a request or complaint about your data

What we collect

Your contact details, what you ask for or complain about, our replies, and anything we need to confirm who you are.

Why

To deal with your request or complaint, and to keep a record of how we handled it.

Lawful basis

Legal obligation.

How long we keep it

We keep personal data only for as long as we need it for the reasons above. We may keep it longer if we need it to deal with a legal claim, or if the law requires us to.

Who we share it with

We do not sell your personal data. We share it only with the service providers below. They act for us under contracts that require them to protect it and to use it only on our instructions.

Google also uses some Google Analytics data for its own purposes, such as maintaining and improving its services, under its own terms. Google explains this in how Google uses information from sites that use its services. [PLACEHOLDER: confirm that Google's data processing terms are accepted and which data sharing settings are off in our Google Analytics account]

We may also share personal data:

• with professional advisers, such as our accountant or solicitor, when they need it to advise us
• with the police, courts, regulators or other public bodies, when the law requires it or to prevent or detect crime
• with a buyer or investor if our business, or part of it, is sold or reorganised, who must protect it in the same way

We do not give your details to partner brands. If you contact us about a brand's product and we need the brand's help to answer, we will ask you first.

International transfers

Netlify and Google are based in the United States, and other providers may use computers outside the UK. When your personal data goes outside the UK, UK law requires a safeguard that keeps your data protected to a standard not materially lower than in the UK. We rely on one of these:

• UK adequacy regulations, including the UK-US data bridge for US companies that have signed up to it
• the International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses, in the provider's data processing terms

[PLACEHOLDER: the safeguard used for each provider, after checking the Data Privacy Framework list for Netlify and Google]

You can ask us for a copy of, or more information about, the safeguard that applies to your data.

Your rights

UK data protection law gives you these rights over your personal data. Some of them apply only in certain situations.

• Access: ask for a copy of your personal data.
• Correction: have inaccurate or incomplete data put right.
• Deletion: have your data deleted, for example when we no longer need it.
• Restriction: ask us to limit how we use your data, for example while we check that it is accurate.
• Objection: object to our use of your data where we rely on legitimate interests. You can always stop direct marketing, such as our newsletter.
• Portability: get the data you gave us in a common digital format, or have it sent to another organisation, where we rely on consent or contract.
• Withdrawing consent: where we rely on your consent, withdraw it at any time.
• Automated decisions: not be subject to decisions made only by automated means that have legal or similarly significant effects on you. We do not make decisions like this.

How to use your rights

Email us at [PLACEHOLDER: privacy contact email], use our contact form and choose "A data protection request", or write to us at our address above. Tell us which right you want to use and, if you can, which data it is about.

• It is free in most cases.
• We will reply within one month. If your request is complex, or you send us several, we may need up to two more months. If so, we will tell you within the first month.
• We may ask you to confirm who you are, or to tell us more about what you are asking for. The time limit is paused until we have what we need. Usually, writing from the email address we already hold is enough.
• We will make reasonable and proportionate searches for your data.

Complaints

Complain to us

If you are unhappy with how we have handled your personal data, please tell us. You can email [PLACEHOLDER: privacy contact email], use our contact form and choose "A complaint", or write to us at our address above. You do not need to use any particular words or form.

What happens next:

1. We acknowledge your complaint within 30 days of receiving it.
2. We look into it without undue delay, and may ask you for more information.
3. We keep you updated on our progress.
4. We tell you the outcome, and what we are doing about it.

[PLACEHOLDER: our target time for a full reply to a data protection complaint]

Complain to the Information Commission (ICO)

You also have the right to complain to the UK's data protection regulator, the Information Commission, which still uses the name ICO. The ICO usually asks people to raise their concern with the organisation first, so please give us the chance to put things right.

Website

ico.org.uk/make-a-complaint

Helpline

0303 123 1113

Post

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

[PLACEHOLDER: check the Information Commission's current contact details on ico.org.uk before launch]

Children

Evra is a shop for adults. Our baby range is for parents and carers to buy. We do not design the website for children, and we do not knowingly collect personal data from them. If you think a child has given us their details, please contact us and we will delete them.

How we protect your data

Every page of our website uses a secure, encrypted connection (HTTPS), and strict security settings limit what can run on our pages. Our forms are protected against spam. We limit access to personal data to the people who need it, and our providers must protect it under their contracts with us. [PLACEHOLDER: confirm that two-step sign-in is switched on for our Netlify, email and Google accounts]

No website can be completely secure. If a personal data breach puts your rights at risk, we will report it to the ICO within 72 hours where the law requires, and tell you without undue delay if the risk to you is high.

Changes to this notice

We will update this notice when the way we use personal data changes, for example before our checkout opens. The date at the top shows when it last changed. If a change significantly affects data you have already given us, we will tell you directly where we can.

Earlier versions:

• 14 October 2026: this version, written for the redesigned website.
• [PLACEHOLDER: earlier versions of our privacy notice, if they should be listed]