Privacy policy

Who is responsible for your information

Sartura Research is the trading name of the business owner identified in section 1 of our Terms and Conditions. That owner is responsible for the personal information described in this policy and acts as its data controller, except where a service provider acts as a separate controller for its own purposes.

Our business address is 15 Admirals Yard, Keel Drive, Slough, SL1 2YA.

For privacy questions, requests or complaints, email admin@sarturaresearch.com or write to the address above. This policy explains how we use information when you browse sarturaresearch.com, contact us, place an order or interact with our services.

Information we collect and where it comes from

Information you provide may include your name, email
address, telephone number, billing and delivery addresses, account information,
order details, correspondence and the research-use and terms declarations you
make. Where proportionate to reviewing an order, we may ask for your
organisation, role or a brief description of the proposed research purpose.

We receive order and payment-status information through
Shopify and the payment services used at checkout. Payment providers process
card or other payment credentials under their own security arrangements. We do
not ask you to send full card details to us by email or through the contact
form.

When you use the site, Shopify and enabled service providers
may collect technical information such as an IP address, device and browser
information, pages visited, session information and security events. Cookies
and similar technologies are described in our Cookie Policy and cookie
preferences.

We may receive delivery updates from the carrier and
transaction, dispute or fraud-related information from payment and platform
providers. If another person places an order for you or supplies your business
contact details, we receive the information they give us for that purpose.

The entrance declaration asks you to confirm that you meet
our age policy. It does not routinely require your date of birth or an
identity-document upload. Please do not send patient data, medical records or
other sensitive information in a research enquiry.

Why we use information and our lawful bases

To process an order, take payment, deliver goods, provide
account functions and deal with contractual enquiries, we use the information
needed to take steps at your request before a contract or to perform our
contract with you.

When you act for an organisation rather than buying
personally, we use your business contact details in our legitimate interests in
administering that relationship and communicating with authorised contacts.

We use research-use declarations and proportionate
order-review information in our legitimate interests in checking proposed use,
administering our supply restrictions and documenting decisions. We consider
the impact on individuals and limit the information collected to what is
relevant. Where a particular legal obligation requires processing, we rely on
that obligation instead.

We use appropriate technical, order and correspondence
records in our legitimate interests in protecting the website, preventing fraud
and misuse, resolving disputes and establishing or defending legal claims. We
also use information to comply with applicable accounting, tax and other legal
duties.

We use contact-form information to answer your enquiry. This
is on the basis of pre-contract steps where your enquiry concerns a proposed
contract with you, or our legitimate interests in responding to other
correspondence. Legal obligations may apply to rights requests and data
protection complaints.

Where we offer optional email marketing, we use your consent
under our chosen marketing approach. You can unsubscribe through the message or
contact us. We may retain a minimal suppression record to respect an opt-out.
Order and service communications are not dependent on marketing consent.

Under our chosen cookie approach, optional analytics and
advertising technologies are enabled only with your consent, where offered.
Necessary technologies are used to provide functions you request and keep the
service secure, subject to the applicable rules. See our Cookie Policy for
details and controls.

Who receives information

We share information only as appropriate to the service or
purpose concerned. Recipients can include Shopify for hosting and commerce
functions; the payment provider selected at checkout; Royal Mail and relevant
delivery partners for fulfilment; providers of email, support, security,
analytics or advertising functions that we enable; and professional advisers
such as accountants and legal advisers.

We may disclose information where lawfully required to
regulators, law enforcement or courts, or where necessary to establish,
exercise or defend legal rights. If the business is transferred, relevant
information may be shared with advisers and a prospective or actual successor
subject to suitable safeguards and the applicable law.

Our service providers act under appropriate arrangements for
their role. Some, including payment providers, may act as separate controllers
for purposes such as their own fraud prevention and legal obligations. Their
notices explain those activities.

Shopify and connected services

Our store is hosted on Shopify. Shopify processes
information to provide and protect its commerce services. Its consumer privacy
information is available at https://www.shopify.com/legal/privacy/consumers and
its privacy portal at https://privacy.shopify.com/.

We use Shopify features that draw on interactions with our
store, other merchants and Shopify to provide enhanced services. For these
features, Shopify may process personal information as a separate controller,
including for service improvement, personalisation or advertising as described
in its consumer privacy policy. Relevant choices and rights can be exercised
through our cookie controls where applicable and Shopify's privacy portal.

International transfers

Although we deliver only within the UK, technology providers
may process personal information outside the UK. Where a restricted transfer
occurs, we use an applicable lawful transfer mechanism, such as UK adequacy
regulations or appropriate contractual safeguards with any required additional
protections. These may include the UK International Data Transfer Agreement or
UK Addendum to relevant standard contractual clauses.

Contact us for information about safeguards relevant to your
information and how to obtain a copy where available. Provider locations and
safeguards must be assessed separately from our shipping area.

How long we keep information

We keep information for no longer than reasonably necessary
for the stated purpose, taking account of applicable legal requirements. Order,
payment, tax and accounting records are retained for the periods required by
law. Related contract and declaration records may also be kept for applicable
claim or dispute periods where necessary and proportionate.

Enquiries and support correspondence are kept long enough to
resolve the matter and manage related issues. Security information is retained
according to the incident, risk and operational need. Consent and preference
records are kept as needed to evidence and respect your choices. Cookie
lifetimes are shown in the cookie information made available through our
preferences tool.

At the end of the relevant period, information is deleted or
anonymised unless a lawful reason requires continued retention. You can ask us
about the period or criteria that apply to a particular record.

Your rights

Depending on the circumstances and applicable law, you may
have rights to access your information, correct inaccuracies, request deletion,
restrict processing and receive or transfer certain information in a portable
format. Where processing is based on consent, you can withdraw it at any time
without affecting the lawfulness of earlier processing.

Your right to object

You can object at any time to use of your information for
direct marketing. You can also object, on grounds relating to your particular
situation, to processing based on legitimate interests. We will consider the
request under the applicable legal rules.

Requests and order decisions

Contact admin@sarturaresearch.com to exercise a right. We
may ask for proportionate information to confirm identity or clarify a request.
We normally respond within one month; lawful extensions or other permitted
adjustments may apply, and we will explain them where required. Rights are not
absolute and may be subject to legal exceptions.

We may use platform or payment-provider fraud signals when
reviewing orders. You may contact us to request human review of an order
decision made by us. Payment providers may make their own decisions under their
own policies.

Security

We use appropriate technical and organisational measures for
the information we handle and restrict access according to business need. No
internet service can guarantee absolute security. Please protect your account
credentials and contact us if you believe your account has been misused.

Children

Our catalogue and products are intended for people aged 21
or over under our store policy. If you believe a child has provided personal
information to us, contact us so we can assess and address it appropriately.

Complaints

You can make a data protection complaint by emailing
admin@sarturaresearch.com, using the Contact page or writing to our business
address. Tell us what happened and the outcome you seek; you do not have to use
a particular form.

We will acknowledge a data protection complaint within 30
days of receiving it, make appropriate enquiries, keep you informed and
communicate the outcome without undue delay.

You also have the right to complain to the Information
Commissioner's Office. Visit https://ico.org.uk/make-a-complaint/ or call 0303
123 1113.

Changes to this policy

We may update this policy when our practices or legal
requirements change. The date above identifies the latest version. We will
provide further notice of material changes where appropriate or required.