1. Who is responsible for your data
The controller is Expensive Chiodo Ltd, a company registered in England and Wales (company number 16882749), with its registered office at 82a James Carter Road, Mildenhall, United Kingdom, IP28 7DE. For any privacy question, write to info@expensivechiodo.com.
We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation.
2. What we collect
- When you contact us: your name, company, email address, phone number if you give it, and the content of your message.
- When you place an order: name, company, email address, phone number, billing address, VAT or company number if you give it, the packages ordered and any notes you add.
- When you pay by card (once card payment is active): the payment is processed by our payment provider. We receive confirmation of the payment and limited details such as the card type and the last digits; we never receive or store your full card number.
- When we deliver a service: information in your systems that we access on your behalf. For that data we act as your processor, under your instructions.
- When you browse: our hosting provider records standard technical data — IP address, browser type and the pages requested — to keep the website secure and working.
- On your device: your cart, saved packages, recently viewed packages, theme and consent choices are stored in your browser’s local storage. They are not sent to us unless you submit an order.
3. Why we use it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Answering enquiries and preparing proposals | Steps at your request before a contract; our legitimate interest in replying to business enquiries |
| Processing orders and delivering services | Performance of a contract |
| Invoicing, accounting and tax records | Legal obligation |
| Keeping the website and our systems secure | Legitimate interest |
| Analytics or marketing cookies, if we ever use them | Your consent, which you can withdraw at any time |
We do not send marketing emails unless you ask to receive them, we do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
4. Who we share it with
We share personal data only with service providers who help us run our business, acting on our instructions under contract:
- Website hosting: Vercel Inc..
- Transactional email delivery, used to send messages from the website forms and order confirmations.
- Card payment processing, once card payment is active on this website.
- Professional advisers such as accountants, where necessary.
We may also disclose data where the law requires it or to protect our legal rights.
5. International transfers
Some of our providers are based outside the UK and the European Economic Area, notably in the United States. When personal data is transferred, we rely on adequacy regulations or decisions — including the UK Extension to the EU–US Data Privacy Framework and the EU–US Data Privacy Framework, where the recipient is certified — or on standard contractual clauses together with the UK International Data Transfer Addendum.
6. How long we keep it
- Enquiries that do not lead to an order: deleted within 24 months.
- Orders, invoices and related correspondence: six years after the end of the financial year they relate to, as required by UK tax rules.
- Data we process inside your systems as part of a service: for the duration of the service, then returned or deleted as agreed.
- Server logs: for the short period set by our hosting provider for security purposes.
7. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent at any time where we rely on consent. To exercise a right, write to info@expensivechiodo.com; we reply within one month.
You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or, if you live in the EU, to the data protection authority of your country.
8. Security
We use appropriate technical and organisational measures to protect personal data, including encrypted connections, access limited to people who need it and multi-factor authentication on our accounts. No transmission over the internet is completely secure, but we work to keep the risk low.
9. Children
Our services are intended for businesses and are not directed at children.
10. Changes to this policy
If this policy changes, we publish the new version on this page with a new date.