Spectrum ("we", "us") is the data controller for personal information collected through this website. This policy explains what we collect, why, how long we keep it, and the rights you have under UK GDPR and the Data Protection Act 2018. This page is maintained by the Spectrum team; please confirm the company legal entity, registered address and Data Protection contact details before publishing.
1. What we collect
- Account & order data — name, delivery and billing address, email, phone, order history.
- Payment data — processed directly by our payment provider; we never see or store full card numbers.
- Marketing preferences — email subscription status and engagement.
- Technical data — IP address, device and browser type, pages visited, referrer.
- Support correspondence — messages you send us and our replies.
2. Why we use it (lawful bases)
- Contract — to process orders, deliver products, handle returns and provide customer support.
- Legal obligation — to keep tax, accounting and consumer-rights records.
- Legitimate interests — to secure the site, prevent fraud, and improve our products.
- Consent — for marketing emails and non-essential cookies. You can withdraw consent at any time.
3. Who we share it with
We share the minimum data necessary with vetted processors acting on our instructions: our e-commerce platform, payment processor, shipping carrier, email service provider, and analytics provider. We do not sell your personal data. A current list of sub-processors is available on request.
4. International transfers
Some processors may be located outside the UK. Where they are, we rely on UK adequacy regulations or the UK International Data Transfer Addendum to ensure equivalent protection.
5. How long we keep it
- Order records: 6 years (HMRC requirement).
- Marketing data: until you unsubscribe, then removed within 30 days.
- Support tickets: 3 years from last contact.
- Analytics: aggregated and anonymised after 14 months.
6. Your rights
You can request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. Email privacy@spectrum.example and we'll respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk).
7. Security
Traffic to this site is encrypted in transit (HTTPS/TLS). Payments are handled by a PCI-DSS compliant provider. Access to customer data inside our team is limited to those who need it. See our Security page for more.
8. Changes
We'll post material changes on this page and, where appropriate, notify you by email.
9. Contact
Spectrum — privacy@spectrum.example. Registered office, company number and VAT number to be confirmed before publish.