Skip to content
Cartio
0

Privacy Policy

Last updated: 30 October 2026

1. Who we are

This Privacy Policy explains how Cartio ("Cartio", "we", "us") collects and uses personal data when you use cartio.uk, buy from us, create an account, check out as a guest or contact us. Inovera Limited, trading as Cartio, is the controller of your personal data.

Legal entity: Inovera Limited (private limited company)
Registered / trading address: Edinburgh, United Kingdom
Company number: 874398
Email: support@cartio.uk

2. Personal data we collect

Account customers: name, email address, password (stored only as a secure one-way hash), phone number, saved delivery addresses, wishlist, order history, returns and preferences. If you sign in with Google we receive your name, email address and profile picture from Google; we do not receive your Google password.

Guest checkout customers: name, email address, phone number, delivery address, postcode, delivery instructions and order details. We do not create an account for guests. To let guests view previous orders and invoices, we send a one-time verification code to the email address used at checkout.

Order and invoice information: products purchased, prices, discounts, delivery charges, order and invoice numbers, payment status and payment references, delivery deadlines and fulfilment history, refunds and credit notes.

Payment information: card payments are processed by Stripe. Cartio does not see or store your full card number or security code. We receive limited information from Stripe such as payment status, a payment reference and amount.

Delivery and postcode information: when you check a postcode or check out, we validate the postcode using the Postcodes.io service and compare it with our approved delivery areas. We record delivery status, delivery notes and, where used, proof of delivery.

Returns: the items, reasons, descriptions and any photographs you choose to upload.

Communications: messages you send through our contact form or by email, including any order number you provide.

Cartio Business interest registration: business name, contact name, business email, phone number, product category, website, comments, your privacy acknowledgement and any optional marketing consent.

Cookies, analytics and advertising: your cookie choices; with your consent, information about pages and products viewed, searches, basket and checkout events and campaign parameters (such as utm_source); with advertising consent, Meta Pixel data described in section 6.

Technical and security data: limited technical information such as IP address (used for security and rate limiting) and session identifiers.

3. How we use your data and our legal bases (UK GDPR)

  • Performing our contract with you — processing and delivering orders, payments, invoices, returns, refunds, guest order access and customer support.
  • Legal obligations — keeping accounting and tax records, handling consumer rights requests and responding to lawful requests.
  • Legitimate interests — preventing fraud and abuse, securing our website, improving our service, handling Cartio Business enquiries and keeping essential records of staff actions. We balance these interests against your rights.
  • Consent — optional analytics and advertising cookies/technologies, marketing emails and optional Cartio Business updates. You can withdraw consent at any time.

4. Service providers and data sharing

We share personal data only as necessary with: Stripe (payment processing and refunds); our transactional email provider(s) — currently the managed email service (Resend) provided through our hosting platform — to send order confirmations, delivery, refund and verification emails from support@cartio.uk; our hosting, database and file-storage providers; Postcodes.io (postcode only); Google (if you choose Google sign-in); Meta Platforms (only with advertising consent); professional advisers; and authorities where required by law. We do not sell your personal data.

5. International transfers

Some providers (for example Stripe, Google and Meta) may process data outside the UK, including in the USA. Where this happens we rely on appropriate safeguards such as the UK International Data Transfer Agreement or Addendum, the UK Extension to the EU–US Data Privacy Framework where applicable, or adequacy regulations. You can ask us for more details at support@cartio.uk.

6. Cookies, Meta Pixel and advertising

We use strictly necessary technologies for sign-in, your basket and checkout. With your consent we use preferences, analytics and advertising technologies. Our advertising technology is the Meta Pixel and, where configured, the Meta Conversions API, which help us measure our Facebook and Instagram advertisements. These only operate after you accept advertising cookies; purchase events are only sent after a payment is verified. Where sent, your email is hashed before transmission. See our Cookie Policy and change your choices at any time via "Cookie Settings" in the footer.

7. Data security

We use HTTPS encryption, hashed passwords, access controls with role-based staff permissions, time-limited verification codes, signed payment notifications, rate limiting and audit logs. No system is completely secure; we will notify you and the ICO of personal data breaches where required by law.

8. How long we keep data

  • Orders, invoices, credit notes and payment records: 6 years after the end of the financial year (tax and accounting requirements).
  • Customer accounts: while your account is active; on request we anonymise account data while keeping legally required financial records.
  • Support enquiries and returns: up to 2 years after resolution.
  • Cartio Business interest registrations: until the programme launches or up to 2 years, unless you ask us to delete them sooner.
  • Guest verification codes: 10 minutes; verified guest sessions: 1 hour.
  • Cookie choices: stored on your device for up to 12 months, after which we ask again.

9. Your rights

Under UK data protection law you have the right to: access your data; rectification; erasure; restriction; object to processing (including absolutely to direct marketing); data portability; and to withdraw consent at any time without affecting earlier lawful processing. Email support@cartio.uk. We will respond within one month (extendable where permitted). We may need to verify your identity.

10. Complaints

Please contact us first at support@cartio.uk. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.

11. Children

Our website is not intended for children under 18 and we do not knowingly collect their data.

12. Changes

We may update this policy. The "last updated" date shows the latest version.