Política de privacidade

This Privacy Notice explains how MV EDUCATION LTD, trading as Alder & Rose (“we”, “us”, “our”), collects, uses, shares and protects your personal data when you visit alderandrose.shop, place an order, register an account, or otherwise engage with our brand. It is written to comply with the United Kingdom General Data Protection Regulation as it forms part of UK domestic law by virtue of the Data Protection Act 2018 (“UK GDPR”), the Privacy and Electronic Communications Regulations 2003 (“PECR”), and, where applicable, the EU GDPR (Regulation 2016/679), the Swiss Federal Act on Data Protection (revFADP), and the California Consumer Privacy Act as amended by the CPRA (“CCPA/CPRA”).

1. Data controller and contact details

The data controller responsible for your personal data is:

• Legal entity: MV EDUCATION LTD (trading as Alder & Rose)
• Companies House registration: 17028593, registered in England and Wales
• Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
• Privacy enquiries / DPO mailbox: contact@alderandrose.shop

We intend to notify the Information Commissioner’s Office (“ICO”) and obtain a data protection fee registration where the volume of processing activity makes this required under the Data Protection (Charges and Information) Regulations 2018. We have not appointed a statutory Data Protection Officer because we do not meet the thresholds in Article 37 UK GDPR; however, the mailbox above is a single, monitored channel for all privacy enquiries.

2. Categories of personal data we process

3. Purposes and lawful bases (Article 6 UK GDPR)

Where we rely on legitimate interests, we have completed a Legitimate Interests Assessment that balances our purpose against your rights and freedoms. You may request a summary by contacting us.

4. Sources of personal data

Most data comes directly from you when you place an order, register an account, contact us, or subscribe to communications. Some technical and usage data is collected automatically through cookies and similar technologies (see our Cookie Policy). Limited data may come from third parties such as payment processors confirming an authorisation, couriers updating delivery status, or fraud prevention partners returning a risk score.

5. Recipients and sub-processors

We share personal data only with vetted recipients under written data processing agreements. The principal recipients are:

We do not sell your personal data and do not share it with third parties for their own independent marketing purposes.

6. International transfers

Where personal data is transferred outside the United Kingdom, we rely on a lawful transfer mechanism under Articles 44–49 UK GDPR:

• Transfers to the European Economic Area, Switzerland and other jurisdictions covered by UK adequacy regulations are made on the basis of those adequacy decisions.
• Transfers to the United States are made under the UK Extension to the EU–US Data Privacy Framework where the recipient is certified, or under the ICO’s International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses with the UK Addendum where it is not.
• We document supplementary measures following our Transfer Impact Assessments, including encryption in transit and at rest, pseudonymisation, contractual onward-transfer restrictions, and challenge of unlawful government access requests.

You may request a copy of the relevant safeguards by writing to contact@alderandrose.shop.

7. Retention schedule

At the end of the retention period we either delete the data or irreversibly anonymise it for statistical use.

8. Your rights under UK GDPR

You have the right to: be informed; access your data; rectify inaccurate data; erase data (“right to be forgotten”); restrict or object to processing; data portability; and object to direct marketing at any time. Where processing relies on consent, you may withdraw it without affecting the lawfulness of prior processing.

To exercise any right, email contact@alderandrose.shop. We will verify your identity proportionately and respond within one calendar month, extendable by two further months for complex requests under Article 12(3) UK GDPR. There is no fee unless the request is manifestly unfounded or excessive.

If you are not satisfied, you may lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk. We would, however, appreciate the opportunity to address your concerns first.

9. Children

Our website and products are directed at adults. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us so we may delete it.

10. Automated decision-making and profiling

We carry out limited automated fraud screening on payment transactions through Shopify Payments, Stripe and PayPal. These checks return a risk score that may decline a transaction. The decision does not produce legal effects on you, you may reattempt with an alternative method, and a human will review on request. We do not carry out profiling that produces legal or similarly significant effects within the meaning of Article 22 UK GDPR.

11. Security measures

• TLS 1.2+ encryption in transit across the entire storefront and checkout.
• Card data tokenised inside the PCI DSS Level 1 environments of Shopify Payments, Stripe and PayPal — never stored on our servers.
• Encryption at rest on platform databases, role-based access control, and least-privilege principle.
• Multi-factor authentication on all administrative accounts.
• Logging, monitoring, vulnerability management and patching of the underlying platform.
• Background checks and confidentiality undertakings for personnel handling customer data.

12. Personal data breaches

If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO without undue delay and within 72 hours where feasible, in accordance with Article 33 UK GDPR. Where the breach is likely to result in a high risk, we will inform affected data subjects without undue delay under Article 34, with clear remediation guidance.

13. California residents (CCPA / CPRA)

If you are a California resident, you have the right to know the categories and specific pieces of personal information we collect, the sources, the purposes and the categories of recipients; to request deletion; to correct inaccurate information; to opt out of the “sale” or “sharing” of personal information for cross-context behavioural advertising; and to non-discrimination for exercising these rights. We do not sell personal information for monetary consideration. Where the cookies described in our Cookie Policy may amount to “sharing”, you may opt out via the cookie banner or a Global Privacy Control signal. To make a verifiable consumer request, email contact@alderandrose.shop with the subject line “California Privacy Request”. Authorised agents must provide written permission and proof of identity.

14. EU representative (Article 27 EU GDPR)

Where our processing is subject to the EU GDPR because we offer goods to data subjects in the European Union, we will appoint an Article 27 representative established in the Union. Until appointment is finalised, the contact point for EU residents remains contact@alderandrose.shop and we cooperate fully with EU supervisory authorities.

15. Marketing and the PECR soft opt-in

We send transactional messages (order confirmation, shipping updates, returns acknowledgements) on the basis of contractual necessity. Where you have purchased a similar product, we may send marketing emails on the PECR Regulation 22(3) soft opt-in basis; every message contains an unsubscribe link and an opportunity to refuse at the point of collection. SMS, push and prospect-list emails are sent only with your prior consent.

16. Updates and version history

We review this notice at least annually and whenever processing changes materially. The current version is 1.0 dated 9 May 2026. Material changes will be notified by email to active customers and through a banner on the storefront.

17. Related policies

• Terms & Conditions
• Cookie Policy
• Refund Policy
• Returns & Exchanges
• Shipping & Delivery

For any privacy or data protection enquiry, please write to contact@alderandrose.shop.