Privacy policy

Privacy Policy

Introduction

Below, we inform you about the processing of personal data when using our website https://www.aventon.co.uk/ and our social media profiles.
Personal data is any data that can be related to a specific natural person, e.g., their name or IP address.

The contact details

of the controller pursuant to Article 4(7) UK GDPR are Karbon Kinetics Ltd, Unit 30, Barwell Business Park, Leatherhead Road, Chessington, Surrey, KT9 2NY, United Kingdom, email: customerservice@gocycle.com. We are legally represented by JW Zhang. Privacy-related enquiries may also be sent to support@aventon.co.uk. If we are required to appoint a data protection officer, the relevant contact details will be made available through this privacy policy.

Scope of data processing, processing purposes and legal basis

We explain the scope of data processing, processing purposes, and legal bases in detail below. The following are generally considered legal bases for data processing:

  1. Article 6(1)(a) UK GDPR serves as the legal basis for processing operations for which we obtain consent.

  2. Article 6(1)(b) UK GDPR is the legal basis insofar as the processing of personal data is necessary for the performance of a contract, e.g., when a website visitor purchases a product from us or we perform a service for them. This legal basis also applies to processing that is necessary for pre-contractual measures, such as inquiries about our products or services.

  3. Article 6(1)(c) UK GDPR applies if we process personal data to comply with a legal obligation, as may be the case, for example, under tax law.

  4. Article 6 paragraph 1 sentence 1 letter f UK GDPR serves as the legal basis when we can rely on legitimate interests for the processing of personal data, e.g. for cookies that are necessary for the technical operation of our website.

Data Processing Outside the United Kingdom

Where we transfer personal data to service providers or other third parties outside the United Kingdom, we will only do so where a valid transfer mechanism applies under Chapter V UK GDPR. This may include a UK adequacy regulation, the UK Extension to the EU-US Data Privacy Framework where applicable, an International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another permitted safeguard under UK GDPR.

Where we rely on an IDTA, UK Addendum, or other appropriate safeguard, we will also assess whether the personal data receives a level of protection that is not materially lower than under UK law and will take supplementary measures where required. The specific transfer position may vary by provider and is described in the relevant sections below where applicable.

Data Retention Period

Unless a more specific retention period is stated in this Privacy Policy, we retain personal data only for as long as necessary for the purpose for which it was collected, including to provide services, manage customer relationships, comply with legal obligations, resolve disputes, and enforce agreements. Account, order, invoice, tax, and accounting records may be retained for the period required by applicable commercial, tax, and limitation laws. Marketing data is retained until consent is withdrawn or an objection is received, unless we have another lawful reason to retain it. Website log data is ordinarily deleted no later than 14 days after collection unless further retention is required for security investigation or legal purposes.

Rights of Data Subjects

Data subjects have the following rights with regard to their personal data, subject to the conditions and exceptions set out in UK data protection law:

  1. Right of access
  2. Right to rectification or erasure
  3. Right to restriction of processing
  4. Right to object to processing
  5. Right to data portability
  6. Right to withdraw consent at any time

Data subjects also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters. The ICO can be contacted at https://ico.org.uk or by telephone on 0303 123 1113. We would appreciate the opportunity to address any concern first, and you can contact us using the details set out above.

Obligation to provide data

Customers, prospective customers, or third parties are only required to provide us with the personal data necessary for establishing, executing, and terminating the business relationship or other relationship, or which we are legally obligated to collect. Without this data, we will generally have to refuse to conclude a contract or provide a service, or we may no longer be able to perform an existing contract or other relationship.
Mandatory fields are marked as such.

No automated decision-making in individual cases

We generally do not use fully automated decision-making pursuant to Article 22 UK GDPR for establishing and conducting a business relationship or other relationship. Should we use these procedures in individual cases, we will inform you separately, provided this is legally required.

Contacting Us

When you contact us, for example by email, telephone, web form, post, or social media message, we process the information you provide, such as your name, contact details, message content, order details, and any other information needed to respond. The legal basis is Article 6(1)(f) UK GDPR, as we have a legitimate interest in responding to enquiries and managing customer relationships. Where the enquiry relates to a contract or potential contract, Article 6(1)(b) UK GDPR may also apply. We retain enquiry records for as long as needed to handle the matter and for a reasonable period afterwards for record-keeping, dispute management, and legal purposes, unless a longer statutory retention period applies.

Competitions

Occasionally, we offer prize draws, competitions, or similar promotional activities via our website, social media, or other channels. We process the information requested for the relevant promotion, such as name, contact details, entry details, eligibility information, and prize delivery information, to administer the promotion, select and notify winners, deliver prizes, and comply with related legal and record-keeping obligations. The legal basis is Article 6(1)(b) UK GDPR where processing is necessary to administer the promotion terms, Article 6(1)(c) UK GDPR where we must comply with legal obligations, and Article 6(1)(f) UK GDPR where we rely on our legitimate interest in running and promoting competitions. Competition records are retained for the period needed to administer the promotion and resolve any related issues, unless a longer legal retention period applies.

Newsletter

We may send marketing communications about similar products or services to existing customers where permitted by PECR, provided the customer was given a clear opportunity to opt out when their details were collected and in every subsequent marketing message. The legal basis under UK GDPR is Article 6(1)(f), as we have a legitimate interest in promoting our products and services to existing customers. Customers can object to direct marketing at any time without charge by using the unsubscribe link in our emails or by contacting us using the details above.

Where required, we send newsletters and other electronic marketing only with consent. We process the information provided during registration, such as email address, name, marketing preferences, and sign-up metadata, for the purpose of sending the newsletter and recording consent. The legal basis is Article 6(1)(a) UK GDPR. You can withdraw consent at any time by using the unsubscribe link in the newsletter or by contacting us using the details above. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Where we measure newsletter open rates, click rates, or similar engagement metrics, we do so only where permitted by applicable direct marketing and privacy rules and, where required, with consent. These measurements help us understand which content is relevant to recipients and improve our communications.

Data processing on our website

Notice for website visitors in the United Kingdom

Our website may store information on the end device of website visitors, such as cookies or similar storage technologies, or access information already stored on the device. This may include strictly necessary technologies required to provide the website, as well as analytics, advertising, personalisation, and conversion-tracking technologies used only where permitted.
This storage and access is based on the following provisions:

  1. Where storage or access is strictly necessary to provide a service expressly requested by the website visitor, such as maintaining security, enabling core website functions, remembering basket contents, or preserving privacy preferences, it is carried out under the strictly necessary exemption in Regulation 6 PECR. Where personal data is processed in connection with these technologies, the UK GDPR lawful basis is generally Article 6(1)(f), our legitimate interest in operating a secure and functional website, or Article 6(1)(b) where necessary for a contract.

  2. For all non-essential cookies and similar technologies, including analytics, advertising, social media, and conversion-tracking technologies, we ask for consent before the technology is used, unless another PECR exemption applies. Where the information is personal data, the UK GDPR lawful basis for subsequent processing is Article 6(1)(a) UK GDPR. Consent can be withdrawn or changed at any time through the cookie settings made available on the website.

Subsequent data processing is carried out in accordance with the following sections and on the basis of the provisions of the UK GDPR.

Informational Use of the Website

When you use our website for informational purposes, i.e., when visitors do not specifically provide us with information, we collect the personal data that your browser transmits to our server to ensure the stability and security of our website. This constitutes our legitimate interest, and the legal basis for this processing is Article 6(1)(f) UK GDPR.
This data includes:

  1. IP address
  2. Date and time of the request
  3. Time zone difference to Greenwich Mean Time (GMT)
  4. Content of the request (specific page)
  5. Access status/HTTP status code
  6. Amount of data transferred
  7. Website from which the request originated
  8. Browser
  9. Operating system and its interface
  10. Language and version of the browser software.

This data is also stored in log files. It is deleted when its storage is no longer necessary, at the latest after 14 days.

Web hosting and website provision

Our website is hosted by Shopify. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. The provider processes personal data transmitted via the website, such as content data, usage data, meta/communication data, contact data, account data, and order data, for the purpose of hosting, operating, securing, and providing our online store. Further information can be found in the provider's privacy policy at https://www.shopify.com/legal/privacy.

Providing a website is in our legitimate interest, so the legal basis for the described data processing is Article 6(1)(f) UK GDPR.

We use Shopify's content delivery and related infrastructure services to deliver website content efficiently and securely. The provider may process personal data transmitted through the website, including usage data, technical identifiers, device information, IP addresses, and contact or order data where relevant.

Where Shopify or its sub-processors process personal data outside the United Kingdom, the transfer is protected by a valid transfer mechanism such as an adequacy regulation, the UK Extension to the EU-US Data Privacy Framework where applicable, an IDTA, or the UK Addendum to the EU Standard Contractual Clauses.

We have a legitimate interest in utilizing sufficient storage and delivery capacities to ensure optimal data throughput even during peak loads. The legal basis for the described data processing is therefore Article 6(1)(f) UK GDPR.

Customer Account

Visitors to our website can create a customer account. We process account registration and account management data, such as name, contact details, login credentials, address information, order history, preferences, and customer service information, to provide and manage the account and related services. The legal basis is Article 6(1)(b) UK GDPR where processing is necessary for the user agreement and Article 6(1)(f) UK GDPR where we have a legitimate interest in account security, fraud prevention, and customer relationship management.

Account data is retained while the account remains active. If an account is closed, we delete or anonymise account data unless continued retention is required for legal, accounting, fraud prevention, dispute resolution, or contract enforcement purposes.

Offering of Goods

We offer goods via our website. In connection with the order, we process the following data:
This includes information needed to place and fulfil orders, such as name, billing and delivery address, email address, telephone number, payment-related information, order details, delivery information, returns and warranty information, and related customer service correspondence. Shopify and other service providers process this data on our behalf where necessary to operate the online store and fulfil orders.

The data is processed for the performance of the contract concluded with the respective website visitor (Art. 6 para. 1 sentence 1 lit. b UK GDPR).

We share the aforementioned data with the following service providers, insofar as this is necessary for the order:

  1. Netsuite
  2. Shopify.

The legal basis for the processing is Art. 6 para. 1 sentence 1 lit. b UK GDPR, as it is necessary for the performance of the contract.

Technically Necessary Cookies

Our website uses cookies. Cookies are small text files that are stored in the web browser on the device of a website visitor. Cookies help to make the website more user-friendly, effective, and secure. Insofar as these cookies are necessary for the operation of our website or its functions (hereinafter "Technically Necessary Cookies"), the legal basis for the associated data processing is Article 6(1)(f) UK GDPR. We have a legitimate interest in providing customers and other website visitors with a functional website. We specifically use technically necessary cookies for the following purposes:

  1. To save language settings

Third-party providers

Shopify

We use Shopify to operate our online store. The provider is Shopify International Limited, Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland. The provider processes meta/communication data (e.g., device information, IP addresses) within the EU.
The legal basis for this processing is Article 6(1)(f) UK GDPR. We have a legitimate interest in making our products easily accessible to potential customers.
The data is deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.shopify.com/legal/privacy.

Cookiebot

We use Cookiebot to manage consents. The provider is Usercentrics A/S, Havnegade 39, DK-1058 Copenhagen. The provider processes meta/communication data (e.g., device information, IP addresses) within the EU.
The legal basis for this processing is Article 6(1)(f) UK GDPR. We have a legitimate interest in easily managing website visitors' cookie consent.
The data is deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Consent records may be retained for as long as necessary to demonstrate compliance. Further information can be found in the provider's privacy policy at https://www.cookiebot.com/en/privacy-policy/.

MoEngage

We use MoEngage to automate our marketing and communicate with customers. The provider is MoEngage Inc., 315 Montgomery Street, 10th floor, San Francisco, 94104, USA. The provider processes contact data (e.g., email addresses, telephone numbers), meta/communication data (e.g., device information, IP addresses), and master data (e.g., names, addresses) within the EU.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
We delete the data when the purpose for which it was collected no longer applies. Further information can be found in the provider's privacy policy at https://www.moengage.com/privacy-policy/.

Google Analytics

We use Google Analytics for analysis. The provider is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an adequacy decision or, where no such decision exists, an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://business.safety.google/privacy/.

Google Tag Manager

We use Google Tag Manager for advertising and analytics. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an adequacy decision or, where no such decision exists, an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses.
We delete the data when the purpose for which it was collected no longer applies. Further information can be found in the provider's privacy policy at https://business.safety.google/privacy/.

Meta Pixel

We use Meta Pixel for analysis. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an adequacy decision or, where no such decision exists, an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.facebook.com/policy.php.

TikTok Pixel

We use the TikTok Pixel for advertising and analytics purposes. The provider is TikTok, Inc., 10100 Venice Blvd Suite 401 Culver City, CA 90232, USA. The provider processes meta/communication data (e.g., device information, IP addresses) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses approved by the ICO, which we have agreed upon with the provider.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.tiktok.com/legal/privacy-policy?lang=en.

Google Conversion Tag

We use the Google Conversion Tag for conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an adequacy decision or, where no such decision exists, an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://business.safety.google/privacy/.

Facebook Conversion API

We use the Facebook Conversion API for analysis. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an adequacy decision or, where no such decision exists, an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.facebook.com/policy.php.

imgix

We use imgix to optimise, transform, and deliver images and other visual content on our website. The provider is Zebrafish Labs, Inc. d/b/a imgix, 114 Sansome Street, Suite 950, San Francisco, CA 94104, USA. The provider may process usage data and meta/communication data, such as IP addresses, device information, browser information, request URLs, and access times, for the purpose of delivering website media efficiently and securely.
Where personal data is transferred outside the United Kingdom in connection with imgix, the transfer is protected by a valid transfer mechanism such as an IDTA, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted under UK GDPR.
The data is deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://imgix.com/privacy.

Prismic

We use Prismic for content management. The provider is Prismic.io Inc., San Francisco, California, USA. The provider processes usage data (e.g., websites visited, interest in content, access times), contact data (e.g., email addresses, telephone numbers), and meta/communication data (e.g., device information, IP addresses) in the USA.
The legal basis for this processing is Article 6(1)(f) UK GDPR. We have a legitimate interest in setting up and maintaining a website and thus presenting ourselves to the public.
The transfer of personal data to a country outside the United Kingdom is based on an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses approved by the ICO, which we have agreed upon with the provider.
The data is deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://prismic.io/legal/privacy.

Talkable

We use Talkable for recommendations. The provider is Curebit, Inc., 261 Market Street #4588, San Francisco, CA 94114, USA. The provider processes contact data (e.g., email addresses, telephone numbers), meta/communication data (e.g., device information, IP addresses), and master data (e.g., names, addresses) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses approved by the ICO, which we have agreed upon with the provider.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.talkable.com/privacy.

Reddit Conversion Pixel

We use the Reddit Conversion Pixel for analysis. The provider is Reddit, Inc., 548 Market St. #16093, San Francisco, California 94104, USA. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses approved by the ICO, which we have agreed upon with the provider.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.reddit.com/policies/privacy-policy.

Google Ads

We use Google Ads for advertising. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an adequacy decision or, where no such decision exists, an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses.
We delete the data when the purpose for which it was collected no longer applies. Further information can be found in the provider's privacy policy at https://business.safety.google/privacy/.

Instagram Analytics

We use Instagram Analytics for analysis purposes. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The transfer of personal data to a country outside the United Kingdom is based on an adequacy decision or, where no such decision exists, an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.facebook.com/policy.php.

Meta Ads

We use Meta Ads for advertising. The provider is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The provider processes usage data (e.g., websites visited, interest in content, access times) and meta/communication data (e.g., device information, IP addresses) in the USA.
The legal basis for this processing is Article 6(1)(a) UK GDPR. Processing is based on consent. Data subjects can withdraw their consent at any time by contacting us, for example, using the contact details provided in our privacy policy. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
Where personal data is transferred outside the United Kingdom in connection with Meta Ads, the transfer is protected by a valid transfer mechanism such as an adequacy regulation, the UK Extension to the EU-US Data Privacy Framework where applicable, an IDTA, or the UK Addendum to the EU Standard Contractual Clauses. The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.facebook.com/policy.php.

Elevar

We use Elevar for ecommerce analytics, event tracking, and marketing measurement. The provider is Elevar, LLC, United States. The provider may process usage data, order event data, device information, identifiers, IP addresses, and other meta/communication data for analytics, attribution, and tracking purposes.
The transfer of personal data to a country outside the United Kingdom is based on an International Data Transfer Agreement (IDTA) or UK Addendum to Standard Contractual Clauses approved by the ICO, which we have agreed upon with the provider.
The data will be deleted when the purpose for its collection no longer applies and there is no legal obligation to retain it. Further information can be found in the provider's privacy policy at https://www.getelevar.com/legal/privacy/.

heyData

We have integrated a data protection seal on our website. The provider is heyData GmbH, Schützenstraße 5, 10117 Berlin, Germany. The provider processes meta/communication data (e.g., IP addresses) within the EU.
The legal basis for this processing is Article 6(1)(f) UK GDPR. We have a legitimate interest in providing website visitors with confirmation of our data protection compliance. At the same time, the provider has a legitimate interest in ensuring that only customers with existing contracts use its seal, which is why a mere image copy of the certificate is not a viable alternative for confirmation.
The data is masked after collection to ensure that it no longer contains any personal information. Further information can be found in the provider's privacy policy at https://heydata.eu/datenschutzerklaerung.

Data processing on social media platforms

We are present on social media networks to introduce our organization and services. The operators of these networks regularly process their users' data for advertising purposes. Among other things, they create user profiles based on online behavior, which are used, for example, to display advertising on the networks' pages and elsewhere on the internet that matches the users' interests. To do this, the network operators store information about usage behavior in cookies on the users' computers. It is also possible that the operators combine this information with other data. Further information and instructions on how users can object to data processing by the network operators can be found in the respective operators' privacy policies listed below. It is also possible that the operators or their servers are located in non-UK countries, meaning they process data there. This may pose risks for users, for example, because enforcing their rights may be more difficult or government agencies may access the data.
When users of these networks contact us via our profiles, we process the data they provide in order to answer their inquiries. This constitutes our legitimate interest, so the legal basis is Art. 6 para. 1 sentence 1 lit. f UK GDPR.

Instagram

We maintain a profile on Instagram. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. The privacy policy can be found here:
https://help.instagram.com/519522125107875.

YouTube

We maintain a profile on YouTube. The operator is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The privacy policy can be found here:
https://policies.google.com/privacy?hl=en-GB.

LinkedIn

We maintain a profile on LinkedIn. The operator is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. The privacy policy can be found here: https://www.linkedin.com/legal/privacy-policy. You can object to data processing via your ad settings:
https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

Service partner inquiries

Processing of data for contract initiation (service partners)

If you apply to become a service partner using our form, we process your data (name, contact details, business information) to handle your application and prepare for potential cooperation.

Legal basis

Processing is based on Article 6(1)(b) UK GDPR (performance of pre-contractual measures). Alternatively, we base the processing on our legitimate interest in acquiring service partners pursuant to Article 6(1)(f) UK GDPR.

Storage period

Service partner enquiry data is retained for as long as necessary to assess the application, manage pre-contractual discussions, and, where applicable, establish and manage the service partner relationship. If an application is unsuccessful or does not proceed, we delete or anonymise the data after a reasonable review period unless a longer retention period is required for legal, dispute resolution, or compliance purposes.

Changes to this privacy policy

We reserve the right to amend this privacy policy with effect for the future. The current version is always available here.

Questions and comments

For questions or comments regarding this privacy policy, please feel free to contact us using the contact details provided above.