1. Who we are

Data Controller: CYBRAXO LTD (Company No. 15605119) is the controller responsible for your personal data processed in connection with the Website.

If you contact us about privacy, we may ask for information to verify your identity before processing your request (for your security).

2. Personal data we collect

We collect personal data directly from you, automatically through your use of the Website, and (where relevant) from service providers that support transactions and Website functionality.

What we do not collect

• Full payment card data: card numbers, CVV/CVC codes, and full magnetic stripe data are not stored on our servers.
• Sensitive categories of data (e.g., health, religion, political opinions) are not required for our services. Please do not send such data to us.

If you report an issue with an order (for example, damaged/defective goods), we may request evidence such as photos within the relevant timeframe to investigate and resolve the matter.

3. How we use personal data

We use personal data for the following purposes:

• Order processing: confirm purchases, fulfil orders, handle shipping, returns and refunds, and provide order updates.
• Customer service: respond to your questions, resolve issues, and maintain communication related to your orders and requests.
• Website functionality: maintain accounts (if enabled), prevent fraud, secure the Website, and ensure performance.
• Improvement & analytics: understand how the Website is used and improve content, user experience, and reliability (using GDPR-safe methods and consent where required).
• Marketing (if you choose): send newsletters and promotions, measure campaign performance, and personalise communications where lawful and appropriate.
• Legal & compliance: meet legal obligations, maintain records, and defend or pursue legal claims if necessary.

4. Lawful bases for processing (UK GDPR)

We process personal data only when we have a lawful basis. Depending on the context, these may include:

• Contract: to perform a contract with you (e.g., processing and delivering your order) or to take steps at your request before entering a contract.
• Legal obligation: to comply with our legal requirements (e.g., tax and accounting rules, consumer protection obligations).
• Legitimate interests: to operate and improve our business, prevent fraud, maintain Website security, and provide customer service—provided these interests are not overridden by your rights.
• Consent: where required (e.g., certain cookies, and some marketing communications). You can withdraw consent at any time.

If we rely on legitimate interests, we consider the impact on your rights and implement safeguards where appropriate.

5. How we share data

We may share personal data with trusted third parties only where necessary to operate the Website and provide services. We require service providers to protect personal data and use it only for authorised purposes.

Categories of recipients

• Delivery partners / carriers: to ship your order and provide tracking or delivery updates.
• Payment service providers: to process payments securely. Card data is handled by the provider; we receive only limited confirmation details (e.g., payment status and transaction reference).
• IT, hosting, and e-commerce providers: to host the Website, store data securely, provide core store functionality, and maintain service reliability.
• Professional advisers: legal advisers, accountants, auditors, insurers, and other professional consultants where necessary for compliance or legitimate business needs.
• Authorities and regulators: where required by law, court order, or to protect rights, safety, or prevent fraud.

No selling of personal data

We do not sell your personal data to third parties.

6. International transfers

Because we serve customers in the UK and worldwide, your personal data may be transferred to, stored in, or accessed from locations outside the UK and/or the European Economic Area (EEA). Where international transfers occur, we use appropriate safeguards to ensure an adequate level of protection, which may include (as applicable) contractual protections such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to EU Standard Contractual Clauses, and/or reliance on adequacy regulations where recognised.

You may contact us at support@cybraxo.co.uk to request additional information about safeguards applied to relevant transfers (where applicable).

7. Data retention

We keep personal data only for as long as necessary for the purposes described in this policy, including to meet legal, accounting, or reporting requirements. Retention periods vary depending on the nature of the data and why it is processed. For example:

• Order and transaction records may be retained for statutory periods required for tax and accounting.
• Customer support communications may be retained to help resolve queries, maintain service history, and defend or pursue legal claims.
• Marketing data is retained until you unsubscribe/withdraw consent (or as otherwise required by law).

When data is no longer required, we securely delete or anonymise it, where feasible.

8. Security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access controls, encryption in transit where supported, secure hosting practices, and internal procedures for handling data.

While we take reasonable steps to protect your data, no method of transmission or storage can be guaranteed to be 100% secure. If you believe your data has been compromised, please contact us immediately.

9. Marketing & communications

If you opt in (or where otherwise permitted by law), we may send marketing communications about products, promotions, and updates. You can opt out at any time by using the unsubscribe link in the message or by contacting us.

Service messages (such as order confirmations, shipping updates, and responses to your support requests) are not marketing and may be sent regardless of marketing preferences because they are necessary to perform our contract with you or to provide customer service.

10. Cookies & similar technologies

We use cookies and similar technologies to operate the Website, remember preferences, improve performance, and (where enabled) understand usage patterns or measure marketing performance. Some cookies are strictly necessary; others may require your consent depending on their purpose and applicable law.

For details on what cookies we use, why we use them, and how to manage your preferences, see our Cookies Policy.

11. Your rights (UK GDPR)

Subject to certain limitations and legal requirements, you may have the right to:

• Access your personal data and receive a copy of it
• Rectification of inaccurate or incomplete data
• Erasure (the “right to be forgotten”) in certain circumstances
• Restriction of processing in certain circumstances
• Data portability (transfer your data to another provider)
• Object to processing based on legitimate interests and to direct marketing
• Withdraw consent where processing is based on consent

How to exercise your rights

To make a request, contact us at support@cybraxo.co.uk. We may request information to verify your identity and will respond within the timeframe required by applicable law.

Complaints

If you are unhappy with how we handle your personal data, you can contact us first so we can address your concern. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).

ICO contact details can be found on the ICO website (Information Commissioner’s Office).

12. Children

The Website is not intended for children under 16 years of age, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can take appropriate steps.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to our practices, services, legal requirements, or for other operational reasons. When we update the policy, we will revise the “Last updated” date at the top of this page. Where appropriate, we may provide additional notice (for example, via the Website).

14. Contact us

For questions, requests, or concerns regarding privacy or this policy, contact us using the details below:

Please include your name, the email address used on the Website (if applicable), and enough detail for us to locate relevant records (e.g., order number) so we can help quickly and securely.