GDPR
Our Approach to Personal Data Protection
At Erinrovia, we recognize the importance of handling personal information responsibly. This policy explains how personal data may be collected, used, stored, disclosed, and protected when you visit our website, place an order, or communicate with our customer support team.
The General Data Protection Regulation (GDPR) applies only where its territorial and other legal requirements are met. This policy describes the rights available under the GDPR when applicable and does not suggest that every provision applies to every visitor or transaction.
Personal Information We May Process
Depending on how you interact with our website, the information we process may include your name, email address, telephone number, billing and delivery address, order details, payment-related transaction information, customer service correspondence, and technical information associated with your use of the website.
We aim to collect only information that is reasonably relevant to the purposes for which it is needed. We do not request sensitive personal information unless it is necessary, lawful, and appropriate for a specific purpose.
Purposes and Legal Grounds for Processing
Personal data may be processed to manage purchases, arrange deliveries, respond to customer inquiries, process eligible cancellations and refunds, maintain website functionality, prevent fraud, protect transactions, and meet applicable legal obligations.
Where the GDPR applies, the legal basis for processing may include the performance of a contract, compliance with a legal obligation, legitimate interests that do not override your rights and freedoms, or your consent where consent is required or relied upon.
If processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
Sharing and Disclosure of Information
Personal information may be shared with service providers when reasonably necessary to operate the website and fulfill customer requests. Depending on the services actually used, these providers may assist with payment processing, order fulfillment, shipping, website hosting, technical support, or customer communications.
Information may also be disclosed when required by law, in response to valid legal processes, or when reasonably necessary to protect legal rights and prevent fraud or security incidents.
We do not describe a particular third-party provider as a recipient of personal information unless that provider is actually used for the relevant purpose. Information shared with service providers should be limited to what is reasonably necessary for the service, subject to applicable legal requirements.
International Data Transfers
Personal data may be processed in a country different from the country where you reside, depending on the location of our service providers and the systems used to support website operations.
Where the GDPR applies and personal data is transferred outside the European Economic Area, the transfer must comply with applicable GDPR requirements. Depending on the circumstances, this may require an adequacy decision, appropriate safeguards, or another lawful transfer mechanism.
We do not claim that a particular international transfer mechanism or certification is in place unless it has been verified for the relevant processing activity.
Data Retention and Security
Personal information is retained for as long as reasonably necessary for the purposes for which it was collected, including order administration, customer support, recordkeeping, dispute resolution, and compliance with applicable legal obligations.
The appropriate retention period depends on the type of information, the purpose of processing, and relevant legal requirements. Information that is no longer required should be deleted or otherwise handled in accordance with applicable retention obligations.
We use reasonable measures intended to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no method of electronic transmission or storage can be guaranteed to be completely secure.
Your Rights Under the GDPR
Where the GDPR applies to the processing of your personal data, you may have the following rights, subject to the conditions and exceptions set out in the law:
Right to be informed: You may request clear information about how your personal data is processed.
Right of access: You may request confirmation of whether your personal data is being processed and obtain access to eligible information.
Right to rectification: You may ask for inaccurate or incomplete personal data to be corrected.
Right to erasure: You may request deletion of your personal data in circumstances provided for by law.
Right to restriction: You may request that certain processing activities be restricted where the legal conditions are met.
Right to data portability: Where applicable, you may request personal data you provided in a structured, commonly used, machine-readable format and have it transmitted to another controller where the legal requirements are satisfied.
Right to object: You may object to certain processing based on legitimate interests and to processing for direct marketing, subject to applicable law.
Right to withdraw consent: Where processing relies on consent, you may withdraw it without affecting the lawfulness of processing performed before withdrawal.
Rights concerning automated decisions: Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.
These rights are not absolute in every situation. Some requests may be subject to legal exceptions, retention requirements, or the rights of other individuals.
Exercising Your Rights
To submit a data protection request, contact us using the email address listed below. Please describe the information or processing activity concerned and the right you wish to exercise.
We may request reasonable information to verify your identity and protect personal data from unauthorized disclosure. Please do not send passwords, full payment card details, or other unnecessary sensitive information with your request.
Where the GDPR applies, requests will be handled in accordance with its response deadlines and applicable exceptions. In general, a response is due without undue delay and within one month, subject to lawful extensions in qualifying circumstances.
Your Right to Complain to Data Protection Authorities
If you believe that the processing of your personal data violates the GDPR or other applicable data protection law, you may lodge a complaint with a competent data protection supervisory authority.
Where the GDPR applies, you may generally contact the supervisory authority in the European Union or European Economic Area country where you habitually reside, work, or where the alleged infringement occurred, subject to the applicable jurisdictional rules. You may also have the right to seek a judicial remedy under applicable law.
You are not required by this policy to contact us before approaching a competent supervisory authority. You may contact us voluntarily if you wish to give us an opportunity to review your concern, but doing so does not remove any statutory right to complain to a regulator.
Your Right to Contact U.S. Regulatory Authorities
Depending on the nature of your concern and the laws that apply, U.S. consumers may also contact relevant government authorities about privacy, data protection, or allegedly deceptive practices.
The Federal Trade Commission (FTC) accepts reports concerning certain unfair or deceptive business practices within its jurisdiction, including some privacy-related matters.
You may also contact the Attorney General's Office in your state or another relevant state privacy regulator if the matter falls within that authority's jurisdiction. The appropriate agency depends on the state, the type of concern, and the applicable law.
Contacting the FTC or a state authority does not guarantee that a complaint will be investigated or result in a particular outcome. These authorities determine whether and how to act under their respective powers. This policy does not require you to contact us before exercising any complaint right available to you under applicable law.
Children's Personal Information
Our website is intended for general shopping use and is not knowingly directed toward children in circumstances where parental authorization or other legal safeguards are required. We do not knowingly collect children's personal information in violation of applicable law.
If you believe a child has provided personal information inappropriately, please contact us so that we can review the circumstances and take appropriate action where required.
Cookies and Similar Technologies
Our website may use cookies or similar technologies to support website functions, remember preferences, maintain sessions, or perform other functions where implemented.
The technologies in use and the choices available to you may depend on the website configuration and applicable law.
Updates to This Policy
We may revise this policy when our data practices, website operations, or legal obligations change. The revised version will be published on this page with the updated content.
Changes will be applied in accordance with applicable law. If a change requires additional notice or consent, we will take the steps required by law.
Contact Information
For questions about personal data processing, requests to exercise privacy rights, or other data protection concerns, please contact us:
Email: info@erinrovia.com
Phone: +1 (352) 614-7829
Mailing Address: 7721 Sloewood Dr, Leesburg, FL 34748, United States
Customer Support Hours: Monday through Friday, 9:00 AM–6:00 PM Eastern Time (ET)