Legal

Privacy Policy

What we collect, why we collect it, who we share it with, and what you can tell us to do about it. Written to be read, not to be survived.

Last updated: 11 August 2026

1. Who we are

Ashvane is a trading name of AB Business Advisory Ltd (trading as Ashvane), a company registered in England & Wales under company number 17211240, registered office: 124-128 City Road, London, England, EC1V 2NX.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, AB Business Advisory Ltd is the data controller for the personal data described in this policy. That means we decide what data is collected and what happens to it, and we are accountable for it.

We have not appointed a Data Protection Officer, as we are not required to under Art. 37 UK GDPR. All privacy questions and rights requests are handled directly by the company's data protection contact:

Email: info@abbusinessadvisory.com — please put "Data protection" in the subject line
Telephone: +44 7849 539538
Post: AB Business Advisory Ltd, 124-128 City Road, London, England, EC1V 2NX

2. What we collect and why

We collect only what we need to sell you a sofa and keep our records straight. We do not buy personal data, and we do not sell or rent yours to anyone. Below is every purpose for which we use personal data, the lawful basis for it, and how long we keep it.

Taking and fulfilling your order

What we collect: Name, email address, delivery address, telephone number, your sofa configuration, payment references
Lawful basis: Performance of a contract (UK GDPR Art. 6(1)(b))
How long we keep it: 6 years from the end of the tax year in which the order completes, to meet HMRC record-keeping duties and to cover the limitation period for claims under the Consumer Rights Act 2015

Customs clearance and import declarations

What we collect: Recipient name, delivery address, order value and product description
Lawful basis: Legal obligation (Art. 6(1)(c)) and performance of a contract (Art. 6(1)(b))
How long we keep it: 6 years, as required for customs and tax records

Sending your welcome-offer discount code

What we collect: Email address, and your name if you choose to give it
Lawful basis: Consent (Art. 6(1)(a)) — given when you submit the form
How long we keep it: Until you unsubscribe, or after 24 months of no engagement, whichever is sooner

Marketing emails about new models, leathers and offers

What we collect: Email address, name, and which emails you opened or clicked
Lawful basis: Consent (Art. 6(1)(a)); or the soft opt-in under PECR Reg. 22(3) where you have bought from us and we email you about similar products, always with an unsubscribe link
How long we keep it: Until you unsubscribe, or after 24 months of no engagement

Answering enquiries sent through the contact form or by email

What we collect: Name, email address, the content of your message
Lawful basis: Legitimate interests (Art. 6(1)(f)) — responding to someone who has contacted us; or Art. 6(1)(b) where the enquiry precedes an order
How long we keep it: 24 months from our last exchange

Trade and wholesale enquiries

What we collect: Name, work email address, business and project details
Lawful basis: Legitimate interests (Art. 6(1)(f)) — pursuing a business-to-business relationship you initiated
How long we keep it: 36 months from our last exchange

Preventing payment fraud and chargeback abuse

What we collect: Transaction details, IP address, device and browser characteristics, billing/shipping mismatch signals
Lawful basis: Legitimate interests (Art. 6(1)(f)) — protecting the business against fraudulent orders; and legal obligation for anti-fraud record-keeping
How long we keep it: As long as Stripe retains the transaction record, and 6 years for our own order record

Honouring your guarantee and handling faults or complaints

What we collect: Order record, correspondence, photographs you send us of a fault
Lawful basis: Performance of a contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c))
How long we keep it: 11 years from delivery — the 10-year frame guarantee plus one year for claims arising at the end of it

Understanding how the website is used

What we collect: Aggregate, non-identifying page-view statistics
Lawful basis: Legitimate interests (Art. 6(1)(f)) — our analytics tool sets no cookies and does not identify you, so no consent is required under PECR
How long we keep it: Aggregate statistics only, retained indefinitely; no personal data is held

Advertising and measuring advertising (not currently active)

What we collect: Cookie and device identifiers, pages viewed, whether you completed an order
Lawful basis: Consent (Art. 6(1)(a)) and PECR Reg. 6 — nothing will be set or read until you accept it in our cookie banner
How long we keep it: Per the advertising platform, typically up to 24 months

Data we do not collect

We never see or store your full card number, expiry date or security code. Card details are entered directly into Stripe's hosted checkout; they do not pass through our website or our servers. We also do not collect special category data (such as health or ethnicity), and we ask that you do not send it to us.

Automated processing

Stripe Radar automatically scores every transaction for fraud risk and may decline a payment. This is automated processing, but it is not a decision made solely by automated means with legal or similarly significant effects on you: if a payment of yours is declined, you can email us and a person will look at it. You are not profiled for any purpose other than fraud prevention, and we do not use your data to make automated decisions about pricing.

If you don't give us the data

Where we ask for data to perform a contract — your name, email and delivery address — we cannot process your order without it. Everything else on our forms is optional, and marked as such.

3. Who we share your data with

We use a small number of service providers who process personal data on our instructions, under written contracts that meet Art. 28 UK GDPR. They may only use your data to provide their service to us — never for their own purposes. This is the complete list as at the date above:

Who	What they do for us	What they receive	Where they process it
Stripe Payments Europe, Ltd. / Stripe, Inc.	Payment processing, fraud screening (Stripe Radar), invoicing for the balance payment	Name, email, billing and shipping address, card details (entered directly with Stripe — never on our servers), transaction amounts, device and IP data for fraud checks	Ireland, with transfers to the USA
Resend (Plus Five Five, Inc.)	Sending transactional order emails and the welcome-offer code	Name, email address, order reference and order summary	USA
Netlify, Inc.	Website hosting, form submissions (contact, trade, welcome offer), spam filtering, server logs	Form contents you submit, IP address, browser user-agent, pages requested	USA, with a global content delivery network
Neon, Inc.	Hosted PostgreSQL database holding the order record	Name, email, shipping address, order configuration, order status, Stripe reference IDs	European Union
Our freight forwarder and UK delivery carrier	International freight, customs clearance as importer of record, and two-person home delivery	Recipient name, delivery address, contact telephone number, order reference	India and the United Kingdom
WhatsApp Ireland Ltd (Meta)	Optional enquiry channel — only if you choose to message us on WhatsApp. We never start the conversation.	Your phone number, WhatsApp profile name and the content of the messages you send us	Ireland, with transfers to the USA and other countries where Meta operates
Plausible Insights OÜ	Website analytics — aggregate visit counts and page popularity	No cookies and no personal data: Plausible records page views without identifying or tracking individual visitors	European Union (Estonia / Germany)

We may also disclose data to our accountants and, if we ever needed to, to our legal advisers, insurers, or a court or regulator where we are legally required to. If the business were sold or restructured, order records would transfer to the buyer as part of it; you would be told before that happened.

Stripe also acts as a data controller in its own right for fraud prevention and regulatory compliance. Its handling of your data in that capacity is governed by the Stripe Privacy Policy.

4. Sending data outside the UK

Some of our providers are based outside the UK, as shown in the table above. Where personal data leaves the UK, we rely on one of the following safeguards under Chapter V UK GDPR:

Adequacy regulations — for transfers to the European Union and to organisations certified under the UK Extension to the EU–US Data Privacy Framework.
The International Data Transfer Addendum to the EU Standard Contractual Clauses, where adequacy does not apply, together with a transfer risk assessment.
Necessity for the contract (Art. 49(1)(b)) — for the limited transfer of delivery details to the workshop and freight forwarder in India, without which your sofa cannot be built or shipped.

You can ask us for a copy of the relevant safeguards by emailing info@abbusinessadvisory.com.

5. Cookies and tracking

We keep this deliberately minimal. At present the only storage we use is what the site needs to work — remembering the contents of your basket — plus a cookieless analytics tool that cannot identify you. Because none of that is used for advertising or tracking, no consent banner is required for it under the Privacy and Electronic Communications Regulations 2003.

If and when we start advertising, advertising cookies and pixels will be blocked until you accept them, and you will be asked through a consent banner with a genuine choice to refuse. The full detail, including how to change your mind, is in our Cookie Policy.

6. How we protect your data

The whole site is served over HTTPS; form submissions and payments are encrypted in transit.
Card data never touches our systems — payments are handled entirely by Stripe, which is certified to PCI DSS Level 1.
Access to the order database and email systems is limited to the people who need it, protected by unique credentials and multi-factor authentication.
Our database is encrypted at rest and backed up by our hosting provider.
Payment webhooks are cryptographically signature-verified, so order records cannot be forged.

No system is perfectly secure. If a personal data breach occurred that was likely to result in a risk to your rights, we would report it to the ICO within 72 hours and tell you without undue delay where the risk to you was high.

7. Your rights

Under UK GDPR you have the following rights, free of charge:

Access — ask for a copy of the personal data we hold about you.
Rectification — have inaccurate data corrected or incomplete data completed.
Erasure — have your data deleted, where we no longer need it. Note that we cannot delete order and tax records before our 6-year retention period ends, as we are legally required to keep them.
Restriction — ask us to pause processing while a dispute about accuracy or our grounds is resolved.
Portability — receive the data you gave us in a structured, machine-readable format, or have it sent to another provider.
Objection — object to processing based on our legitimate interests. You have an absolute right to object to direct marketing, and we will stop immediately.
Withdrawing consent — where we rely on consent, you can withdraw it at any time. Use the unsubscribe link in any marketing email, or email us. Withdrawal does not affect processing that already happened.
Automated decision-making — you are not subject to decisions made solely by automated means with legal or similarly significant effects.

To exercise any of these, email info@abbusinessadvisory.com. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if we do. We may ask you to confirm your identity before releasing data — that protects you, not us.

8. Children

Our products are sold to adults and our website is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, email us and we will delete it.

9. Complaints

If you are unhappy with how we have handled your personal data, please tell us first — email info@abbusinessadvisory.com and we will investigate and reply.

You also have the right to complain directly to the UK supervisory authority at any time, and you do not have to come to us first:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
https://ico.org.uk/make-a-complaint/

10. Changes to this policy

We will update this policy when what we do with data changes — for example, if we add a new service provider or start advertising. The "last updated" date at the top always reflects the current version. If a change materially affects how we use data you have already given us, we will email you about it rather than rely on you noticing.