Privacy notice
1. Who we are
Wexfur Limited (a private company limited by shares), trading as Wexfur, is the data controller for personal data collected through wexfur.com. Our registered address is 15 Beechgrove, Clones, Co. Monaghan, H23 XT99, Ireland. For any privacy question or request, contact privacy@wexfur.com.
Wexfur Limited operates this website on the ZLVA storeHub platform (ZLVA Ltd), which acts as a processor on our instructions. The site runs on Cloudflare's edge network, which processes request data as a sub-processor.
2. What we collect, why, and on what lawful basis
| Data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
Guest identifier (random UUID in the sh_guest cookie) | Keeping your cart and saved items attached to this browser | Legitimate interests (Art. 6(1)(f)), operating a working shop |
| Account: your email address, your name if you give one, your saved delivery addresses, and when you last signed in | Letting you sign in, see your orders and fill in checkout for you | Contract (Art. 6(1)(b)) |
Account session (random token in __Host-sh_customer; only a fingerprint of it is stored on our side) | Keeping you signed in | Contract (Art. 6(1)(b)) |
| Sign-in codes and attempt counts (a fingerprint of each code, of the email address and of the IP address that asked) | Checking the code you type and stopping anyone guessing codes or flooding an inbox | Legitimate interests (Art. 6(1)(f)), account security |
| Bag and saved items (browser localStorage, not sent to us) | Remembering what you were shopping for | Legitimate interests (Art. 6(1)(f)) |
| Technical request data (IP address, user agent, country, timestamps) | Security, rate limiting against scrapers, and fault diagnosis | Legitimate interests (Art. 6(1)(f)) |
| Page-load measurements by Cloudflare Web Analytics, added by our host: the page, the page you came from, how long it took to load, your browser type and country. No cookie is used | Seeing how fast the site loads | Legitimate interests (Art. 6(1)(f)), keeping the site working well |
| Mailing list: your email address, when you signed up and the page you signed up on | Sending you occasional emails from Wexfur, which you asked for | Consent (Art. 6(1)(a)), withdrawable at any time |
| Back in stock requests: your email address, the product you asked about and your language | Emailing you when that product is back in stock. ZLVA, our platform, keeps the request and sends the email | Consent (Art. 6(1)(a)), given by ticking the box, withdrawable at any time |
| Email you send us | Answering your question | Legitimate interests, or contract where it concerns an order |
3. What we do not collect
This site does not take orders or payments. Ordering is not switched on, so no payment card details, delivery addresses or order records are collected or stored by this website. No profile is built about you, no automated decision-making or profiling with legal effect takes place, and your data is not sold.
4. Cookies and local storage
We set only the storage the site needs to work. Nothing is optional, so we do not ask you to choose and we keep no record of a choice. The cookie policy lists every name, purpose and lifetime.
Cloudflare, which hosts this site, measures how fast our pages load with Cloudflare Web Analytics. It sets no cookie and stores nothing on your device, so it is not in the cookie table. Cloudflare says it does not use it to identify or follow visitors.
5. Who your data is shared with
- ZLVA Ltd, as platform processor, under a data processing agreement. ZLVA also keeps back in stock requests and sends those emails.
- Cloudflare, Inc., for hosting, edge delivery, denial-of-service protection and sending our emails.
- Nobody else, unless we are legally required to disclose it.
Where a processor operates outside the EEA, transfers rely on the European Commission's Standard Contractual Clauses together with supplementary measures.
6. How long we keep it
- Guest identifier: 12 months from your last visit.
- Account session: 14 days after you last visit, and 60 days at most, or until you sign out.
- Sign-in codes: 10 minutes, and removed within the hour after that. Attempt counts: 24 hours.
- Your account, saved addresses and mailing list place: until you delete your account, which you can do yourself on the account page. Deleting it also ends every sign-in.
- Orders placed with the same email are not part of the account. The record of a sale is kept for as long as the law requires; deleting your account removes your name and contact details from it.
- Bag and saved items: until you clear them or clear your browser storage.
- Technical logs: retained by our hosting provider on a short rolling window.
- Page-load measurements: held by Cloudflare for its reports. No cookie or ID is used, so they are not linked to you.
- Mailing list: until you ask to come off it. Reply to any email from us, or write to care@wexfur.com, and we will take you off straight away.
- Back in stock requests: sent straight to ZLVA. If ZLVA cannot take one at that moment, we keep it for up to 3 days while we try again, then delete it. ZLVA keeps the request, and a note of when it emailed you, with no set end date yet. The stop link in the email ends the request, and we will delete it if you ask.
- Email correspondence: kept while it is needed to resolve your query.
7. Your rights
Under the GDPR and the Data Protection Act 2018 you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time, without affecting processing before withdrawal.
Email privacy@wexfur.com to exercise any of these. We respond within one month.
If you have an account you do not need to ask: sign in and open Your details to download everything the account holds, or to delete it. Deleting the account removes your saved addresses, your sign-ins and your place on the mailing list. It does not delete the orders you have placed. We keep the record of a sale for as long as the law requires, and nothing on your account points at it.
8. Complaints
If you are not satisfied with our response you can complain to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, at dataprotection.ie. If you are in another EEA state you may complain to your local supervisory authority instead.
9. Changes
We review this notice when the site changes what it collects. The review date is at the top of this page.
