Last Updated: 8 November 2026

GemsVault is an online gemstone website operated for and on behalf of MARICAR GEMS LIMITED, a company registered in England and Wales.

MARICAR GEMS LIMITED respects your privacy and is committed to handling personal information responsibly, securely and transparently.

This Privacy Policy explains how we collect, use, store, protect and disclose personal information when you visit or use the GemsVault website, create an account, contact us, submit an enquiry, purchase products, communicate with us through WhatsApp, or otherwise interact with our services.

For the purposes of applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, MARICAR GEMS LIMITED is responsible for determining how and why personal data collected through GemsVault is processed, except where a third-party service provider acts as an independent controller for its own processing.

1. Who We Are

Website: GemsVault
Website address: gemstonevault.shop
Operating company: MARICAR GEMS LIMITED
Company number: 01514652
Registered in: England and Wales
Registered office: Hallswelle House, 1 Hallswelle Road, London, NW11 0DH, United Kingdom
Business activity: Wholesale of watches and jewellery

MARICAR GEMS LIMITED is registered on the UK Companies House register. The company’s publicly available Companies House record identifies it as an active private limited company incorporated in 1980.

For privacy-related enquiries, you may contact us using:

Email: info@gemstonevault.shop

Where appropriate, please include “Privacy Request” in the subject line.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information collected through:

• the GemsVault website;
• customer accounts;
• online purchases and orders;
• checkout and payment services;
• contact and enquiry forms;
• customer-service communications;
• WhatsApp communications;
• email communications;
• website security and technical systems;
• cookies and similar technologies; and
• other online interactions with GemsVault.

This Policy does not necessarily apply to third-party websites or services that we do not control. Those services have their own privacy policies and terms.

3. What Personal Information We Collect

Depending on how you interact with GemsVault, we may collect different categories of information.

3.1 Identity and contact information

This may include:

• full name;
• email address;
• telephone number;
• billing address;
• delivery/shipping address;
• country;
• company or business name, where provided; and
• information you provide when communicating with us.

3.2 Customer account information

If you create an account, we may process:

• username;
• email address;
• account credentials;
• order history;
• saved addresses;
• account preferences;
• wishlist or similar account information, where available; and
• information necessary to administer your account.

We do not normally need to see or store your payment-card security information when you pay through our third-party payment providers.

3.3 Order and transaction information

When you purchase products, we may process:

• products purchased;
• order number;
• transaction amount;
• billing information;
• delivery information;
• order status;
• payment status;
• refund information;
• correspondence relating to an order; and
• information necessary to fulfil, administer or support the transaction.

3.4 Payment information

Payments may be processed through third-party payment providers including:

• Stripe; and
• PayPal.

Depending on the payment method you select, payment information may be provided directly to the relevant payment provider.

We do not intend to store complete payment-card details on the GemsVault website where payment processing is handled by the applicable payment provider.

Stripe and PayPal may independently process personal information for payment processing, fraud prevention, security, regulatory compliance and other purposes described in their respective privacy documentation.

3.5 Information submitted through forms

We use SureForms to provide certain contact, enquiry and other forms on the website.

Information submitted through a form may include:

• name;
• email address;
• telephone number;
• message or enquiry;
• order-related information;
• business information; and
• any other information voluntarily entered into the relevant form.

The information provided through a form may be stored in the website’s WordPress database and/or transmitted to us so that we can respond to your request.

Where SureForms’ GDPR-related functionality is enabled, certain technical information such as IP address, browser name and device name may not be stored with form entries. The exact information retained depends on the configuration of the individual form.

Please do not submit highly sensitive personal information through ordinary contact or enquiry forms unless we specifically request it and provide an appropriate secure method.

4. WhatsApp Communications

GemsVault may provide customer communication through WhatsApp.

If you choose to contact us through WhatsApp, we may receive and process information such as:

• your telephone number;
• WhatsApp profile information made available to us;
• messages;
• photographs;
• documents;
• order information; and
• other information you voluntarily provide.

WhatsApp is a third-party communication service operated by Meta companies. WhatsApp has its own privacy terms and may process information independently of MARICAR GEMS LIMITED.

For users in the European Region, WhatsApp identifies WhatsApp Ireland Limited as the service provider under its applicable privacy framework.

You should review WhatsApp’s applicable privacy information before using WhatsApp to communicate with us.

5. Hostinger Hosting and Webmail

GemsVault’s website infrastructure and/or email services may be provided through Hostinger.

Hostinger may process technical information required to operate, secure and maintain the website and related services.

This may include information such as:

• IP address;
• browser and device information;
• server logs;
• security information;
• website access information;
• email metadata;
• email addresses;
• information contained in emails sent to or from our business mailboxes; and
• other technical information necessary to provide hosting and email services.

Hostinger acts as a service provider for infrastructure and hosting functions, subject to its applicable terms and privacy documentation.

6. Google Site Kit and Google Services

We use Site Kit by Google to help administer and understand aspects of the GemsVault website.

Site Kit can connect a website to various Google services, including:

• Google Search Console;
• Google Analytics;
• PageSpeed Insights;
• Google Ads;
• Google AdSense;
• Google Tag Manager; and
• other supported Google services.

The specific Google services that process information depend on which services are actually connected and enabled on the GemsVault website.

Where analytics, advertising or other non-essential tracking technologies are used, we will obtain consent where required by applicable law before placing or activating the relevant technologies.

Google’s Site Kit documentation specifically states that website owners are responsible for managing applicable privacy and consent requirements.

Where Google Analytics or another optional Google service is not enabled, this Privacy Policy should not be interpreted as stating that such service is collecting information merely because Site Kit is installed.

For Google Customer Reviews, third parties including Google may place or read cookies or use web beacons. We send Google your order ID, email address, delivery country, and estimated delivery date so it can show an optional post-checkout survey invitation. If you opt in, Google may email you a survey after the estimated delivery date.

7. Cookies and Similar Technologies

GemsVault may use cookies and similar technologies.

Cookies may be used for purposes such as:

Strictly necessary cookies

These may be required to:

• operate the website;
• maintain shopping-cart functionality;
• process checkout;
• maintain account sessions;
• provide security;
• prevent fraudulent activity; and
• remember essential technical settings.

Preference cookies

Where used, these may remember choices such as language, region or other website preferences.

Analytics cookies

Where enabled, analytics technologies may help us understand:

• how visitors use the website;
• which pages are visited;
• website performance;
• traffic sources; and
• general website usage patterns.

Advertising or marketing technologies

Where applicable, advertising or marketing technologies may be used to measure campaigns or provide relevant advertising.

Non-essential cookies and similar technologies will be used only where we have an appropriate lawful basis, including consent where consent is legally required.

You can control certain cookies through your browser settings and, where provided, our cookie-consent mechanism.

UK guidance states that visitors should be informed about cookies and that consent is generally required for non-essential cookies.

8. Why We Use Your Personal Information

We may use personal information for the following purposes.

We will not use your personal information for a materially incompatible purpose without providing appropriate information and, where required, obtaining consent or another lawful basis.

9. Our Lawful Bases for Processing

Under applicable UK GDPR principles, we rely on one or more of the following lawful bases.

9.1 Performance of a contract

We may process personal information when necessary to:

• process your order;
• provide products or services;
• arrange delivery;
• administer your customer account;
• process refunds; or
• provide customer support connected with a transaction.

9.2 Legal obligation

We may process information where necessary to comply with legal requirements, including:

• accounting requirements;
• tax obligations;
• financial record keeping;
• fraud prevention requirements;
• regulatory obligations;
• court orders; and
• other legal obligations applicable to MARICAR GEMS LIMITED.

9.3 Legitimate interests

We may process information where necessary for legitimate business interests, provided those interests are not overridden by your rights and freedoms.

Examples may include:

• website security;
• fraud prevention;
• improving our services;
• responding to customer enquiries;
• maintaining business records;
• protecting our legal rights;
• managing business relationships; and
• ensuring the website operates effectively.

9.4 Consent

Where consent is legally required, we will ask for it before processing the relevant information.

Examples may include certain:

• marketing communications;
• optional cookies;
• analytics technologies;
• advertising technologies; and
• other optional processing activities.

You may withdraw consent at any time where consent is the lawful basis for processing.

Withdrawal of consent does not affect the lawfulness of processing that occurred before withdrawal.

10. Who We Share Personal Information With

We do not sell your personal information as a general business practice.

We may disclose personal information to carefully selected third parties where necessary for legitimate business, contractual or legal purposes.

These may include:

Payment providers

• Stripe
• PayPal

Website and infrastructure providers

• Hostinger
• WordPress-related service providers and technical providers where necessary

Form and website tools

• SureForms
• Google services connected through Site Kit, where applicable

Communication providers

• WhatsApp
• email service providers

Delivery and logistics providers

Where necessary to fulfil an order, we may provide relevant information to:

• couriers;
• postal operators;
• shipping companies;
• customs intermediaries; and
• other logistics providers.

Professional and legal advisers

Where reasonably necessary, information may be shared with:

• accountants;
• auditors;
• lawyers;
• insurers;
• professional advisers; and
• other specialist service providers.

Government and regulatory authorities

We may disclose information where required or permitted by law, including to:

• tax authorities;
• law-enforcement authorities;
• courts;
• regulators; and
• other competent public authorities.

We seek to ensure that third-party providers process personal information only for appropriate purposes and provide suitable safeguards where required.

11. International Transfers

Some of our service providers may process personal information outside the United Kingdom, including in countries that may not provide the same level of data protection as the UK.

Where personal information is transferred internationally, we will seek to ensure that the transfer is made using an appropriate lawful mechanism under applicable data protection law.

Depending on the circumstances, this may include:

• an adequacy decision;
• approved contractual safeguards;
• the UK International Data Transfer Agreement;
• the UK Addendum to EU Standard Contractual Clauses;
• another legally recognised transfer mechanism; or
• another permitted safeguard or exception.

We will take appropriate steps to protect personal information during international transfers.

12. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Different categories of information may be retained for different periods.

For example:

• customer account information may be retained while an account remains active and for a reasonable period thereafter;
• order and transaction records may be retained for accounting, tax, legal and regulatory purposes;
• customer-service correspondence may be retained for as long as reasonably necessary to manage the enquiry and maintain appropriate records;
• marketing information may be retained until you unsubscribe, withdraw consent where applicable, or it is otherwise no longer required;
• security and technical logs may be retained for a limited period appropriate to security and operational needs.

When personal information is no longer required, we will delete it, anonymise it or securely dispose of it, subject to applicable legal retention requirements.

13. Your Data Protection Rights

Depending on the circumstances and applicable law, you may have rights including:

Right of access

You may request a copy of the personal information we hold about you.

Right to rectification

You may ask us to correct inaccurate or incomplete information.

Right to erasure

You may request deletion of personal information where there is no lawful reason for us to continue processing it.

Right to restriction

You may request that we restrict processing in certain circumstances.

Right to object

You may object to certain processing, including processing based on legitimate interests.

You may also have an absolute right to object to direct marketing.

Right to data portability

Where applicable, you may request certain personal information in a structured, commonly used and machine-readable format.

Right to withdraw consent

Where processing is based on consent, you may withdraw that consent at any time.

Rights concerning automated decision-making

Where applicable, you may have rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.

These rights are subject to applicable legal conditions and exceptions.

14. How to Exercise Your Rights

To exercise a privacy right, contact us at:

Email: info@gemstonevault.shop

Please provide enough information for us to identify you and understand your request.

We may need to request reasonable additional information to verify your identity before releasing or changing personal information.

This is a security measure intended to prevent personal information from being disclosed to the wrong person.

We will normally respond within the applicable legal time period.

UK GDPR transparency guidance requires organisations to explain individuals’ rights and how those rights can be exercised.

15. Direct Marketing

Where permitted by law, we may send information about:

• gemstones;
• new products;
• special collections;
• promotions;
• auctions;
• company news; and
• other relevant GemsVault services.

Where consent is required, we will obtain consent before sending the relevant marketing communications.

You can unsubscribe from marketing communications at any time by:

• using the unsubscribe option in the relevant communication; or
• contacting us directly.

Unsubscribing from marketing does not prevent us from sending essential transactional or service communications, such as order confirmations, payment notices, delivery information or important account messages.

16. Account Security

Where you create an account, you are responsible for maintaining the confidentiality of your account credentials.

We recommend that you:

• use a strong and unique password;
• do not share your password;
• log out of your account on shared devices; and
• notify us if you suspect unauthorised access.

We use reasonable technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• destruction;
• alteration;
• disclosure; and
• other unlawful or unauthorised processing.

However, no internet transmission or electronic storage system can be guaranteed to be completely secure.

17. Payment Security

Payments made through Stripe or PayPal may be processed through their respective secure payment infrastructure.

Depending on the payment method, payment information may be transmitted directly to the applicable payment provider.

Stripe and PayPal have their own privacy policies and security practices governing information processed through their services.

We do not request that customers send complete payment-card numbers, security codes or passwords to us through email, WhatsApp or ordinary website forms.

18. Children’s Privacy

GemsVault is not intended to knowingly collect personal information from children who are below the applicable age of digital consent.

We do not knowingly request unnecessary personal information from children.

If you believe that a child has provided personal information to us without appropriate consent, please contact us so that we can review and, where appropriate, delete the information.

19. Third-Party Websites and Services

The GemsVault website may contain links to third-party websites or services.

These may include payment providers, social media platforms, communication services, logistics providers and other external websites.

When you follow a third-party link or use a third-party service, that organisation may process your information under its own privacy policy.

We are not responsible for the privacy practices of third-party organisations that operate independently from MARICAR GEMS LIMITED.

20. Data Breaches and Security Incidents

If we become aware of a personal-data breach, we will assess the incident and take appropriate steps under applicable data protection law.

Where legally required, we may notify the relevant supervisory authority and/or affected individuals.

We maintain reasonable security measures designed to reduce the likelihood and impact of personal-data incidents.

21. Complaints

If you have concerns about how we process your personal information, we encourage you to contact us first so that we can investigate and attempt to resolve the issue.

You can contact:

MARICAR GEMS LIMITED
Hallswelle House
1 Hallswelle Road
London
NW11 0DH
United Kingdom

Email: info@gemstonevault.shop

You also have the right to complain to the relevant data protection supervisory authority.

For UK data protection matters, the relevant supervisory authority is the:

Information Commissioner’s Office (ICO)

The ICO provides guidance and complaint mechanisms for individuals who believe their personal information has been handled unlawfully or improperly.

22. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

Updates may be necessary because of:

• changes to our website;
• changes to our services;
• changes to third-party service providers;
• changes in technology;
• changes in applicable law or regulatory guidance; or
• changes in how personal information is processed.

The updated version will be published on the GemsVault website with a revised “Last Updated” date.

We recommend reviewing this page periodically.

UK GDPR transparency guidance expects privacy information to be reviewed and updated when processing activities change.

23. Contact Us

For questions about this Privacy Policy, your personal information, or your data protection rights, please contact:

MARICAR GEMS LIMITED
GemsVault
Hallswelle House
1 Hallswelle Road
London
NW11 0DH
United Kingdom

Email: info@gemstonevault.shop

24. Privacy at a Glance