GDPR Compliance

Our Commitment

We are committed to protecting your personal data and complying with the General Data Protection Regulation (GDPR) and applicable data protection law. This page explains how we act as a data controller, the legal bases for processing your data, and the rights you have under GDPR.

Data Controller

We act as the data controller for the personal information we collect on this website. This means we are responsible for determining how and why your data is processed. For any data protection enquiries, please contact us.

Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract  processing is necessary to fulfil your orders and manage your account
• Legal obligation  processing is required to comply with tax, financial, and regulatory requirements
• Legitimate interests  processing is necessary for fraud prevention, security, and improving our services, where your fundamental rights do not override these interests
• Consent  for marketing communications and optional cookies; you may withdraw consent at any time

Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access  request a copy of the personal data we hold about you
• Right to rectification  request correction of inaccurate or incomplete data
• Right to erasure  request deletion of your personal data ("right to be forgotten"), subject to legal obligations
• Right to restriction  request that we limit how we process your data in certain circumstances
• Right to data portability  receive your data in a structured, commonly used, machine-readable format
• Right to object  object to processing based on legitimate interests or direct marketing
• Rights related to automated decision-making  not be subject to decisions made solely by automated processing that significantly affects you

To exercise any of your rights, please contact us. We will respond within 30 days of receiving your request.

Data Retention

We retain personal data only as long as necessary for the purposes it was collected:

• Account data  retained for the duration of your account, plus 12 months after closure
• Order records  retained for 7 years for accounting and legal compliance
• Marketing data  retained until you withdraw consent or unsubscribe
• Support communications  retained for 3 years

International Data Transfers

Where we transfer personal data outside your country, we ensure appropriate safeguards are in place  such as standard contractual clauses approved by the relevant data protection authority  to protect your data to an equivalent standard.

Cookies & Tracking

Our use of cookies is detailed in our Cookie Policy. We use a consent management approach to ensure we obtain valid consent before placing non-essential cookies on your device.

Data Security

We implement appropriate technical and organisational security measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include SSL encryption, access controls, and regular security reviews.

Complaints

If you have concerns about how we handle your personal data, we encourage you to contact us first so we can resolve the issue directly. You also have the right to lodge a complaint with your national data protection supervisory authority.