Privacy Policy

ENSOL is operated by the company identified at the foot of this page, which is the data controller for the information described here.

When you order: your name, email address, shipping address, telephone number, and the contents and total of your order.
When you create an account: your email address and a hashed password. We never store your password in readable form.
When you contact us: your name, email address, the content of your message, and the IP address the message was sent from. The IP address is used only to prevent abuse of the form — it is included in the notification our support team receives and is stored only in hashed form.
Automatically: the cookies described in section 6.
We never receive your card number.Card details are entered on Stripe’s payment page and are not transmitted to or stored by ENSOL.

To take and fulfill your order, to send order confirmations and delivery updates, to handle returns and refunds, to answer your enquiries, to keep the sales records required of us by law, and to detect and prevent fraud and abuse of our contact form. We use your data only for these purposes.

We share the minimum necessary with the providers that let us operate: Stripe (payment processing), our fulfillment partner and its carriers (to pick, pack and deliver your order), Resend (transactional email), Supabase (database hosting) and Vercel (application hosting). We do not sell or rent your personal information, and we do not share it for advertising.

Because we ship internationally and our providers operate globally, your data — in particular your name and delivery address — is transferred outside your country to the fulfillment centre and carrier handling your order. We share only what is needed to deliver it.

We use only the cookies needed for the store to work: one that remembers your shopping cart, and one that keeps you signed in. We do not use advertising or third-party tracking cookies. Blocking these cookies will stop the cart and sign-in from working.

Order records are kept for as long as tax and commercial law requires. Account data is kept until you close your account. Contact messages are kept for up to 24 months. After that, data is deleted or anonymised.

The site is served over HTTPS. Passwords are stored hashed, payment data is handled entirely by Stripe under the PCI DSS standard, and access to our systems is restricted to the people who need it.

You can ask us to give you a copy of your data, correct it, delete it, or stop using it. Account holders can also edit their details and close their account from the account area. To make a request, use the contact page — we respond within 30 days.

This store is not intended for children under 16, and we do not knowingly collect their data. If you believe a child has given us personal information, contact us and we will delete it.

We may update this policy. The date at the top of the page shows when it was last changed, and material changes will be announced on this page.