Privacy Policy

Pavia is an online fashion boutique based in Lebanon. We sell clothing for women and men at pavialeb.com and deliver across Lebanon.

This policy covers the website and the ordering that happens on it. It does not cover a conversation you have with us on WhatsApp or Instagram, which those platforms carry under their own policies.

Reach us on WhatsApp on +961 3 017 725 or on Instagram at @pavia.leb to ask what we hold, to correct it or to have it deleted.

Nothing until you place an order. The checkout asks for:

• Your full name, so the courier knows who to hand the parcel to.
• Your phone number, so we can confirm the order and tell you when it is out for delivery. It is also the number a courier calls at the door.
• Your city or area and your full address, so it arrives.
• Delivery notes, if you write any. A size note, a best time, a building detail. Only what you put there.
• Your payment method, meaning which of cash on delivery or Whish Money you picked. No card number, no account number and no wallet identifier is asked for or stored.

Alongside those we keep the order: the pieces, the sizes, the quantities, the prices, the delivery fee, the total, the order number and the date.

The storefront works in your browser, so several things live there rather than with us. All of them are readable only by pavialeb.com, and clearing your browsing data removes every one:

• Your cart and your wishlist. Without these the cart empties every time you open a product.
• Recently viewed. The last few pieces you opened, so the row on the home page has something in it.
• Your own past orders. A copy kept on your device so you can see what you ordered without an account.
• A pending order marker. Written while an order is being placed and cleared when it is confirmed. It is what stops a dropped connection turning one order into two.
• A cached copy of the catalogue, so a second visit paints before the database answers.
• The preview password flag, while the site is behind its launch gate.
• The visit count's item: the day this browser was last counted, whether it has come back before, and the visit in progress, so you and your visit count once.

• Google Fonts. The two typefaces are loaded from fonts.googleapis.com and fonts.gstatic.com, so Google receives your network address and the fact that a page here was opened. No cookie is set by the font request. If that matters to you, a content blocker that stops Google Fonts leaves the site readable in your system typefaces.
• Meta. Every page loads Meta's pixel from connect.facebook.net. It sets the _fbp cookie (a random code, 90 days) and, after a click on one of our ads, _fbc, and tells Meta your network address, your browser, the pages and pieces you opened, what went into your bag, when you started checkout, and the pieces and total of an order you placed. Pavia's code gives it none of the details you type at checkout. Meta uses this to measure and show Pavia's ads and, under its own privacy policy, can connect it to your Facebook or Instagram account. You can turn off activity from other businesses in Meta's Accounts Center, or block connect.facebook.net with a content blocker; the shop works the same without it. The cookie page has the details.
• Cloudflare. The site is served by Cloudflare, and the catalogue, the product photographs and the orders are kept in Cloudflare's database and file storage in Europe, so Cloudflare handles your network address when a page loads and stores the order you place. Cloudflare acts as our processor here: it stores what we put there and does not use it for anything of its own.

Nothing else is loaded from anywhere else. There is no Google Analytics, no TikTok pixel and no session recorder on this site.

The store keeps its own count of its visits, as totals for each day: how many people came and how many visits, the pages and pieces opened, the site or app a visit came from (its name only), the country, the kind of device, browser, system and language, how long pages stayed on screen, the links tapped, pieces put in a bag, orders placed, and how fast the pages showed. A visit sends two short messages to pavialeb.com, one as it starts and one as you leave; nothing about the visit itself is kept once its numbers are added in. No cookie is set and no network address or identifier is kept: the scrambled key that counts a browser once a day is deleted two days later. The totals are stored with the rest of the store's data. With Do Not Track switched on, nothing is sent.

The site's content security policy also allows Cloudflare's Web Analytics beacon, which is cookieless: it counts page views without setting anything on your device and without following you to another site.

Neither count holds anything that could be tied back to you or to your order.

Inside Pavia, whoever packs the order and whoever answers the phone.

A courier is given your name, your phone number and your address, because that is what a delivery needs. Nothing else about the order travels with it.

Nobody else. We do not pass your name, phone number or address to a marketing agency, an advertiser, or another shop. Meta's pixel learns that an order was placed, its pieces and its total, as described above.

An order stays with us while it is being prepared and delivered, through any return, and afterwards as the record of a sale.

Ask us to delete an order and we will, unless a return is still open on it. Message us with the order number.

What sits in your own browser is yours: clear your browsing data and it is gone, and nothing of it was ever sent to us except the order you placed.

You can ask us at any time to:

• tell you what we hold about you and send you a copy,
• correct anything wrong in it,
• delete it, where no open order depends on it,
• stop using it for something you object to.

Lebanon's Law 81 of 2018 on electronic transactions and personal data gives you these rights here, and the GDPR gives you the same ones if you are ordering from Europe. Asking costs nothing and we do not ask why.

Pavia is not aimed at children and we do not knowingly take an order from one. If a child has sent us details, message us and we will remove them.

The site is served over HTTPS, and the database rules refuse any write that does not match the shape of a real order, which is what stops an order being altered from outside. The admin side is behind a password we alone hold and its dashboard ships encrypted.

If something goes wrong with data we hold about you, we will tell the people affected rather than hope nobody notices.

If this policy changes, the date at the top changes with it, and the version number in the storefront's footer tells you which build you are reading.