Privacy Policy

1. Who we are

ToolHaven (“we”, “us”, “our”) operates the website at orikit.com and sells hardware tools, hand tools, power tools and safety equipment to trade and wholesale buyers. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have over it.

For the purposes of the EU and UK General Data Protection Regulation (GDPR), ToolHaven is the data controller for the data described here. Questions and rights requests go to sales@toolhaven.example.

2. What we collect

We collect only what is needed to quote, fulfil and support an order. Depending on how you use the site, that includes:

• Contact and business details you type into checkout or inquiry forms — name, company, email address, phone number, billing and shipping address, country, and VAT/tax identifiers where you supply one.
• Order data — the items you buy, quantities, unit prices, currency, shipping method, delivery tracking and payment status.
• Account data if you register — email address, a hashed password (never stored in plain text), and session tokens used to keep you signed in.
• Payment data — card and PayPal transactions are processed by Stripe and PayPal. We receive only the outcome (paid / failed / refunded), the last four digits or PayPal transaction reference, and the amount. We never see or store full card numbers, expiry dates or security codes.
• Technical data — IP address, browser user agent, referring page and coarse region, used for security, fraud screening and aggregate performance metrics.
• Message content — anything you send us by email or through a contact form, so that we can answer it.

3. Why we use it (legal bases)

• To perform our contract with you — creating quotes, taking payment, shipping goods, handling returns and warranty claims.
• To meet legal obligations — tax, customs, accounting and product-safety record keeping, which we retain for the statutory period.
• For our legitimate interests — preventing fraud and abuse, securing the site, defending legal claims, and improving the storefront. Where we rely on legitimate interests we balance them against your rights.
• On your consent — optional marketing email and non-essential cookies. You can withdraw consent at any time; withdrawal does not affect processing already carried out.

4. Who we share it with

We do not sell personal data. We share it only with processors and authorities that are required to run the business:

• Stripe and PayPal — to take and refund payments. Each acts as an independent controller for the payment data it collects under its own privacy policy.
• Freight carriers and customs brokers — name, address, phone and order contents, strictly to deliver the shipment and clear customs.
• Email delivery and hosting providers — to send order confirmations, shipping notices and replies to your inquiries.
• Professional advisers and public authorities — accountants, auditors, lawyers, tax and customs officials, where legally required or necessary to establish or defend a legal claim.

Every processor we use is bound by a written data-processing agreement and may only handle your data on our instructions.

5. International transfers

We serve buyers worldwide, so your data may be processed outside your country, including in the United States and China. Where we move data out of the EEA or UK we rely on Standard Contractual Clauses or another lawful transfer mechanism, and we apply the same safeguards described in this policy wherever the data is handled.

6. How long we keep it

• Orders and invoices — retained for the period required by tax and customs law in our jurisdiction (commonly 5–10 years), because they are statutory business records.
• Accounts — kept while your account is active, then deleted or anonymised on request.
• Inquiries and email correspondence — up to 24 months, so we can pick up a thread with you.
• Payment outcome records — as long as needed to evidence the transaction and handle refunds and chargebacks.
• Security and error logs — a short rolling window used for abuse detection and debugging.

7. Your rights

Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to processing, receive it in a portable format, and withdraw consent. To exercise any of these, email sales@toolhaven.example. We reply within one month and never charge a fee for a standard request. You can also complain to your national data-protection authority; in the UK that is the Information Commissioner's Office.

Some data we must keep regardless — for example invoices already issued, or records needed for an open dispute — and we will tell you if that applies to your request.

8. Security

We use TLS encryption in transit, hashed passwords, least-privilege database access, rate limiting on public endpoints, and regular patching. No system is perfectly secure, so if you believe your data has been compromised, contact us immediately at sales@toolhaven.example and we will investigate and notify you and the relevant authority where the law requires it.

9. Cookies and similar technologies

We use strictly necessary cookies for sign-in, the shopping cart and security. Where we use analytics or other non-essential cookies we ask for your consent first, and you can change your choice at any time through the cookie controls on the site or your browser settings.

10. Changes to this policy

We may update this policy as the business or the law changes. The “last updated” date at the top always reflects the current version. If a change materially affects how we handle your data we will give prominent notice on the site or by email.