Legal & Transparency

Privacy Policy

We take your privacy seriously. This policy explains what data we collect, why we collect it, and how we keep it safe under UK GDPR & PECR regulations.

1. Who We Are

Carnavi (“we”, “us”, “our”) is a UK-based supplier of premium car infotainment and connectivity products. Our registered address is Carnavi Ltd, Unit 87, 1 Trowley Way, Sutton, Surrey SM1 4FD, United Kingdom. We are the data controller for all personal data collected through our website and services.

2. What Data We Collect

We collect the following categories of personal data:

•Identity data: name, username, title

•Contact data: email address, shipping/billing address, phone number

•Financial data: payment card details (processed securely via Stripe — we never store full card numbers)

•Transaction data: details of purchases, order history, returns

•Technical data: IP address, browser type, device identifiers, cookies

•Usage data: pages visited, search terms used, time spent on site

•Marketing preferences: newsletter subscriptions, communication preferences

3. How We Use Your Data

We use your personal data for the following essential business purposes:

✓Process and fulfil your orders

✓Send order confirmations and dispatch notifications

✓Manage returns, refunds and warranty claims

✓Provide customer support

✓Send marketing emails (only with explicit consent)

✓Improve website functionality through analytics

✓Comply with UK accounting and tax obligations

✓Prevent fraud and ensure system security

4. Legal Basis for Processing

We process your data under the following legal bases under UK GDPR: contractual necessity (to fulfil your order), legitimate interests (to improve our services and prevent fraud), consent (for marketing communications and non-essential cookies), and legal obligation (for accounting and tax purposes).

5. Third-Party Analytics & Advertising Tools

To understand how visitors interact with our website and to measure marketing performance, we utilize third-party tools. Under UK GDPR and PECR regulations, non-essential tracking scripts are deactivated by default and are only initialized after you give explicit consent via our Cookie Banner.

Google Analytics 4 (GA4)

Site Analytics

We use Google Analytics 4 to analyze site usage, traffic sources, page views, and user journeys. GA4 operates with IP anonymization and respects Google Consent Mode v2 (analytics_storage). It only fires once you opt into Analytics cookies.

Google Tag Manager (GTM)

Script Management

We use Google Tag Manager to deploy and manage website scripts and tags efficiently. GTM acts as a tag orchestrator and does not collect personal data directly; it conditionally triggers third-party tags based on your active consent preferences.

Google Ads (AdWords)

Marketing Tag

We use Google Ads conversion tracking and remarketing tags to evaluate advertisement effectiveness and serve relevant promotion to users interested in our automotive products (ad_storage, ad_user_data). Google Ads cookies are stored only if you enable Marketing cookies.

Meta Pixel (Facebook & Instagram)

Social Ads

We utilize Meta Pixel to track website conversions from Facebook and Instagram advertisements, optimize campaign delivery, and build custom lookalike audiences. Meta Pixel scripts are strictly blocked unless you grant consent for Marketing cookies.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined above. Order data is retained for 7 years to comply with UK accounting and legal requirements. Marketing data is retained until you unsubscribe or withdraw consent. You may request account deletion at any time.

8. Your Rights

Under UK GDPR, you hold full statutory rights regarding your personal data:

→Access your personal data

→Correct inaccurate data

→Erase your data (right to be forgotten)

→Restrict processing

→Data portability

→Object to processing

→Withdraw consent at any time

→Lodge a complaint with the ICO

To exercise any of these rights, contact our Data DPO at privacy@carnavi.co.uk.

9. Security

We implement industry-standard technical and organizational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. Our website employs 256-bit SSL/TLS encryption for all data in transit.

10. Contact Us

For any privacy-related queries or formal data requests, write to our Data Protection Officer at privacy@carnavi.co.uk or send mail to Carnavi Ltd, Unit 87, 1 Trowley Way, Sutton, Surrey SM1 4FD, United Kingdom. You may also contact the UK Information Commissioner's Office (ICO) at ico.org.uk.