Privacy Notice

Cellwick Ltd is the controller for the personal data described in this notice. Our registered office is 60a, Atlantic Business Centre, Atlantic Street, Altrincham, Cheshire WA14 5NQ, United Kingdom. Company number: [Companies House number].

For anything to do with your data, write to datenschutz@cellwick.de or telephone +44 7411 730722. We have [appointed / not appointed] a data protection officer. We are registered with the Information Commissioner’s Office under registration number [ICO registration number].

This notice explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We process personal data only so far as it is needed to run the shop:

• Account: title, name, company, email address, telephone number, postal address, VAT registration number, password hash.
• Orders: items, quantities, prices, billing and delivery address, payment method, VAT treatment.
• Technical data: IP address, time of access and browser identifier when you use the site (server logs).
• Consents: time, IP address and version of the texts you accepted.

We do not process special category data, and we do not use your data for automated decision-making that produces legal effects for you.

• Article 6(1)(b) UK GDPR – performance of a contract: running your account, processing and despatching orders, invoicing, handling returns and enquiries.
• Article 6(1)(c) UK GDPR – legal obligation: keeping accounting and VAT records as required by HMRC and the Companies Act 2006, and verifying VAT registration numbers.
• Article 6(1)(f) UK GDPR – legitimate interests: keeping the site and our systems secure, preventing fraud, managing stock, and recovering money owed to us. We have balanced these interests against your rights; a copy of that assessment is available on request.
• Article 6(1)(a) UK GDPR – consent: marketing emails and optional cookies. You may withdraw consent at any time, and doing so does not affect processing carried out before you withdrew it.

Under the Privacy and Electronic Communications Regulations 2003 (PECR) we may set strictly necessary cookies without asking you first. The shop sets two: a session cookie for your account and a cookie for your basket. Neither is used for tracking.

Analytics and marketing cookies are set only after you have given consent, and you can withdraw that consent at any time through your browser settings or our cookie controls.

We send marketing emails only where you have consented, or where you are an existing customer and the message concerns similar goods (the soft opt-in under PECR). Every message contains an unsubscribe link.

We share personal data only where it is needed to perform the contract or to meet a legal obligation: with our delivery partners (Royal Mail, Parcelforce or a comparable carrier), our payment providers, our accountants, and our hosting provider.

Where a supplier acts as our processor, there is a written contract that meets Article 28 UK GDPR and the supplier may act only on our documented instructions. We do not sell personal data, and we do not share it for anyone else’s marketing.

Some of our processors are established outside the United Kingdom. Where that is the case, we transfer personal data only to a country covered by UK adequacy regulations, or under the ICO’s International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment.

Because our warehouse for returns is in Germany, order and delivery data are also processed there. Transfers currently take place [not at all / to the following countries: …]. A copy of the safeguards we rely on is available on request.

We delete accounts on request, or after [24] months without activity. Invoices, VAT records and other accounting records we keep for six years from the end of the accounting period they relate to, in line with HMRC requirements and the Companies Act 2006. Server logs are deleted after seven days. Records of consent are kept for as long as we rely on the consent and for six years afterwards.

Under the UK GDPR you have the right to be informed, the right of access, and the rights to rectification, erasure, restriction of processing, data portability, and to object to processing that we base on our legitimate interests. Where we rely on consent, you may withdraw it at any time.

To exercise any of these rights, write to datenschutz@cellwick.de. We will respond within one month; if a request is complex we may extend that period and will tell you why. There is no charge unless a request is manifestly unfounded or excessive.

If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the supervisory authority:

Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire SK9 5AF
Telephone 0303 123 1113 · ico.org.uk

All traffic to and from the shop is encrypted with TLS. Passwords are stored as bcrypt hashes and never in plain text. Access to customer data is limited by role and is logged. If a personal data breach is likely to result in a risk to your rights, we will report it to the Information Commissioner’s Office within 72 hours and, where the risk is high, tell you as well.