Privacy policy

Who is responsible for your data

The Last Avenue is a trading name of The Last Avenue Limited, which is the data controller for the personal data described here.

For any question about this policy, or to exercise a right set out below, write to customerservice@thelastavenue.com.

What we collect

We collect only what an order needs:

• Order and delivery details — your name, email address, telephone number and delivery address.
• Order contents — the fragrances you bought, the amount charged, the currency and the date.
• Payment confirmation — the payment reference, the result, and the card brand and last four digits.
• Correspondence — anything you write to us, kept so we can answer you and refer back to the conversation.

We never see or store your card number.Card details are entered directly into a payment form hosted by Stripe and go straight to Stripe. They do not pass through this website’s servers at any point.

We do not run advertising trackers, analytics or profiling on this site, and we do not buy or sell personal data.

Why we hold it, and our lawful basis

• To perform our contract with you — taking payment, packing and shipping your order, confirming it by email, and handling returns or refunds.
• To meet legal obligations — tax and accounting law requires us to keep records of sales.
• Our legitimate interests — preventing fraudulent payments and keeping the site secure.
• Your consent — marketing email, and only if you ticked the box at checkout. You can withdraw it at any time, in one click from any marketing email or by writing to us.

Who we share it with

We share the minimum necessary with a small number of processors who act on our instructions:

• Stripe — to take and secure your payment, and to process refunds. Stripe is an independent controller for its own fraud-prevention purposes; see stripe.com/privacy.
• Our delivery carriers — your name, address and telephone number, so your parcel can be delivered and tracked.
• Our email provider — to send your order confirmation and any reply to your questions.
• Our hosting provider — which operates the servers this site runs on.

We disclose data to anyone else only where the law requires it. We do not sell your data or share it for anyone else’s marketing.

Transfers outside the European Economic Area

Some of our providers process data outside the EEA, including in the United States. Where that happens, the transfer is covered by the European Commission’s standard contractual clauses or an equivalent safeguard, so your data keeps the protection it has here.

How long we keep it

• Order and payment records — seven years from the end of the tax year of the order, as tax law requires.
• Correspondence — two years from our last exchange, unless it relates to an order or a legal claim.
• Marketing consent — until you withdraw it, and we stop sending immediately when you do.

Your account

An account holds nothing beyond the order details already described above. There is no password: signing in means clicking a link we email to your address, so we never hold a credential that could be stolen from us or reused elsewhere.

When you place an order, the delivery name, telephone number and address you used are kept against your email address so a later checkout can be prefilled. Signing in with that address shows you those details and your order history, and nothing else.

A sign-in link is single-use and expires after 15 minutes. Being signed in sets one cookie on your device, which holds a random identifier and no personal data; signing out deletes it. Ask us at any time to erase your account and we will.

The bag and the currency you choose

This site sets no advertising or tracking cookies. It stores two small items in your own browser’s local storage: the contents of your shopping bag, and the display currency you selected. Both stay on your device, are never sent to us as a profile, and exist only so the site works as you expect. Clearing your browser storage removes them. The only cookie this site sets is the sign-in cookie described above, and only once you have chosen to sign in.

To show prices in a sensible currency we read your device’s time zone and language, and where our host provides one, a country code derived from your connection. This is used for the currency default only, it is not stored, and you can override it with the currency selector at any time.

Your rights

Under the GDPR you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where we no longer need it and no legal duty requires us to keep it;
• restrict or object to how we use it;
• receive the data you gave us in a portable, machine-readable form;
• withdraw consent at any time, where consent is the basis;
• complain to a supervisory authority. In Ireland this is the Data Protection Commission, dataprotection.ie.

To exercise any of these, write to customerservice@thelastavenue.com. We will respond within one month, and we will not charge you for it.

Security

The site is served over HTTPS throughout. Payment details are handled entirely by Stripe on PCI-DSS certified infrastructure. Access to order data is limited to the people who need it to fulfil your order.

Children

This site is not intended for children, and we do not knowingly collect data from anyone under 16.

Changes to this policy

If we change how we use personal data, we will update this page and the date above. Material changes affecting an order you have already placed will be sent to you by email.

See also our terms and conditions.