MODULO PRIVACY POLICY

Last updated: [DATE]

1. About This Privacy Policy

This Privacy Policy explains how Modulo collects, uses, shares, stores and protects personal information when you:

• visit or use our website;

• create an account;

• request a quotation;

• place or manage an order;

• contact us;

• sign up for marketing;

• submit a review;

• interact with our advertisements; or

• otherwise use our products and services.

Our website and online store are powered by Shopify.

This Policy should be read alongside our Cookie Policy, Terms and Conditions of Sale, Shipping and Delivery Policy and Returns and Refunds Policy.

2. Who We Are

[FULL LEGAL ENTITY NAME], trading as Modulo, is the controller responsible for the personal information described in this Policy.

Our details are:

Trading name: Modulo
Legal entity: [FULL LEGAL ENTITY NAME]
Registered or principal address: [INSERT ADDRESS]
Company number: [INSERT COMPANY NUMBER]
VAT number: [INSERT VAT NUMBER, IF APPLICABLE]
Email: sales@modulokitchens.co.uk
Telephone: [INSERT TELEPHONE NUMBER]
ICO registration number: [INSERT ICO REGISTRATION NUMBER, IF APPLICABLE]

Where we determine why and how personal information is used, we act as the data controller.

Some third parties, including Shopify, payment providers and advertising platforms, may act as separate controllers for certain processing they carry out for their own purposes.

3. What Is Personal Information?

Personal information means information relating to an identified or identifiable living person.

It may identify someone directly, such as through their name or email address, or indirectly when combined with other information.

Information that has been irreversibly anonymised so that no person can reasonably be identified is not personal information.

4. Personal Information We Collect

The information we collect depends on how you interact with Modulo.

4.1 Identity and contact information

This may include:

• name;

• title;

• billing address;

• delivery address;

• email address;

• telephone number;

• company or trading name; and

• account username.

4.2 Order and transaction information

This may include:

• products viewed or ordered;

• quotations;

• order numbers;

• purchase history;

• basket contents;

• product preferences;

• delivery instructions;

• returns;

• refunds;

• exchanges;

• complaints;

• warranty claims; and

• correspondence relating to an order.

4.3 Payment information

This may include:

• payment method;

• payment status;

• transaction reference;

• billing details;

• refund information; and

• fraud-screening results.

Payment-card information is generally collected and processed directly by Shopify Payments or another authorised payment provider. Modulo does not normally receive or retain complete payment-card numbers or security codes.

4.4 Account information

This may include:

• login credentials;

• account preferences;

• saved addresses;

• saved products;

• order history; and

• communication preferences.

Passwords are stored in protected or encrypted form by the relevant platform provider and are not visible to Modulo in plain text.

4.5 Website, device and technical information

This may include:

• IP address;

• device type;

• browser type and version;

• operating system;

• time zone;

• language;

• device or advertising identifiers;

• referring website;

• pages visited;

• links selected;

• session information;

• cookie identifiers;

• approximate location derived from an IP address; and

• information about how you navigate or use the website.

4.6 Marketing information

This may include:

• whether you have agreed to receive marketing;

• marketing channels selected;

• email opens and link clicks;

• advertisements viewed or selected;

• campaign attribution;

• browsing and purchase interests; and

• your responses to promotions.

4.7 Communications and customer-service information

This may include information provided when you:

• email or telephone us;

• use a contact form;

• request support;

• report damaged or faulty goods;

• make a complaint;

• submit photographs or videos;

• communicate through social media; or

• respond to a survey.

Calls are not recorded unless we tell you before recording begins.

4.8 Reviews and user-generated content

This may include:

• your name or chosen display name;

• review text;

• star rating;

• photographs or videos;

• product purchased; and

• any response we publish.

You should not include sensitive, confidential or unnecessary personal information in a public review.

4.9 Fraud, security and compliance information

This may include:

• identity-verification results;

• IP and device-risk indicators;

• suspected fraudulent activity;

• chargeback information;

• delivery verification;

• records of policy or account misuse; and

• information required to establish, exercise or defend legal claims.

4.10 Trade customer information

Where you purchase or enquire on behalf of a business, we may collect:

• job title;

• employer or business name;

• company registration details;

• VAT number;

• trade references;

• credit information;

• purchasing authority; and

• business account information.

4.11 Special category and criminal-offence information

We do not intentionally request special category information, such as information concerning health, ethnicity, religion, political opinions or sexual orientation.

You should not provide this information unless it is genuinely necessary.

We may process limited health or accessibility information where you voluntarily provide it because it is necessary to make reasonable delivery or communication arrangements.

We do not routinely process criminal-offence information. Where fraud or criminal activity is suspected, relevant information may be processed where permitted by law.

5. How We Collect Personal Information

We collect personal information from the following sources.

5.1 Directly from you

For example, when you:

• visit our website;

• create an account;

• request a quotation;

• place an order;

• communicate with us;

• return a product;

• make a complaint;

• join our mailing list;

• submit a review; or

• enter a promotion.

5.2 Automatically through our website

We may collect technical and usage information through:

• cookies;

• pixels;

• tags;

• scripts;

• local storage;

• server logs;

• software development kits;

• device identifiers; and

• similar technologies.

Further information is contained in our Cookie Policy and cookie preference centre.

5.3 From service providers

We may receive information from:

• Shopify;

• payment providers;

• fraud-prevention providers;

• delivery companies;

• manufacturers;

• distributors;

• warehouse and fulfilment providers;

• customer-service systems;

• email and SMS providers;

• analytics providers; and

• website-security providers.

5.4 From marketing and advertising partners

Subject to applicable consent and cookie rules, we may receive information from:

• Meta;

• Google;

• Microsoft;

• TikTok;

• Shopify’s advertising services;

• affiliate partners; and

• other advertising or attribution providers.

5.5 From publicly available and business sources

For trade customers, we may obtain information from:

• Companies House;

• public business websites;

• credit-reference agencies;

• trade-reference providers; and

• fraud-prevention databases.

6. Our Lawful Bases for Processing

We process personal information only where we have a lawful basis.

The main lawful bases we rely upon are:

6.1 Contract

We process information where necessary to:

• provide a quotation;

• take steps requested before entering a contract;

• process an order;

• receive payment;

• arrange delivery;

• manage returns and refunds;

• deal with faults and warranties; or

• otherwise perform our contract with you.

6.2 Legal obligation

We process information where necessary to comply with obligations concerning:

• tax;

• accounting;

• consumer protection;

• product safety;

• fraud prevention;

• court orders;

• law-enforcement requests;

• data-protection compliance; and

• other applicable legal requirements.

6.3 Legitimate interests

We may process information where necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms.

These interests may include:

• operating and improving our business;

• providing customer service;

• maintaining accurate business records;

• protecting our website and systems;

• preventing fraud and misuse;

• managing supplier and carrier relationships;

• understanding website and product performance;

• defending legal claims;

• recovering unpaid debts;

• maintaining network and information security; and

• marketing similar products to existing customers where permitted.

Where required, we assess the necessity and balance of the processing before relying on legitimate interests.

6.4 Consent

We rely on consent where required, including for:

• certain marketing communications;

• non-essential cookies and similar technologies;

• certain personalised advertising;

• publication or reuse of particular customer photographs or videos; and

• any other processing for which we specifically request consent.

You may withdraw consent at any time. Withdrawal does not affect processing lawfully carried out before consent was withdrawn.

7. How and Why We Use Personal Information

7.1 Website enquiries and quotations

We use identity, contact, project and communication information to:

• respond to enquiries;

• prepare quotations;

• answer product questions;

• check availability; and

• take steps towards a possible order.

Lawful basis: contract where the enquiry concerns a potential purchase, and legitimate interests in managing genuine business enquiries.

7.2 Orders and payments

We use identity, contact, transaction and payment information to:

• accept and manage orders;

• process payments;

• issue invoices;

• carry out fraud checks;

• provide order updates;

• manage refunds; and

• maintain transaction records.

Lawful basis: contract, legal obligation and legitimate interests in preventing fraud and maintaining accurate records.

7.3 Delivery and fulfilment

We use names, addresses, contact information, order information and delivery instructions to:

• arrange dispatch;

• book carriers;

• provide delivery updates;

• complete delivery;

• manage failed deliveries; and

• resolve delivery problems.

Lawful basis: contract and legitimate interests in managing efficient fulfilment.

7.4 Returns, faults, warranties and complaints

We use order information, correspondence, photographs, video and other evidence to:

• assess return requests;

• investigate damaged or faulty products;

• arrange inspection or collection;

• process refunds;

• pursue supplier or carrier claims;

• manage warranties; and

• resolve complaints.

Lawful basis: contract, legal obligation and legitimate interests in managing claims and protecting our legal position.

7.5 Accounts

We use identity, contact, login and order information to:

• create and administer accounts;

• authenticate users;

• retain saved preferences;

• provide order history; and

• protect accounts against unauthorised use.

Lawful basis: contract and legitimate interests in providing and securing account functionality.

7.6 Customer service

We use contact and communication information to:

• respond to requests;

• provide support;

• investigate problems;

• maintain service records; and

• improve customer service.

Lawful basis: contract and legitimate interests in managing customer relationships.

7.7 Website operation and security

We use technical, device and usage information to:

• provide website functions;

• maintain sessions and baskets;

• protect accounts;

• identify security threats;

• detect attacks;

• diagnose errors;

• prevent misuse; and

• maintain system availability.

Lawful basis: legitimate interests and, where cookies or similar technologies are involved, consent or an applicable exemption under PECR.

7.8 Analytics and website improvement

We may use technical and usage information to:

• understand how the website is used;

• measure performance;

• identify popular products;

• improve navigation;

• diagnose problems; and

• test changes.

Lawful basis: legitimate interests and, where required under cookie and electronic-communications rules, consent.

Where an applicable low-risk statistical or website-improvement exemption is relied upon, we will provide clear information and a simple means to object where required.

7.9 Marketing

We may use contact, transaction and marketing information to:

• send product news;

• promote offers;

• send abandoned-basket reminders;

• recommend related products;

• measure marketing performance; and

• maintain suppression lists.

Marketing may be based on:

• your consent;

• the electronic-marketing “soft opt-in” for similar products where legally available; or

• legitimate interests for marketing channels not requiring consent, such as certain postal business marketing.

Every electronic marketing message will provide an appropriate method to unsubscribe.

7.10 Personalised advertising

Subject to your choices and applicable consent requirements, we may use website, device, transaction and marketing information to:

• build advertising audiences;

• measure advertisement performance;

• attribute sales;

• limit repeated advertisements;

• show advertisements likely to be relevant; and

• reconnect with visitors who viewed products or abandoned a basket.

Lawful basis: consent where required for cookies, pixels or similar tracking, together with any applicable UK GDPR lawful basis.

Rejecting advertising cookies will not prevent you from using the basic website, although advertisements may be less relevant.

7.11 Reviews and customer content

We may use review and user-generated content to:

• publish reviews;

• respond to feedback;

• verify genuine purchases;

• moderate inappropriate content;

• improve products and service; and

• promote Modulo where separate permission has been obtained where required.

Lawful basis: legitimate interests, contract where a review service forms part of the website, and consent for specified promotional reuse where appropriate.

7.12 Legal, regulatory and insurance matters

We may use relevant information to:

• comply with law;

• respond to regulators;

• respond to court or law-enforcement requests;

• obtain legal advice;

• pursue or defend claims;

• manage insurance matters; and

• enforce our contracts and policies.

Lawful basis: legal obligation and legitimate interests in protecting our legal rights.

7.13 Business administration

We may use information for:

• accounting;

• audit;

• forecasting;

• internal reporting;

• supplier management;

• corporate transactions; and

• business continuity.

Lawful basis: legal obligation and legitimate interests in operating and protecting our business.

8. Marketing Communications

We may send marketing by email, SMS, post or other permitted channels.

We will obtain consent where consent is required.

Where permitted by law, we may send existing customers marketing about products similar to those they previously purchased or enquired about. Customers will be given an opportunity to object when their details are collected and in every subsequent message.

You may opt out at any time by:

• selecting the unsubscribe link in an email;

• following the opt-out instructions in a message;

• adjusting your account or cookie preferences; or

• contacting sales@modulokitchens.co.uk.

Opting out of marketing does not stop essential service communications, including order, delivery, return, safety, account or legal notices.

We may retain limited contact information on a suppression list to ensure that we continue to respect your opt-out request.

9. Cookies and Similar Technologies

Our website uses cookies and similar storage or access technologies.

These may include:

• essential cookies;

• basket and checkout cookies;

• security cookies;

• preference cookies;

• analytics technologies;

• advertising cookies;

• tracking pixels;

• local storage; and

• device identifiers.

Essential technologies may operate without consent where legally permitted because they are necessary to provide a service requested by you or satisfy another applicable exemption.

Where consent is required, non-essential technologies will not be used until you have made the relevant choice.

You may:

• accept or reject non-essential technologies;

• make choices by category;

• change your choices; and

• withdraw consent through our cookie preference centre.

Advertising technologies are not treated as essential.

Further information, including technology providers, purposes and durations, is contained in our Cookie Policy or cookie preference centre.

10. Automated Decision-Making and Profiling

We may use limited automated tools for:

• fraud screening;

• payment-risk checks;

• account security;

• advertising audience selection;

• product recommendations; and

• marketing attribution.

These activities may involve profiling based on transaction, device or browsing information.

We do not currently make decisions based solely on automated processing that produce legal or similarly significant effects on customers, except where necessary to enter into or perform a contract, authorised by law or based on explicit consent.

A payment provider or fraud-prevention provider may independently decline or refer a transaction based on its own automated systems.

Where applicable, you may ask for human intervention, express your view and challenge a significant automated decision.

11. Who We Share Personal Information With

We share personal information only where reasonably necessary and permitted by law.

Recipients may include the following.

11.1 Shopify

Shopify hosts and operates the ecommerce platform, checkout and associated services.

Information submitted through the website is processed through Shopify’s systems.

Shopify may act:

• as our processor when providing services on our instructions; and

• as a separate controller for certain platform, security, analytics, advertising or service-improvement activities.

Shopify’s own privacy information explains its independent processing.

11.2 Payment providers

We may share transaction and payment information with:

• Shopify Payments;

• card networks;

• banks;

• payment gateways;

• PayPal or similar services; and

• fraud-prevention providers.

These organisations may act as processors or separate controllers, depending on the service.

11.3 Manufacturers, distributors and fulfilment providers

We may share information needed to:

• source products;

• fulfil orders;

• provide product support;

• process warranty claims;

• arrange replacements; or

• investigate faults.

This may include names, contact details, delivery addresses, order details, photographs and technical information.

11.4 Delivery companies

We may provide carriers and logistics providers with information needed to arrange, track and complete delivery or collection.

This may include:

• recipient name;

• address;

• telephone number;

• email address;

• order size;

• delivery instructions; and

• relevant access information.

11.5 Technology and professional providers

We may share information with providers of:

• website hosting;

• cloud storage;

• IT support;

• cybersecurity;

• customer-service software;

• email and SMS systems;

• accounting;

• analytics;

• review services;

• legal services;

• insurance;

• audit; and

• business consultancy.

11.6 Marketing and advertising providers

Subject to applicable consent and privacy choices, information may be shared with advertising, analytics and marketing providers including:

• Meta;

• Google;

• Microsoft;

• TikTok;

• Shopify;

• email service providers; and

• marketing agencies.

These providers may receive technical identifiers, cookie information, transaction events and audience information.

11.7 Authorities and legal recipients

We may disclose information to:

• courts;

• law-enforcement bodies;

• regulators;

• tax authorities;

• government agencies;

• legal advisers;

• insurers; and

• fraud-prevention organisations

where required by law or reasonably necessary to establish, exercise or defend legal rights.

11.8 Corporate transactions

Personal information may be shared with prospective buyers, investors, lenders or advisers in connection with:

• a sale;

• merger;

• acquisition;

• restructuring;

• financing;

• administration;

• insolvency; or

• transfer of part or all of the business.

Appropriate confidentiality and data-protection safeguards will be used.

12. International Transfers

Some providers used by Modulo, including Shopify, cloud providers, payment providers and advertising platforms, may process personal information outside the United Kingdom.

Where personal information is transferred to a country that is not covered by UK adequacy regulations, we will use an appropriate transfer safeguard where required.

These safeguards may include:

• the UK International Data Transfer Agreement;

• the UK Addendum to the European Commission’s Standard Contractual Clauses;

• another approved contractual mechanism;

• binding corporate rules; or

• a lawful exception available for a particular transfer.

Where required, we or the relevant provider will assess whether additional technical, contractual or organisational safeguards are necessary.

You may contact us for further information about the safeguards applying to relevant transfers.

13. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention and dispute-resolution requirements.

Our normal retention approach is set out below.

13.1 Enquiries and unsuccessful quotations

Normally retained for up to 24 months after the last meaningful contact, unless a longer period is necessary because of a complaint, dispute or anticipated claim.

13.2 Orders, invoices and transaction records

Normally retained for up to seven years after the end of the relevant accounting period or transaction relationship, to satisfy tax, accounting and legal requirements.

13.3 Account information

Retained while the account remains active and normally deleted or anonymised within 24 months after account closure or prolonged inactivity, except where transaction or legal records must be retained longer.

13.4 Delivery records

Normally retained with the relevant order record for up to seven years, particularly where needed to evidence delivery or resolve claims.

13.5 Returns, warranty claims and complaints

Normally retained for up to six years after final resolution, or longer where litigation, product safety or regulatory issues justify continued retention.

13.6 Customer-service communications

Normally retained for up to three years after the communication is resolved, unless linked to an order, complaint, claim or legal requirement requiring longer retention.

13.7 Marketing records

Marketing contact information is retained while you remain subscribed.

Records of consent and opt-out requests may be retained for as long as necessary to demonstrate compliance and maintain suppression lists.

Inactive marketing records may be reviewed and deleted or anonymised after 24 months without meaningful engagement, subject to our continuing need to retain suppression information.

13.8 Cookie and analytics information

Retention varies by technology and provider and is shown in our cookie preference centre or Cookie Policy.

13.9 Fraud and security records

Normally retained for up to six years, or longer where necessary to investigate continuing fraud, protect systems, comply with law or defend claims.

At the end of the relevant retention period, information will be deleted, securely destroyed or anonymised unless continued retention is legally justified.

14. Data Security

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;

• accidental loss;

• alteration;

• disclosure;

• misuse; and

• destruction.

Measures may include:

• access controls;

• multi-factor authentication;

• encrypted connections;

• secure payment processing;

• software updates;

• malware protection;

• backups;

• staff access restrictions;

• supplier due diligence;

• contractual safeguards; and

• incident-response procedures.

Access to personal information is limited to persons who require it for legitimate business purposes.

No internet transmission or storage method is completely secure. You should use a strong, unique password and must not share account credentials.

Contact us promptly if you believe your account or personal information has been compromised.

15. Personal Data Breaches

We maintain procedures to identify, investigate and manage suspected personal data breaches.

Where legally required, we will notify the Information Commissioner’s Office and affected individuals.

We may contact you where necessary to protect your account, investigate an incident or explain protective action you should take.

16. Your Data-Protection Rights

Depending on the circumstances, you may have the following rights.

16.1 Right to be informed

You have the right to clear information about how your personal information is used.

16.2 Right of access

You may request confirmation of whether we process your personal information and receive a copy of relevant information.

16.3 Right to rectification

You may ask us to correct inaccurate information or complete incomplete information.

16.4 Right to erasure

You may ask us to delete personal information in certain circumstances.

This right does not apply where continued processing is necessary, including for legal obligations, transaction records, fraud prevention or legal claims.

16.5 Right to restrict processing

You may ask us to restrict use of your information in certain circumstances, including while accuracy or an objection is investigated.

16.6 Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request relevant information in a structured, commonly used and machine-readable format.

16.7 Right to object

You may object to processing based on legitimate interests.

We will stop processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is needed for legal claims.

You have an absolute right to object to the use of your personal information for direct marketing.

16.8 Rights concerning automated decisions

Where applicable, you may have rights concerning decisions based solely on automated processing which produce legal or similarly significant effects.

16.9 Right to withdraw consent

Where processing is based on consent, you may withdraw consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

16.10 Right to complain

You may complain to Modulo or to the Information Commissioner’s Office.

17. How to Exercise Your Rights

To exercise a right, contact:

Email: sales@modulokitchens.co.uk
Address: [INSERT PRIVACY CONTACT ADDRESS]

Please state clearly:

• your name;

• your contact details;

• the right you wish to exercise; and

• enough information to identify the relevant records.

We may request information reasonably necessary to verify your identity and protect personal information against unauthorised disclosure.

You may authorise another person to act on your behalf. We may require evidence of their authority and may verify your identity directly.

We normally respond without undue delay and within one month.

Where a request is complex or numerous, the response period may be extended where permitted by law. We will explain any extension.

Rights requests are normally free. A reasonable fee may be charged, or a request refused, where a request is manifestly unfounded or excessive and the law permits this.

18. Complaints to the Information Commissioner

Please contact us first if you have concerns so that we have an opportunity to resolve them.

You may also complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

You can find current contact and complaint information on the ICO website.

You normally have the right to complain without first contacting us, although the ICO may ask whether you have given us an opportunity to address the issue.

19. Children

Our website and products are not intended for children.

We do not knowingly collect personal information directly from children under 13.

Orders may be placed only by persons aged 18 or over.

If you believe a child has provided personal information to us without appropriate authority, contact us so that we can investigate and take appropriate action.

20. Third-Party Websites and Social Media

Our website may contain links to third-party websites, applications and social-media services.

Those third parties control their own processing and privacy practices.

Modulo is not responsible for how an independent third party handles information after you leave our website or interact directly with its service.

You should review the relevant third party’s privacy notice before providing personal information.

21. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

• changes to our business;

• changes to service providers;

• new technology;

• changes in legal or regulatory requirements; or

• improvements to how we explain our processing.

The latest version will be posted on this page with an updated date.

Where required by law, we will provide additional notice or request renewed consent.

Changes will not retrospectively make earlier processing lawful where it was not lawful when undertaken.

22. Contact Us

For questions, complaints or requests concerning this Privacy Policy or your personal information, contact:

Modulo Privacy Contact
Legal entity: [FULL LEGAL ENTITY NAME]
Address: [INSERT ADDRESS]
Email: sales@modulokitchens.co.uk
Telephone: [INSERT TELEPHONE NUMBER]