Privacy Policy

How we collect, use, and protect your personal data under UK GDPR

Last updated: February 2026

IT Remarketing Limited ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data Controller

IT Remarketing Limited
Swan Ken, Broadbridge Heath Road, Warnham, Horsham, RH12 3PA
Privacy Contact: sales@itremarketing.co.uk
Phone: 020 4591 5420
Company No: 15820855 | VAT No: GB477755043

Personal Data You Provide Directly

Identity Data: First name, last name
Contact Data: Email address, telephone number, delivery and billing address
Financial Data: Payment card details (processed securely by Shopify Payments — we do not store card numbers)
Transaction Data: Details of products purchased, order history, payment records
Communication Data: Messages you send via our contact form, email, or phone
Marketing Preferences: Whether you have opted in to receive marketing communications

Personal Data Collected Automatically

Technical Data: IP address, browser type and version, operating system, time zone setting
Usage Data: Pages visited, time spent on pages, page interaction data, referring URL
Cookie Data: See our Cookie Policy for full details

Data We Do Not Collect

We do not collect any Special Category Data (e.g., health data, biometric data, political opinions, religious beliefs) or criminal conviction data.

Under Article 6 of the UK GDPR, we rely on the following lawful bases for processing your personal data:

Purpose	Lawful Basis	Data Used
Processing and fulfilling your orders	Performance of a contract (Art. 6(1)(b))	Identity, Contact, Financial, Transaction
Managing your account	Performance of a contract (Art. 6(1)(b))	Identity, Contact, Transaction
Responding to enquiries and support requests	Performance of a contract / Legitimate interest (Art. 6(1)(b)/(f))	Identity, Contact, Communication
Sending order updates (confirmation, dispatch, delivery)	Performance of a contract (Art. 6(1)(b))	Identity, Contact, Transaction
Sending marketing emails and newsletters	Consent (Art. 6(1)(a)) — you can withdraw anytime	Identity, Contact, Marketing Preferences
Website analytics and performance improvement	Legitimate interest (Art. 6(1)(f))	Technical, Usage, Cookie Data
Fraud prevention and website security	Legitimate interest (Art. 6(1)(f))	Technical, Identity, Transaction
Compliance with legal obligations (tax, accounting)	Legal obligation (Art. 6(1)(c))	Identity, Financial, Transaction

Legitimate Interest Assessment

Where we rely on legitimate interests, we have carried out a balancing test to ensure our interests do not override your fundamental rights and freedoms. You may request details of this assessment by contacting us.

Order Fulfilment: Processing, dispatching, and delivering your orders
Customer Service: Responding to enquiries, complaints, and support requests
Transactional Communications: Order confirmations, shipping updates, delivery notifications, receipts
Marketing: Promotional offers, new product announcements, newsletters (only with your explicit opt-in consent under PECR)
Service Improvement: Analysing website usage patterns to improve our products and website experience
Security: Protecting against fraud, unauthorised access, and other security threats
Legal Compliance: Meeting our obligations under tax, consumer protection, and other applicable laws

We share your personal data only with trusted third parties who need it to provide services on our behalf. We do not and will never sell your personal data.

Category	Provider(s)	Purpose	Location
E-commerce Platform	Shopify Inc.	Order processing, hosting, payment processing	Canada / USA (adequacy decision)
Payment Processing	Shopify Payments (Stripe)	Secure card payment processing	UK / EEA
Delivery Partners	Royal Mail, DPD, UPS	Order delivery and tracking	UK
Analytics	Google Analytics (G-YG2J62JYBX)	Website usage analysis (anonymised)	USA (SCCs in place)
Tag Management	Google Tag Manager (GTM-T6G35NMJ)	Managing website tracking scripts	USA (SCCs in place)
Email (Transactional)	Shopify Email	Order confirmations and shipping updates	Canada / USA

Your Data is Protected

All third-party processors are contractually obligated to process your data only on our instructions and in compliance with UK GDPR. We have Data Processing Agreements in place with each provider.

Some of our service providers are based outside the UK. When we transfer personal data internationally, we ensure it is protected by one of the following safeguards:

UK Adequacy Decisions: Transfers to countries deemed to provide adequate data protection by the UK Secretary of State (e.g., Canada under PIPEDA for commercial activities)
International Data Transfer Agreement (IDTA): UK-approved Standard Contractual Clauses for transfers to the USA and other countries
Supplementary Measures: Additional technical and organisational safeguards where necessary, such as encryption and pseudonymisation

You may request a copy of the relevant transfer safeguards by contacting us.

We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:

TLS/SSL encryption (256-bit) for all data in transit
PCI DSS compliant payment processing via Shopify Payments
Encrypted data at rest on Shopify's infrastructure
Access controls and principle of least privilege for staff
Regular review of security practices and incident response procedures

Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform you without undue delay, as required under Articles 33 and 34 of the UK GDPR.

We retain personal data only for as long as necessary for the purposes set out in this policy. Our specific retention periods are:

Data Category	Retention Period	Reason
Order and transaction records	7 years from date of transaction	HMRC tax and accounting obligations
Customer account data	Until you request deletion or 3 years of inactivity	Contract performance and customer service
Marketing consent records	Until you withdraw consent	Compliance with PECR and UK GDPR
Contact form messages	2 years from enquiry date	Legitimate interest in resolving queries
Website analytics data	26 months (Google Analytics default)	Legitimate interest in service improvement
Cookie consent preferences	12 months	PECR compliance

When data is no longer needed, it is securely deleted or anonymised.

Under UK GDPR and the Data Protection Act 2018, you have the following rights. These rights are not absolute and may be subject to exemptions:

Right of Access (Art. 15): Request a copy of the personal data we hold about you (Subject Access Request). We will respond within one month
Right to Rectification (Art. 16): Have inaccurate or incomplete personal data corrected
Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten") where there is no compelling reason for continued processing
Right to Restrict Processing (Art. 18): Request that we limit how we use your data while a concern is being investigated
Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format
Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing purposes
Right to Withdraw Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing

How to Exercise Your Rights

To exercise any of these rights, email us at sales@itremarketing.co.uk with the subject line "Data Protection Request". We may need to verify your identity before processing your request. We will respond within one calendar month as required by law.