Privacy Policy

Privacy Policy

    Last updated: 28 December 2024

    This privacy policy describes how ErgoSteg ("the website," "we," "us," or "our") collects, uses and shares your personal data when you visit, use our services, or make a purchase from ergosteg.uk (the "website"), or otherwise communicate with us regarding the website (together, the "services"). The use of "you"/"your" (etc.) in this privacy policy refers to you as a user of the services, whether you are a customer, website visitor, or any other person about whom we have collected data under this privacy policy.

    We recommend that you read this privacy policy carefully.

    Changes to this privacy policy

    We may update this privacy policy from time to time, for example to reflect new practices or for other operational, legal or regulatory reasons. The revised privacy policy will be posted on the website, indicated by the date at "Last updated," and we will take any other steps required by applicable law.

    How we collect and use personal data

    To provide the services, we collect your personal data from a variety of sources as described below. The data we collect and use varies depending on how you interact with us.

    In addition to the specific purposes described below, we may use the data we've collected about you to communicate with you, provide or improve the services, comply with any applicable legal requirements, enforce any applicable terms of service, and protect the services, our rights, and the rights of our users and others.

    What personal data we collect

    The types of personal data we collect about you depend on how you interact with our website and use our services. When we use the term "personal data," we mean information that identifies, relates to, describes, or can otherwise reasonably be linked to you. The sections below describe the categories and specific types of personal data we collect.

    Data we collect directly from you

    Data you submit to us directly through our services may include:

    • Contact details — for example your name, address, phone number and email address.
    • Order information — for example name, billing address, shipping address, payment confirmation, email address and phone number.
    • Account information — for example username, password, security questions, and other information used to protect your account.
    • Customer support information — for example information you choose to share with us when communicating with us, such as when sending a message through the services.

    Certain features of the services may require you to directly provide us with specific information about yourself. You may choose not to share such information, but doing so may make it impossible for you to use or access those features.

    Information we collect about your use

    We may also automatically collect certain information about your interaction with the services ("Usage Data"). For this purpose, we may use cookies, pixels, and similar technologies ("Cookies"). Usage Data may include information about how you access and use our website and account, including data about your device, browser, network connection, IP address, and other information about your interaction with the services.

    Information we obtain from third parties

    Finally, we may also obtain information about you from third parties, including vendors and service providers who may collect information on our behalf, such as:

    • Companies who support our website and services, for example Shopify.
    • Our payment processors, who collect payment information (e.g. bank account details, credit or debit card details, billing address) in order to process your payment, fulfil your orders and deliver the products or services you have requested, in order to perform our contract with you.
    • When you visit our website, open or click on emails we send you, or interact with our services or adverts, we or third parties we work with may automatically collect certain information using online tracking technologies such as pixels, web beacons, SDKs, third-party libraries, and cookies.

    All information we receive from third parties will be treated in accordance with this privacy policy. Please also see the section below, "Third-party websites and links."

    How we use your personal data

    Providing products and services. We use your personal data to provide you with the services in order to perform our contract with you, including to process your payments, fulfil your orders, send you communications related to your account, purchases, returns, exchanges or other transactions, create, maintain and otherwise manage your account, arrange shipping, facilitate any returns and exchanges, and other features and functions related to your account. We may also improve your shopping experience by allowing Shopify to match your account with other Shopify services you may choose to use. In that case, Shopify will process your data in accordance with its own privacy policy and consumer protection policy.

    Marketing and advertising. We may use your personal data for marketing and advertising purposes, for example to send marketing, adverts and promotional communications by email, SMS, or post, and to show you adverts for products or services. This may include using your personal data to better tailor the services and advertising on our website and other websites. If you are a resident of the UK/EEA, the legal basis for this processing of personal data is our legitimate interest in selling our products, pursuant to Article 6(1)(f) GDPR/UK GDPR.

    Security and fraud prevention. We use your personal data to identify, investigate or take action regarding potentially fraudulent, illegal or harmful activity. If you choose to use the services and register an account, you are responsible for keeping your account credentials safe. We strongly recommend that you do not share your username, password, or other access details with anyone else. If you believe your account has been compromised, please contact us immediately. If you are a resident of the UK/EEA, the legal basis for this processing of personal data is our legitimate interest in keeping our website secure for you and other customers, pursuant to Article 6(1)(f) GDPR/UK GDPR.

    Communicating with you and improving the service. We use your personal data to provide you with customer support and to improve our services. This is a legitimate interest of ours, allowing us to be responsive to you, provide you with effective services, and maintain our business relationship with you, pursuant to Article 6(1)(f) GDPR/UK GDPR.

    Cookies

    Like many other websites, we use cookies on our site. For more information about the cookies we use to run our store on Shopify, visit https://www.shopify.com/legal/cookies. We use cookies to operate and improve our website and services (including to remember information about your activity and preferences), to conduct analytics, and to better understand how users interact with the services (which relates to our legitimate interest in administering, improving, and optimising the services). We may also allow third parties and service providers to use cookies on our website to better tailor the services, products, and advertising on our website and other websites.

    Most browsers automatically accept cookies by default, but you can change your browser settings to remove or reject cookies. Please note that your experience may be negatively affected if you remove or block cookies, and some services — including certain features and general functionality — may stop working, in whole or in part. It's also possible that blocking cookies will not entirely prevent our information sharing with third parties, such as our advertising partners.

    How we disclose personal data

    In certain circumstances, we may disclose your personal data to third parties in order to fulfil contracts, for legitimate purposes, and for other reasons covered by this privacy policy. Some examples of such circumstances include:

    • Data may be shared with vendors or other third parties who perform services on our behalf (e.g. IT management, payment processing, data analytics, customer support, cloud storage, distribution and delivery).
    • Data may be shared with business and marketing partners to provide services and advertising to you. Our business and marketing partners will use your data in accordance with their own privacy notices.
    • Where you request or otherwise consent to us disclosing certain data to third parties, for example to deliver products to you, or when you use social media widgets or login-based integrations, we may also share your data.
    • Data may be shared with our affiliates or within our corporate group as part of our legitimate interest in running a successful business.
    • Data may be shared in connection with a business transaction, such as a merger or bankruptcy, in order to comply with applicable legal obligations (for example, in response to court orders or search warrants), enforce applicable terms of service, and protect and enforce the services, our rights, and the rights of our users and other persons.

    We disclose personal data from the following categories, and sensitive information about users, for the purposes described above in "How we collect and use personal data" and "How we disclose personal data":

    Category Categories of recipients
    Identifiers such as basic contact information and certain order and account information Vendors and third parties performing services on our behalf (e.g. internet service providers, payment processors, distribution partners, customer support partners, and data analytics providers)
    Commercial information such as order, shopping and customer support information Business and marketing partners
    Internet or other similar network activity, e.g. Usage Data Affiliate partners
    Geolocation data, e.g. locations determined via an IP address or other technical means

    We do not use or disclose sensitive personal data without your consent, or in order to draw inferences about you.

    With your consent, we share personal data for the purposes of carrying out advertising and marketing activities as described below.

    Third-party websites and links

    Our website may provide links to websites or other online platforms operated by third parties. If you follow links to websites not affiliated with or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee, and are not responsible for, the privacy or security of such websites, including the accuracy, completeness, or reliability of information found on them. Information you provide on public or semi-public venues, including information you share on third-party social media platforms, may also be viewed by other users of the services and/or users of those third-party platforms without limitation as to its use by us or by third parties. Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms, or of their owners or operators, except as expressly stated in the services.

    Children's data

    The services are not intended for use by children, and we do not knowingly collect personal data about children. If a child for whom you are responsible has provided us with their personal data, you may contact us using the contact details below to request that it be deleted.

    As of the effective date of this privacy policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined under applicable law) personal data of individuals under 16 years of age.

    Security and retention of your data

    Please note that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security." Any information you send to us may not be secure while in transit. We recommend that you do not use insecure channels to send us sensitive or confidential information.

    How long we retain your personal data depends on various factors, such as whether we need it to maintain your account, provide the services, comply with legal obligations, resolve disputes, or enforce other applicable contracts and policies.

    Your rights

    Depending on where you live, you may have some or all of the rights listed below in relation to your personal data. That said, these rights are not absolute and may only apply in certain circumstances, and in some cases, we may decline your request as permitted by law.

    • Right to access/know: You may have the right to request access to the personal data we hold about you, including details about how we use and share it.
    • Right to delete: You may have the right to request that we delete the personal data we hold about you.
    • Right to correct: You may have the right to request that we correct inaccurate personal data we hold about you.
    • Right to data portability: You may have the right, in certain circumstances and subject to certain exceptions, to receive a copy of the personal data we hold about you and to request that we transfer it to a third party.
    • Right to opt out of sale, sharing, or targeted advertising: You may have the right to instruct us not to "sell" or "share" your personal data, or to state that your personal data must not be used for purposes considered "targeted advertising," as defined under applicable privacy laws. If you visit our website with the GPC (Global Privacy Control) signal enabled (depending on your location), we will automatically treat this as a request to opt out of "selling" or "sharing" data for the device and browser you use to access the website.
    • Right to restrict processing: You may have the right to request that we stop processing your personal data, or restrict our processing of it.
    • Right to withdraw consent: Where we rely on consent to process your personal data, you may have the right to withdraw that consent.
    • Right to appeal: If we decline your request, you may have the right to appeal our decision. You can do this by replying directly to our denial notice.
    • Managing communication preferences: We may send you marketing emails, and you may opt out at any time by using the unsubscribe link included in every message we send you. If you opt out, we may still send you non-promotional communications, such as those about your account or your orders.

    You can exercise these rights where indicated on our website, or by contacting us using the contact details below.

    Your status with us will not be affected by exercising any of your rights. We may need to collect information from you to verify your identity, such as your email address or account details, before providing a substantive response to your request. Under applicable law, you may designate an authorised agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require proof that you have authorised them to act on your behalf, and we may also need you to independently verify your identity with us directly. We will respond to your request within the time period required by applicable law.

    Complaints

    If you have complaints about how we process your personal data, please contact us using the contact details below. If you are not satisfied with how we've addressed your complaint, you may — depending on where you live — have the right to appeal our decision by contacting us using the contact details below. You may also lodge your complaint with the relevant supervisory authority. UK-based users can contact the Information Commissioner's Office (ICO) at ico.org.uk. Users within the EEA can find a list of responsible data protection authorities here.

    International users

    Please note that we may transfer, store, and process your personal data outside of the country in which you reside. Your personal data is also processed by staff and third-party service providers and partners in these countries.

    Where we transfer your personal data out of the UK or Europe, we rely on recognised transfer mechanisms, such as the European Commission's Standard Contractual Clauses, the UK's International Data Transfer Agreement (IDTA), or equivalent arrangements from the relevant competent authority (as applicable), unless the data transfer is to a country that has been assessed as providing an adequate level of protection.

    Contact

    If you have questions about our privacy practices or this privacy policy, or if you would like to exercise any of your rights, please call or email us at support@ergosteg.uk, or you can contact us at [insert company registered address].

    For the purposes of applicable data protection legislation, and unless otherwise expressly stated, we are the data controller of your personal data.