Privacy policy

Last updated:08-OCT-26

Who is responsible for your information

Sartura Research is the trading name of the business owner identified in section 1 of our Terms and Conditions. That owner is responsible for the personal information described in this policy and acts as its data controller, except where a service provider acts as a separate controller for its own purposes.

Our business address is 15 Admirals Yard, Keel Drive, Slough, SL1 2YA.

For privacy questions, requests or complaints, email admin@sarturaresearch.com or write to the address above. This policy explains how we use information when you browse sarturaresearch.com, contact us, place an order or interact with our services.

Information we collect and where it comes from

Information you provide may include your name, email address, telephone number, billing and delivery addresses, account information, order details, correspondence and the research-use and terms declarations you make. Where proportionate to reviewing an order, we may ask for your organisation, role or a brief description of the proposed research purpose.

We receive order and payment-status information through Shopify and the payment services used at checkout. Payment providers process card or other payment credentials under their own security arrangements. We do not ask you to send full card details to us by email or through the contact form.

When you use the site, Shopify and enabled service providers may collect technical information such as an IP address, device and browser information, pages visited, session information and security events. Cookies and similar technologies are described in our Cookie Policy and cookie preferences.

We may receive delivery updates from the carrier and transaction, dispute or fraud-related information from payment and platform providers. If another person places an order for you or supplies your business contact details, we receive the information they give us for that purpose.

The entrance declaration asks you to confirm that you meet our age policy. It does not routinely require your date of birth or an identity-document upload. Please do not send patient data, medical records or other sensitive information in a research enquiry.

Why we use information and our lawful bases

To process an order, take payment, deliver goods, provide account functions and deal with contractual enquiries, we use the information needed to take steps at your request before a contract or to perform our contract with you.

When you act for an organisation rather than buying personally, we use your business contact details in our legitimate interests in administering that relationship and communicating with authorised contacts.

We use research-use declarations and proportionate order-review information in our legitimate interests in checking proposed use, administering our supply restrictions and documenting decisions. We consider the impact on individuals and limit the information collected to what is relevant. Where a particular legal obligation requires processing, we rely on that obligation instead.

We use appropriate technical, order and correspondence records in our legitimate interests in protecting the website, preventing fraud and misuse, resolving disputes and establishing or defending legal claims. We also use information to comply with applicable accounting, tax and other legal duties.

We use contact-form information to answer your enquiry. This is on the basis of pre-contract steps where your enquiry concerns a proposed contract with you, or our legitimate interests in responding to other correspondence. Legal obligations may apply to rights requests and data protection complaints.

Where we offer optional email marketing, we use your consent under our chosen marketing approach. You can unsubscribe through the message or contact us. We may retain a minimal suppression record to respect an opt-out. Order and service communications are not dependent on marketing consent.

Under our chosen cookie approach, optional analytics and advertising technologies are enabled only with your consent, where offered. Necessary technologies are used to provide functions you request and keep the service secure, subject to the applicable rules. See our Cookie Policy for details and controls.

Who receives information

We share information only as appropriate to the service or purpose concerned. Recipients can include Shopify for hosting and commerce functions; the payment provider selected at checkout; Royal Mail and relevant delivery partners for fulfilment; providers of email, support, security, analytics or advertising functions that we enable; and professional advisers such as accountants and legal advisers.

We may disclose information where lawfully required to regulators, law enforcement or courts, or where necessary to establish, exercise or defend legal rights. If the business is transferred, relevant information may be shared with advisers and a prospective or actual successor subject to suitable safeguards and the applicable law.

Our service providers act under appropriate arrangements for their role. Some, including payment providers, may act as separate controllers for purposes such as their own fraud prevention and legal obligations. Their notices explain those activities.

Shopify and connected services

Our store is hosted on Shopify. Shopify processes information to provide and protect its commerce services. Its consumer privacy information is available at Shopify Consumer Privacy Policy and its privacy portal is available at Shopify Privacy Portal .

International transfers

Although we deliver only within the UK, technology providers may process personal information outside the UK. Where a restricted transfer occurs, we use an applicable lawful transfer mechanism, such as UK adequacy regulations or appropriate contractual safeguards with any required additional protections. These may include the UK International Data Transfer Agreement or UK Addendum to relevant standard contractual clauses.

Contact us for information about safeguards relevant to your information and how to obtain a copy where available. Provider locations and safeguards must be assessed separately from our shipping area.

How long we keep information

We keep information for no longer than reasonably necessary for the stated purpose, taking account of applicable legal requirements. Order, payment, tax and accounting records are retained for the periods required by law. Related contract and declaration records may also be kept for applicable claim or dispute periods where necessary and proportionate.

Enquiries and support correspondence are kept long enough to resolve the matter and manage related issues. Security information is retained according to the incident, risk and operational need. Consent and preference records are kept as needed to evidence and respect your choices. Cookie lifetimes are shown in the cookie information made available through our preferences tool.

At the end of the relevant period, information is deleted or anonymised unless a lawful reason requires continued retention. You can ask us about the period or criteria that apply to a particular record.

Your rights

Depending on the circumstances and applicable law, you may have rights to access your information, correct inaccuracies, request deletion, restrict processing and receive or transfer certain information in a portable format. Where processing is based on consent, you can withdraw it at any time without affecting the lawfulness of earlier processing.

Your right to object

You can object at any time to use of your information for direct marketing. You can also object, on grounds relating to your particular situation, to processing based on legitimate interests. We will consider the request under the applicable legal rules.

Requests and order decisions

Contact admin@sarturaresearch.com to exercise a right. We may ask for proportionate information to confirm identity or clarify a request. We normally respond within one month; lawful extensions or other permitted adjustments may apply, and we will explain them where required. Rights are not absolute and may be subject to legal exceptions.

We may use platform or payment-provider fraud signals when reviewing orders. You may contact us to request human review of an order decision made by us. Payment providers may make their own decisions under their own policies.

Security

We use appropriate technical and organisational measures for the information we handle and restrict access according to business need. No internet service can guarantee absolute security. Please protect your account credentials and contact us if you believe your account has been misused.

Children

Our catalogue and products are intended for people aged 21 or over under our store policy. If you believe a child has provided personal information to us, contact us so we can assess and address it appropriately.

Complaints

You can make a data protection complaint by emailing admin@sarturaresearch.com, using the Contact page or writing to our business address. Tell us what happened and the outcome you seek; you do not have to use a particular form.

We will acknowledge a data protection complaint within 30 days of receiving it, make appropriate enquiries, keep you informed and communicate the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office. Visit Information Commissioner's Office or call 0303 123 1113.

Changes to this policy

We may update this policy when our practices or legal requirements change. The date above identifies the latest version. We will provide further notice of material changes where appropriate or required.