Privacy Policy

Who we are

Regton Limited (“Regton”, “we”, “us” or “our”) is the controller responsible for personal information described in this policy unless another organisation is identified as acting independently.

We handle personal information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and, where applicable, the Privacy and Electronic Communications Regulations.

Information we collect and where it comes from

We collect this information when you browse the website, create an account, place or finance an order, contact us, subscribe, enter a promotion, leave a review, use chat/search features, interact with advertising or purchase through a marketplace that sends the order to Regton.

Information needed for an order: contact, delivery and payment-related information is required to enter into and perform the sales contract. Without it, we may be unable to take payment, provide finance, deliver the order or respond to a warranty claim.

How we use information and our lawful bases

Where we rely on legitimate interests, those interests include operating and securing the store, preventing fraud and misuse, improving services, managing relationships and protecting or defending legal rights. We balance those interests against the rights and expectations of the people concerned.

Where we rely on consent, you may withdraw it at any time without affecting processing that occurred before withdrawal.

Marketing communications

We send newsletters and promotional email to people who have actively subscribed. You can withdraw consent through the unsubscribe link in every promotional email or by contacting sales@regton.com.

Where the PECR “soft opt-in” applies, we may also email people who have bought from us or who have actively engaged with us in negotiations about buying a product or service, about Regton products or services that are similar to those they bought or considered. We only rely on this exception where we obtained the contact details directly, offered a clear and simple opt-out when collecting them, and include a free and simple opt-out in every subsequent message. This may include reminders about an unfinished basket where the PECR soft opt in requirements are met. We use legitimate interests as the data-protection lawful basis for this limited processing.

Customers who place an order without subscribing receive service communications needed for that order, such as confirmation, dispatch, delivery, payment, finance, warranty or recall information. A requested back-in-stock alert is sent to provide the alert requested. We may also invite customers to give genuine feedback about a purchase; if a message includes promotional content, we treat it as marketing and apply the relevant marketing rules.

We retain a minimal suppression record after an unsubscribe or opt-out where necessary to make sure the address is not added back to marketing unintentionally.

Google and Meta advertising

Google Ads

With Marketing consent, we use Google Ads conversion tracking and Enhanced Conversions to measure whether advertising leads to a purchase and to improve campaign measurement. For a completed conversion, limited first-party information such as email address, name and phone number may be normalised and converted into a secure SHA-256 hashed value before it is used by Google to match the conversion with a signed-in Google account. Hashed information remains personal data.

We do not currently upload Customer Match lists. If this changes, we will update this policy and the relevant consent information before beginning that processing.

Meta advertising

With Marketing consent, we use Meta Pixel and Meta Conversions API to send events such as PageView, ViewContent, Search, AddToCart, InitiateCheckout and Purchase for advertising measurement on Facebook and Instagram. Matching information may include hashed contact details and technical or advertising identifiers such as IP address, user agent, external ID, fbp and fbc.

These events are used to create Website Custom Audiences and Lookalike Audiences for advertising purposes.We do not currently upload separate customer-list audience files to Meta. Withdrawing Marketing consent stops future consent-dependent website events from being sent from Regton, but it does not automatically remove information already lawfully received and retained by Meta under its own terms.

Depending on the service and purpose, Google or Meta may act as our processor, a joint controller with Regton, or an independent controller. Their own privacy information and account controls also apply. You can withdraw Marketing consent through Cookie Settings and manage advertising personalisation in your Google, Facebook and Instagram accounts.

Cookies and similar technologies

We use cookies, local storage, session storage, pixels and related technologies to secure and operate the store, remember choices, provide optional features, measure use and support advertising.

Strictly necessary technologies are used where they are required to provide a requested service, secure the website, process a payment or record privacy choices. Functional, Analytics and Marketing technologies remain off until you positively choose the relevant category.

Payments, finance, fraud checks and automated decisions

Checkout may offer Stripe/card processing, PayPal and PayPal Pay Later, Amazon Pay, Google Pay, Apple Pay and Omni Finance. Stripe may dynamically present eligible methods such as Klarna or Revolut Pay depending on the device, browser, transaction, customer eligibility and current checkout configuration.

Payment and finance providers receive information needed to authenticate, authorise, fund and settle a transaction, meet legal requirements and prevent fraud. Stripe Radar evaluates transactions using automated risk models and rules. Issuing banks and other payment providers may also make their own automated authorisation or fraud prevention decisions and may return a generic decline without giving Regton the underlying reason. Finance providers may carry out automated identity, affordability, credit and fraud assessments under their own privacy notices.

Regton also applies fraud prevention rules to order, payment, address, device, location and risk information. Depending on the result, a transaction may be allowed, referred for further checks or automatically stopped. The consequence may be that the selected payment method or order cannot proceed, although another payment method may remain available.

Where we use solely automated processing to make a decision that has a legal or similarly significant effect on you, we apply the safeguards required by applicable data protection law. This may involve using information such as order, payment, address, device and risk indicators to assess whether a transaction presents a security or fraud risk. Depending on the circumstances, we may provide information about the decision and the processing involved, explain the significance and likely consequences, allow you to make representations or challenge the outcome, and provide human intervention or review where required.

A request for human review does not guarantee that the original outcome will be changed. A reviewer will consider the information available and may confirm or change the decision. Where a decision is made independently by a bank, payment provider or finance provider, that organisation is responsible for its own decision and its applicable privacy information and procedures will apply.

Who we share information with

We do not sell personal information. We disclose only what is reasonably necessary for the relevant service, legal requirement or stated purpose.

Depending on the activity, a recipient may be our processor, an independent controller or a joint controller. Independent controllers determine parts of their processing themselves and provide their own privacy information.

International transfers

Some providers and their sub-processors, including Google, Meta, Klaviyo, Stripe, ShipStation/Auctane, Cloudflare, Doofinder, Tidio and REVIEWS.io, operate internationally. Information may therefore be processed outside the United Kingdom, including in the European Economic Area and the United States.

Depending on the recipient and destination, a transfer is protected by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the relevant US recipient has an active certification covering the transfer, or by contractual safeguards such as the UK International Data Transfer Agreement or the European Commission Standard Contractual Clauses together with the UK Addendum. Where required, transfer risks and supplementary protections are assessed.

You may contact us for more information about the safeguards relevant to your information. The recipient's own privacy notice may also explain its processing locations and transfer mechanisms.

How long we keep information

We keep personal information only for as long as needed for the stated purpose, legal, tax and accounting requirements, security, dispute resolution and the establishment or defence of legal claims.

Specific records may be kept for a shorter or longer period where justified by their purpose, an objection, legal hold, regulatory request or technical backup cycle.

How we protect information

We use proportionate technical and organisational measures including HTTPS encryption, access controls, account and password protections, trusted payment services, staff confidentiality and training, software maintenance, monitoring and backup controls.

No internet transmission or storage method is completely secure, but we regularly assess and improve safeguards appropriate to the information and risks involved.

Your data protection rights

Depending on the circumstances, you may have the right to:

• request access to personal information and a copy of it;
• ask us to correct inaccurate or incomplete information;
• request erasure or restriction of processing;
• receive certain information in a portable format;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time where we rely on consent;
• request information about the safeguards we use for international transfers of your personal information; and
• where applicable, receive information about significant decisions made using solely automated processing, make representations or challenge the decision, and request human intervention or review where required by law.

Some rights are subject to legal conditions and exemptions. In particular, rights relating to automated decision making depend on the nature of the decision, the information involved and the circumstances in which the decision is made.

Where we process information on the basis of consent, withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We may ask for information to verify your identity before responding to a request. To exercise a right, email sales@regton.com.

Questions and complaints

Please contact us first if you are concerned about how we use personal information so that we can investigate and try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection supervisory authority. Visit ico.org.uk/make-a-complaint or telephone 0303 123 1113.

Children, third-party websites and policy changes

Children

Our retail website is not directed at children under 16 and we do not knowingly seek personal information from them. Contact us if you believe a child has provided information so we can assess and delete it where appropriate.

Third-party websites

Links to another website or service are governed by that organisation's privacy information. Regton is not responsible for an external site's independent processing or content.

Changes to this policy

We update this policy when our services, providers, processing or legal requirements change. The date at the top identifies the latest version. Material changes may also be communicated through the website or another appropriate channel.