Lawfulness, Fairness, Transparency
Processing activities are documented and mapped to lawful bases under Article 6 GDPR. Privacy notices are published in clear language and updated when processing purposes materially change.
Operational and governance controls we apply to protect personal data throughout collection, use, transfer, retention, and deletion lifecycles.
Processing activities are documented and mapped to lawful bases under Article 6 GDPR. Privacy notices are published in clear language and updated when processing purposes materially change.
Only data necessary for order fulfillment, account management, support, fraud prevention, and legal obligations is collected. Optional fields are clearly separated from mandatory operational fields.
We provide account-level correction capabilities, support-assisted amendments, and internal data quality checks to reduce stale, duplicate, or contradictory records that may impact data subjects.
Retention schedules are defined by data category (orders, logs, support, analytics, consent records). End-of-life controls include deletion, anonymization, or restricted archival according to legal requirements.
Controls include TLS encryption in transit, password hashing, principle-of-least-privilege access, segmented environments, monitoring, and secure secrets handling practices.
Administrative access is role-based, time-limited where feasible, and logged for auditability. Privileged actions may require elevated verification and are subject to periodic entitlement reviews.
Third-party providers are selected through risk assessment and contractual controls (DPA/SCC as applicable). Data transfers are reviewed for legal transfer mechanisms and supplementary safeguards.
Where data leaves the UK/EU/EEA, transfers rely on recognized mechanisms such as adequacy decisions, standard contractual clauses, and technical safeguards like encryption and minimization.
Processing inventories track categories of data, purposes, recipients, legal bases, retention, and transfer context to support compliance accountability and operational readiness.
Privacy and security requirements are incorporated into product changes, API behavior, and feature planning with conservative defaults, scoped collection, and reduced data exposure patterns.
Structured workflows handle access, rectification, erasure, restriction, objection, portability, and consent withdrawal. Identity verification and legal exception handling are built into request handling.
Incidents are triaged with severity criteria, forensic logging, and containment procedures. Where legally required, supervisory authorities and affected individuals are notified within statutory timelines.
Services are not designed for children under applicable age thresholds. Special category data is not intentionally requested for routine commerce operations and is restricted when encountered unexpectedly.
Non-essential cookies/trackers are controlled via consent interfaces. Consent state is logged and revocable. Essential cookies remain available only for core site functionality and security.
Policies, procedures, risk assessments, processor contracts, and incident records are maintained to demonstrate compliance posture and support internal/external inquiries.
Personnel handling customer data receive periodic security/privacy training including phishing defense, secure handling obligations, escalation procedures, and confidentiality responsibilities.
Compliance controls are reviewed in light of legal updates, operational incidents, and vendor changes. Corrective actions are tracked and prioritized according to risk and impact.