Privacy Policy

1. Scope of This Privacy Policy

This Privacy Policy describes how GRELVADO, LLC collects, uses, stores, safeguards, and shares personal information when customers visit grelvado.com, place an order, communicate with us, request a return or refund, or otherwise use our online store and related services.

The policy applies to information generated through website activity, customer accounts, order processing, communications, payment-related records, shipping, returns, refunds, and other activities connected with purchases made through grelvado.com.

By using the website or providing personal information to us, you acknowledge that your information may be processed as described in this Privacy Policy and in accordance with applicable privacy and data protection requirements.

2. Website Platform and Store Infrastructure

This website is a self-hosted store built on WordPress and powered by WooCommerce. The store operates using hosting infrastructure configured for the operation of grelvado.com rather than through a marketplace that independently controls the entire storefront.

WordPress provides the website content-management framework, while WooCommerce supports functions such as product listings, shopping carts, checkout, order administration, customer accounts, shipping records, tax-related settings, refunds, and transaction status information.

Although WordPress and WooCommerce are used to administer store activity, sensitive payment credentials are processed directly by authorized third-party payment providers rather than stored on our own website servers.

3. Information We Collect

Depending on your interaction with the website, information we collect may include your name, email address, telephone number, billing address, shipping address, order details, purchased products, order amount, selected shipping method, customer account information where applicable, and communications submitted to us.

Technical information may also be collected automatically, including IP address, browser and device information, operating system, referring pages, access times, website activity, session information, server logs, and security records used to operate and protect the website.

We seek to collect only information reasonably necessary for contractual, operational, security, customer-service, regulatory, or other legitimate purposes.

4. Information Collected When You Place an Order

When an order is placed through grelvado.com, we collect information required to create, verify, process, fulfill, deliver, and provide support for that order.

This may include the customer's name, contact details, billing and shipping addresses, products and quantities ordered, order total, selected delivery method, payment method type, order date, order status, shipping status, tracking information, and related customer-service records.

This information is used to perform the purchase transaction, reduce order errors, provide delivery and tracking services, administer returns and refunds, answer inquiries, and maintain appropriate transaction records.

5. Customer Accounts and Communications

Where customer account functionality is offered and you choose to create an account, we may retain information necessary to provide account services, including your name, email address, saved addresses, order history, and account preferences.

Passwords are not intended to be stored as readable plain text. WordPress uses password hashing and authentication mechanisms designed to protect customer credentials.

If you communicate with us by email, contact form, telephone, or another supported channel, we may retain the information submitted and our response where reasonably necessary to provide customer service, maintain service records, address complaints, or document matters involving orders, payments, refunds, returns, or legal obligations.

6. Technical, Log and Security Information

Our systems may automatically generate technical records when visitors use the website. Such records may include IP addresses, requested pages, browser data, timestamps, login activity, server responses, application errors, and security events.

These records may be used to maintain website availability, diagnose technical issues, detect fraud, prevent unauthorized access, investigate suspicious activity, respond to security threats, and protect our customers and systems.

Technical logs are not intended to collect full sensitive payment credentials and are retained only where reasonably necessary for legitimate operational, security, fraud-prevention, compliance, or legal purposes.

7. Cookies and Similar Technologies

Our WordPress and WooCommerce store may use cookies and comparable technologies that are necessary for shopping-cart functionality, checkout sessions, customer login, security functions, website preferences, and session management.

Certain third-party services integrated with the website may also use cookies or similar technologies according to their own policies. Where applicable law requires consent for non-essential technologies, consent will be requested before those technologies are activated.

Customers may manage certain cookies through their browser settings. Disabling essential cookies may prevent important website features, including cart, login, account, or checkout functionality, from operating correctly.

8. How We Use Personal Information

Personal information may be used to administer orders, verify transactions, arrange delivery, provide tracking information, communicate with customers, manage returns and refunds, provide customer support, maintain accounts, detect fraud, protect the website, satisfy legal obligations, and address transaction disputes.

Information may also be used to maintain and improve website operation, investigate technical problems, understand general store performance, prevent misuse, and maintain records required for accounting, taxation, compliance, and business administration.

We do not intentionally use customer information for purposes materially inconsistent with those described in this Privacy Policy unless an appropriate legal basis exists.

9. Legal Bases for Processing Personal Information

Where applicable law requires a lawful basis for processing personal information, processing may occur because it is necessary to perform a contract with you, comply with a legal obligation, protect against fraud or security threats, pursue a legitimate business interest, or because valid consent has been provided.

For example, order and delivery information is generally required to complete a purchase, while certain financial and transaction records may need to be retained for accounting or legal purposes. Security-related data may be processed based on our legitimate interest in protecting customers, our website, and our business.

Where processing relies on consent, consent may be withdrawn where legally permitted. Withdrawal does not affect processing that occurred lawfully before consent was withdrawn.

10. WordPress and WooCommerce Data Processing

WooCommerce processes information required to provide core e-commerce functionality, including shopping-cart activity, checkout, orders, refunds, delivery information, transaction status, and customer account records.

Our self-hosted WordPress environment may also maintain administrative records associated with website management, technical maintenance, system updates, security operations, and backups.

Access to customer information is limited to individuals and service providers who reasonably require access to operate the store, provide support, maintain security, meet legal obligations, or resolve transaction-related matters.

11. Stripe and PayPal Payment Processing

Payments completed through grelvado.com are processed by authorized third-party payment providers, including Stripe and PayPal.

Card transactions and supported digital wallet payments may be processed through Stripe, while PayPal payments are handled through PayPal's payment infrastructure. Depending on the payment option chosen, these providers may collect information necessary to authorize, authenticate, process, settle, refund, protect, or dispute a transaction.

The processing of payment credentials by Stripe and PayPal is subject to their respective privacy, security, and payment-service practices. GRELVADO, LLC does not control the independent internal processing systems operated by these providers.

12. Payment Information We Do Not Store

GRELVADO, LLC does not store customers' sensitive payment credentials on our website or servers.

We do not store full credit or debit card numbers, CVV or CVC codes, PayPal passwords, Apple Pay payment credentials, Google Pay payment credentials, or equivalent sensitive payment authentication information.

Sensitive credentials are transmitted directly to the applicable payment provider through secure payment interfaces and are processed by Stripe, PayPal, or another authorized provider involved in the transaction.

For legitimate order administration, accounting, refund, dispute-resolution, and fraud-prevention purposes, WooCommerce or a payment provider may supply us with limited transaction information such as the payment provider, transaction reference, authorization status, payment status, or refund status. Such information does not include complete card numbers, CVV codes, or payment-account passwords.

13. Payment and Information Security

We use reasonable technical and organizational safeguards intended to reduce the risk of unauthorized access, alteration, disclosure, destruction, loss, or misuse of personal information.

Our website uses HTTPS and SSL/TLS encryption to protect information transmitted between customers' browsers and the website. Sensitive payment credentials are transmitted through secure environments operated by Stripe, PayPal, and other applicable payment technology providers.

Payment providers may employ safeguards and technologies including tokenization, PCI DSS controls, encrypted communications, fraud detection systems, risk analysis, authentication mechanisms, and 3D Secure where supported or required.

Tokenization can reduce exposure of card information by replacing sensitive credentials with non-sensitive tokens or transaction references used to process authorized transactions without exposing the underlying payment-card number to our store.

14. Additional Data Protection Measures

In addition to encryption and secure third-party payment processing, we maintain reasonable administrative and technical controls intended to reduce unauthorized access to customer information.

Measures may include limited administrative access, role-based permissions, account authentication, least-privilege access, WordPress and WooCommerce updates, plugin and software maintenance, server protections, security monitoring, backup procedures, malware monitoring where available, and review of unusual account or transaction activity.

Customer information is made accessible only to individuals or authorized service providers who reasonably require it for legitimate operational or business purposes.

No online system can be guaranteed to be completely secure. Nevertheless, we take reasonable measures appropriate to the nature of the information and the risks associated with its processing.

15. Shipping and Logistics Providers

To fulfill worldwide orders, relevant delivery information may be shared with postal operators, shipping carriers, logistics providers, fulfillment partners, customs authorities, or authorized last-mile delivery services.

Information shared for delivery may include the recipient's name, shipping address, telephone number, email address where necessary, order or shipment reference, customs information, and other information reasonably required to transport or deliver the parcel.

Logistics providers receive only information reasonably necessary to complete delivery, comply with customs requirements, resolve transportation issues, or investigate lost or damaged shipments.

16. Fraud Prevention, Chargebacks and Payment Disputes

We may process and retain transaction information where reasonably necessary to identify fraud, investigate suspicious activity, respond to payment disputes, or support legitimate transactions.

If a customer initiates a payment dispute or chargeback through Stripe, PayPal, a bank, card issuer, or another payment provider, we may provide relevant transaction evidence to that provider.

Evidence may include order confirmation, transaction references, authorization status, billing or delivery information, technical records where lawfully available, tracking details, proof of delivery, customer communications, return records, refund records, and policies applicable to the transaction.

Such information is used only where reasonably necessary to respond to disputes, follow payment-provider procedures, prevent fraud, and protect legitimate rights. Nothing in this section removes any rights available to customers under applicable law or the rules of their payment provider.

17. European Union and European Economic Area — GDPR

Where a customer is located in the European Union or European Economic Area, processing of personal data may be subject to the General Data Protection Regulation (GDPR).

Under the GDPR, personal information is processed only where an appropriate legal basis exists. Depending on the circumstances, this may include performance of a contract, compliance with a legal obligation, legitimate interests, fraud and security prevention, or customer consent.

Where GDPR applies, we seek to follow principles including lawful and transparent processing, purpose limitation, data minimization, accuracy, storage limitation, confidentiality, integrity, and accountability.

Where reasonably possible, only information necessary for the relevant purpose is collected, and personal data is not retained longer than reasonably required for legitimate operational or legal purposes.

18. GDPR Data Subject Rights

Where the GDPR applies, customers may have rights to request access to personal data, correction of inaccurate information, deletion of eligible information, restriction of processing, objection to certain processing, and portability of eligible data.

Where processing is based on consent, customers may also withdraw consent at any time without affecting the lawfulness of processing performed before the withdrawal.

Certain rights may be subject to legal exceptions. For example, order, tax, accounting, fraud-prevention, refund, chargeback, or transaction records may need to be retained where required by law or reasonably necessary to establish, exercise, or defend legal claims.

To exercise a GDPR right, please contact us at help@grelvado.com. We may request reasonable information to verify identity before disclosing, correcting, restricting, or deleting personal information.

19. International Data Transfers

Because grelvado.com provides worldwide shipping and uses international technology, payment, and logistics providers, personal information may be transferred to or processed in jurisdictions outside the customer's country or region.

Stripe, PayPal, hosting providers, shipping carriers, logistics partners, or other authorized service providers may therefore process information in jurisdictions different from the customer's place of residence.

Where applicable law requires safeguards for international transfers, we take reasonable steps to use appropriate service providers and legally recognized transfer mechanisms, including contractual protections where appropriate.

20. Data Retention

We generally aim to retain ordinary customer and order-related personal information for approximately one year after the information is no longer actively required for the transaction or customer-service purpose for which it was collected.

Certain records may need to be retained for longer periods where necessary to comply with accounting, taxation, legal, fraud-prevention, payment-provider, chargeback, consumer-protection, or dispute-resolution obligations.

For example, information relating to an active Stripe or PayPal dispute, legal claim, refund investigation, tax obligation, or suspected fraudulent transaction may be retained until the matter and any legally required retention period have concluded.

When information is no longer reasonably required and no legal basis requires continued retention, we take reasonable steps to delete, anonymize, or securely dispose of it.

21. Children's Privacy and Data Breach Response

Our website is intended for general retail customers and is not directed specifically toward children who are below the minimum age required to enter into online transactions under applicable law.

We do not knowingly seek personal information from children for purposes unrelated to legitimate order fulfillment. Where we become aware that personal information was collected from a child in circumstances requiring parental or legal authorization and that authorization was not obtained, we will take reasonable steps to review and delete the information where legally appropriate.

If a personal data breach occurs that creates a legally relevant risk to individuals, we will investigate the incident, take reasonable measures to contain and remediate the issue, preserve appropriate security records, and notify affected individuals or regulatory authorities where required by applicable law, including the GDPR where applicable.

22. Privacy Policy Updates, Questions and Complaints

We may revise this Privacy Policy from time to time to reflect changes to our website, WordPress or WooCommerce functionality, payment providers, shipping arrangements, security practices, legal requirements, or data-processing activities.

The version published on grelvado.com will apply from its stated effective date. Where required by law, material changes may be communicated through the website or by another reasonable method.

If you have questions about this Privacy Policy, wish to exercise a privacy right, believe your information has been handled incorrectly, or wish to submit a privacy complaint, please contact us using the following information:

Company: GRELVADO, LLC
Address: 1 E Pratt St, Ste 400, Baltimore, MD 21202, US
Phone: +1(410)649-7450
Email: help@grelvado.com
Website: grelvado.com

Customers located in the European Union or European Economic Area may also have the right to lodge a complaint with the competent data protection supervisory authority in their country of residence, workplace, or the place where an alleged infringement occurred.

For information specifically concerning payment processing, please review our Payment Policy. For shipping and delivery practices, please review our Shipping Policy. For information about returns and refunds, please review our Refund and Returns Policy.