Privacy Policy

Last updated: 24 October 2026

This Privacy Policy explains how Zorvane Group LLC, trading as THUNDA THIGHS ("we", "us", "our"), collects, uses and protects your personal data when you visit or make a purchase from our online store (the "Site"). We are committed to protecting your privacy and handling your data in line with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations ("PECR").

1. Who we are

The data controller responsible for your personal data is:

Zorvane Group LLC
1209 Mountain Road Pl NE, Ste N
Albuquerque, NM 87110
United States
Email: info@zorvanegroup.com
Phone: +1 (914) 339-5540

2. The personal data we collect

Identity and contact data: name, email address, phone number, billing and shipping address.
Order and transaction data: products purchased, order value, payment status and order history. Card payments are processed by our payment providers; we do not see or store your full card details.
Account data: if you create an account, your login details and preferences.
Communications: messages you send us by email, contact form or chat, and your marketing preferences.
Technical and usage data: IP address, browser and device type, pages viewed, time spent on the Site and how you arrived at it, collected through cookies and similar technologies.

3. How we collect your data

Directly from you, when you place an order, create an account, subscribe to our newsletter, enter a promotion or contact us.
Automatically, through cookies and similar technologies when you use the Site (see section 8).
From third parties, such as payment providers, delivery companies and analytics or advertising partners.

4. How we use your data and our lawful bases

To process and deliver your order, take payment, send order and delivery updates and handle returns and refunds. Lawful basis: performance of a contract.
To provide customer service and respond to your questions. Lawful basis: performance of a contract and our legitimate interests.
To send you marketing emails or SMS about our products and offers. Lawful basis: your consent (or, for existing customers, our legitimate interests where permitted by PECR). You can unsubscribe at any time.
To run, secure and improve the Site, prevent fraud and understand how customers use it. Lawful basis: our legitimate interests.
To show you relevant advertising on other websites and social media. Lawful basis: your consent, given through our cookie banner.
To comply with our legal obligations, such as tax, accounting and consumer law requirements. Lawful basis: legal obligation.

5. Who we share your data with

We only share your personal data where necessary, with:

Shopify, which hosts our online store and processes order data on our behalf;
Payment providers (such as Shopify Payments, PayPal, Shop Pay, Apple Pay and Google Pay) to process your payment;
Fulfilment and delivery partners who pack and deliver your order;
Email, analytics and advertising providers (for example, Google and Meta), subject to your cookie choices;
Professional advisers and authorities, where required by law or to protect our rights.

We never sell your personal data.

6. International transfers

We are based in the United States, and some of our service providers process data outside the UK. When your personal data is transferred outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or Addendum, the UK Extension to the EU–US Data Privacy Framework, or other mechanisms approved under UK data protection law.

7. How long we keep your data

We keep your personal data only for as long as necessary for the purposes above. Order and transaction records are generally kept for up to 6 years to meet tax and accounting requirements. Marketing data is kept until you unsubscribe or ask us to delete it. Account data is kept while your account is active.

8. Cookies

We use cookies and similar technologies to make the Site work, remember your basket and preferences, understand how the Site is used and, with your consent, show you relevant advertising. Strictly necessary cookies are always active. Analytics and marketing cookies are only used if you accept them through our cookie banner. You can change your choices at any time through the cookie settings on the Site or in your browser.

9. Your rights

Under UK data protection law, you have the right to:

access the personal data we hold about you;
ask us to correct inaccurate or incomplete data;
ask us to delete your data;
ask us to restrict how we use your data;
object to our use of your data, including for direct marketing;
receive your data in a portable format;
withdraw your consent at any time, where we rely on consent.

To exercise any of these rights, email info@zorvanegroup.com. We will respond within one month. We may need to verify your identity before responding.

10. Security

We use appropriate technical and organisational measures to protect your personal data, including secure (HTTPS) connections and trusted service providers. However, no method of transmission over the internet is completely secure.

11. Children

The Site is not intended for children under 13, and we do not knowingly collect personal data from children under 13.

12. Complaints

If you have concerns about how we use your personal data, please contact us first so we can try to resolve them. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.