#1. Why this notice exists
We are established in Pakistan, sell in Pakistani rupees, and deliver within Pakistan. We do not target the EEA or the UK: there is no local-currency pricing, no EU shipping option, and no advertising aimed at those markets.
Even so, Article 3(2)(b) of the GDPR catches the monitoring of behaviour of people in the Union — and an analytics tag or an advertising cookie loading for a reader in Dublin is exactly that. Rather than take the convenient view, we apply the GDPR to those visitors and set this out.
If you place an order from within the EEA or UK for delivery in Pakistan, this notice covers the personal data involved in that order too.
#2. Controller, and Article 27 representative
Controller: VEVARTE, E-100/14, Lower Ground, Main Boulevard, DHA, Lahore, Pakistan. Contact for all data-protection matters: privacy@vevarte.com.
We have not appointed a Data Protection Officer. Article 37 does not require one here — our core activities are selling furniture, not large-scale monitoring or processing of special-category data — and appointing a nominal one would suggest a scrutiny that does not exist. Responsibility sits with Ahsan Raza Khokhar directly.
#3. Legal bases, purpose by purpose
| Processing | Article 6 basis | Notes |
|---|---|---|
| Fulfilling an order you placed | 6(1)(b) contract | Without it we cannot deliver |
| Keeping invoices and tax records | 6(1)(c) legal obligation | Pakistani tax law; survives a deletion request |
| Answering your enquiry | 6(1)(b) or 6(1)(f) | Contract if pre-contractual, otherwise legitimate interests |
| Analytics cookies | 6(1)(a) consent | Denied by default; withdrawable in one click |
| Advertising cookies and personalisation | 6(1)(a) consent | Denied by default. Also governed by Google’s EU user consent policy |
| Email and WhatsApp marketing | 6(1)(a) consent | Opt-in only. Article 21(2) objection is absolute and honoured immediately |
| Fraud prevention and site security | 6(1)(f) legitimate interests | Balancing test recorded; available on request |
| Establishing or defending a legal claim | 6(1)(f) legitimate interests | Recital 47 |
We process no special-category data under Article 9, and carry out no automated decision-making producing legal or similarly significant effects under Article 22.
#4. Your rights under Chapter III
- Article 15 — access. Confirmation of whether we process your data, a copy of it, and the information in this notice.
- Article 16 — rectification. Correction of inaccurate data, and completion of incomplete data.
- Article 17 — erasure. Deletion where the data is no longer necessary, consent is withdrawn, or processing was unlawful. Records we must keep for tax law are the exception, and we will identify precisely which.
- Article 18 — restriction. Processing frozen while accuracy or lawfulness is contested.
- Article 20 — portability. Data you gave us, processed by consent or contract, delivered as structured, machine-readable JSON or CSV — or sent directly to another controller where technically feasible.
- Article 21 — objection. To legitimate-interests processing on grounds relating to your situation. For direct marketing there are no grounds to argue: we stop.
- Article 7(3) — withdrawal of consent. At any time, as easily as it was given, without affecting prior lawfulness.
- Article 77 — complaint. To a supervisory authority, directly, at any time.
Write to privacy@vevarte.com. We respond within 21 days — inside the one-month Article 12(3) limit — and if a request is complex enough to need the two-month extension we will tell you why before the first month is out. No fee.
#5. International transfers
Personal data is stored in the United States — Google's Firestore `nam5` multi-region, with server logic in `us-central1` — and is accessed from Pakistan, where we are. Both legs are transfers for GDPR purposes and both are covered below. Pakistan holds no adequacy decision from the European Commission or the UK government.
| Transfer | Destination | Mechanism |
|---|---|---|
| To Google LLC — hosting, database, storage, analytics, advertising | United States | EU-U.S. Data Privacy Framework (Google LLC is self-certified), plus the Standard Contractual Clauses in Google’s Data Processing Terms and the UK International Data Transfer Addendum as a fallback |
| To us, as controller, reading an order | Pakistan | Article 49(1)(b) — necessary for the performance of a contract you requested. For anything not contract-necessary, we do not make the transfer |
| To delivery crews and couriers | Pakistan | Article 49(1)(b), and only the name, address and phone number the delivery requires |
Supplementary measures, since the DPF and the SCCs are paper and the Schrems II line of reasoning asks what actually protects the data: encryption in transit and at rest; access limited by role and enforced in the database rather than in the interface; card data never reaching our systems at all; a published commitment to resist overbroad government demands; and no routine transfer of EEA or UK data beyond what a specific order requires.
A transfer impact assessment covering these routes is on file. Ask at privacy@vevarte.com and we will send it.
#7. ePrivacy, and Google’s EU user consent policy
The ePrivacy Directive, as implemented locally and as PECR in the UK, requires consent before storing or accessing information on your device for anything other than a strictly necessary purpose. The Cookie Policy sets out how that consent is obtained here.
Google additionally requires publishers serving EEA or UK traffic to obtain consent for cookies and personalised advertising, to disclose the vendors involved, and to pass those signals through a Google-certified consent management platform participating in the IAB Transparency & Consent Framework. Advertising is not active on this site at present. Before it is enabled for EEA or UK traffic, a certified CMP will be in place — our own banner already implements Consent Mode with everything denied by default, which is the substance of the requirement.