1. Who we are

SPICA is a trading name of [[LEGAL COMPANY NAME]], a company registered in [[JURISDICTION]] under company number [[COMPANY NUMBER]], with registered office at [[REGISTERED OFFICE ADDRESS]] (“SPICA”, “we”, “us” or “our”).

For the purposes of the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, we are the controller of the personal data described in this policy, except where we expressly state otherwise.

Privacy enquiries may be sent to [[PRIVACY EMAIL]]. Our ICO registration number, where registration is required, is [[ICO REGISTRATION NUMBER]].

2. Personal data we collect

Depending on how you interact with us, we may collect:

• Identity and business data: name, job title, employer, department, professional role, account username, customer or supplier number, VAT number and business verification information.
• Contact data: billing, delivery and registered addresses, email address, telephone number and communication preferences.
• Order and transaction data: products, quotations, purchase orders, invoices, delivery records, returns, warranty claims and payment status. Payment card details are normally processed by our payment providers and are not stored by us in full.
• Technical and usage data: IP address, device and browser data, cookie identifiers, pages viewed, searches, referral source and interactions with our website and emails.
• Communications and support data: enquiries, call or email content, technical-support records, product application information, protocols and complaint history.
• Marketing and relationship data: newsletter preferences, event attendance, campaign responses and information obtained from professional events, distributors, referrals, your organisation's website or other lawful public business sources.
• Compliance and security data: sanctions or export-control checks, fraud indicators, access logs and information required to establish, exercise or defend legal claims.

Scientific and clinical information

Our website and ordinary support channels are not intended for patient records, donor information, clinical trial subject data or other identifiable health or special-category data. Please do not send us identifiable patient, donor or research-participant data. If technical support requires sensitive information, contact us first so that an appropriate and secure process can be agreed.

Where providing particular information is mandatory, we will make this clear. If you do not provide information needed to process an order, comply with law or perform a contract, we may be unable to supply the relevant products or services.

3. How and why we use personal data

Where we rely on legitimate interests, we consider whether our use is necessary and balanced against your rights and reasonable expectations. You may object to processing based on legitimate interests as described below.

4. Where personal data comes from

We collect data directly from you, your employer or colleagues, website and account activity, our payment and delivery partners, distributors and authorised representatives, fraud-prevention providers, professional events, referrals and lawful public sources. If we obtain personal data from another source, we provide privacy information within the period required by law unless an exemption applies.

5. Who we share personal data with

We disclose only the data reasonably required for the relevant purpose. Recipients may include:

• Shopify and ecommerce service providers that host and operate our online store;
• payment processors, banks and fraud-prevention providers;
• couriers, freight forwarders, customs agents, warehouses and fulfilment providers;
• manufacturing, distribution and service partners where necessary to fulfil an order, provide technical support, trace a lot or serial number, or handle a warranty or safety matter;
• IT, cloud, communications, analytics, advertising and professional service providers;
• auditors, insurers, lawyers, accountants, regulators, courts, law-enforcement bodies and tax or customs authorities; and
• a buyer, investor or adviser in connection with a proposed or completed sale, financing or reorganisation of our business, subject to appropriate confidentiality safeguards.

Service providers acting for us may process personal data only for agreed purposes and under appropriate contractual and security obligations. Some providers, such as payment services, may also act as independent controllers under their own privacy notices.

6. International transfers

Our suppliers and service providers, including Shopify, may process personal data outside the United Kingdom. Where a restricted transfer is made, we use a lawful transfer mechanism appropriate to the circumstances, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by law. We also apply supplementary measures where required. Contact us if you would like further information about the safeguards relevant to your data.

7. How long we keep personal data

We retain personal data only for as long as reasonably necessary for the purposes described above, including legal, tax, accounting, product-traceability, warranty and dispute requirements. Our usual criteria are:

• customer, contract, invoice and order records: generally six years after the end of the relevant relationship or transaction, subject to longer product-safety or legal requirements;
• technical-support, quality, complaint and warranty records: for the product's supported life and any additional period needed for claims, safety and traceability;
• unsuccessful enquiries or quotations: normally up to 24 months unless a longer period is justified;
• marketing data: until you opt out or the data is no longer current, with minimal suppression information retained to honour an opt-out; and
• cookie and analytics data: according to the lifespan shown in our consent tool or cookie information.

We may retain information for longer where a dispute, investigation, recall, legal hold or regulatory requirement applies. We securely delete or anonymise data when it is no longer required.

8. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss, disclosure or destruction. These measures include access controls, supplier due diligence, secure transmission where appropriate, backups and incident procedures. No internet transmission or storage system is completely secure, so we cannot guarantee absolute security.

You are responsible for keeping account credentials confidential and for notifying us promptly if you suspect unauthorised access.

9. Marketing communications

We may send professional contacts relevant information about SPICA products, applications, events and services where permitted by law. You can unsubscribe at any time by using the link in an email or contacting [[PRIVACY EMAIL]]. An opt-out from marketing does not prevent service messages about orders, safety, recalls, accounts or contracts.

10. Cookies and similar technologies

Our website uses strictly necessary technologies required for security, basket, checkout and account functions. With your permission where required, we may also use analytics, preference and advertising technologies. You can accept, reject or change optional-cookie choices through our cookie banner or privacy preferences tool. Browser controls may also block cookies, but blocking necessary cookies may prevent parts of the store from working.

Third-party services may set their own cookies and process data under their privacy notices. The cookie information displayed through our consent tool forms part of this policy and should be reviewed whenever store apps or tracking technologies change.

11. Your data protection rights

Depending on the circumstances, you may have the right to:

• request access to your personal data and a copy of it;
• ask us to correct inaccurate or incomplete data;
• ask us to erase data or restrict its use;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time, without affecting processing already carried out; and
• ask for human review where a decision with legal or similarly significant effect is made solely by automated means. We do not ordinarily make such decisions.

These rights are subject to legal conditions and exemptions. We may ask for information needed to verify identity and authority. We do not ordinarily charge a fee, but the law permits a reasonable fee or refusal in limited cases.

You may complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the opportunity to address your concern first.

12. Children

Our website and products are intended for professional and laboratory audiences and are not directed to children. You must be at least 18 years old and authorised to place an order. If you believe a child has provided personal data to us, please contact us.

13. Other websites and policy changes

Links to third-party websites are provided for convenience. We do not control their privacy practices and encourage you to review their notices. We may update this policy when our processing, providers or legal obligations change. The current version and “last updated” date will be published on this page. Material changes will be highlighted where appropriate.

14. Contact us