🔒 Privacy Policy

Effective Date: 21/06/2025

---

1. Introduction

CompartsLine UK (“we”, “us”, “our”) is committed to protecting your privacy and complying with the UK General Data Protection Regulation (GDPR) and UK Data Protection Act 2018. This policy explains clearly how we handle your personal information.

---

2. Data Controller

CompartsLine UK is operated by GG Digital Innovators Limited, registered in England and Wales.

• Company Number: 15945318

• Registered Address: 82, Unit A James Carter Road, Bury St. Edmunds, Suffolk, United Kingdom, IP28 7DE
  We act as the data controller responsible for your personal information.

---

3. Why We Collect Data

We collect the minimum data required to:

• Process and fulfil orders & payments

• Provide effective customer support

• Personalise user experience and improve our services

• Comply with legal obligations (e.g., tax reporting, fraud prevention, regulatory requirements)

---

4. What Data We Collect

• User data: Name, email, billing/shipping address, phone (if provided), customer reviews.

• Technical data: IP address, browser/device type, site usage (cookie data).

• Transactional data: Purchased items, totals, payment method, shipping preferences, order history.

❌ We never intentionally collect sensitive categories (religious beliefs, ethnicity, health, political opinions), unless you explicitly and voluntarily provide them.

---

5. How We Use Your Data

We also process data for fraud prevention, dispute resolution, and legal defence under legitimate interest.

---

6. Cookies & Tracking

• Necessary cookies (login, shopping cart) → always active, no consent needed.

• Optional cookies (analytics, marketing) → only with your explicit consent via our cookie banner.

• You can withdraw consent anytime in browser settings.

---

7. Data Sharing & Storage

We do not sell personal data.
We share data only with trusted third parties essential to operate our services:

• Payment processors (e.g. Stripe, PayPal)

• Shipping & logistics partners

• Marketing/email platforms (with consent)

• Regulators when legally required

Data is securely hosted in the UK/EU, with industry-standard protection.

---

8. International Transfers

If data is processed outside the UK/EU (e.g., payments or fulfilment), we ensure compliance using Standard Contractual Clauses (SCCs) or other approved safeguards.

---

9. Data Retention

• Completed orders: 7 years (HMRC requirement)

• Cancelled/refunded/failed orders: 2 years

• Marketing & cookie consent records: 3 years from last activity

• Inactive accounts: deleted after 2 years

You can request deletion, correction, or data export anytime (see Section 10).

---

10. Your Rights

You can exercise your GDPR rights:

• Access – request a copy of your data

• Correction – fix inaccurate details

• Deletion – request erasure of unnecessary data

• Restriction – limit certain uses

• Portability – export data in standard format

• Objection – opt-out of direct marketing

• Withdraw consent – at any time

Contact: 📧
We respond within 30 days.

Complaints: You may also contact the ICO: https://ico.org.uk

---

11. Data Security & Breach Policy

We use SSL encryption, firewalls, backups, and access controls.
In case of a breach:

• We notify affected users promptly.

• We report to the ICO within 72 hours, as required.

---

12. Minors

We do not knowingly collect data from individuals under 16 years old. If discovered, we delete immediately.

---

13. Third-Party Links

External sites may have different privacy rules. We recommend reviewing their policies separately.

---

14. Updates

We may update this policy. Any changes will be published on this page with the Effective Date clearly shown.