Privacy Policy

Controller: Archalign Limited (Companies House No. 14635926) · Data Protection contact: legal@archalign.co.uk · Registered office: 1000 Great West Road, c/o KM Accountancy Services, Brentford, London TW8 9DW, United Kingdom.

Effective: 12 May 2026 · Supersedes the version dated August 2025. Written to UK GDPR and EU GDPR standards because we serve consumers in both jurisdictions, and to the Data Protection Act 2018.

How we think about your data

Personal data is held in confidence. We collect only what is necessary to operate the relationship between Archalign and you, retain it only as long as needed, and never sell it. Where the standard differs between regulations, we apply the higher.

1. Scope

This Policy applies to personal data processed by Archalign Limited through our web properties archalign.store, archalign.ltd, and archalign.co.uk, and through the email aliases admin@, support@, shipping@, trade@, orders@, legal@, marketing@, and ai@archalign.co.uk. Suppliers, carriers, and processors operate under separate notices and contracts.

2. Personal data we collect

  • Voluntarily provided: name, billing and shipping address, telephone, email, order content, account password (hashed), trade-account documentation, complaint correspondence, marketing preferences.
  • Automatically collected: device type, browser type, IP address (truncated for analytics), pages viewed, referrer URL, basket state, session cookies, fraud signals from payment providers.
  • Special category data: we do not knowingly collect special category data (UK GDPR Article 9). If unsolicited special data arrives via correspondence we redact and delete.

3. Lawful bases (UK GDPR Article 6)

  • Article 6(1)(b) — Contract: order processing, delivery, customer care, returns.
  • Article 6(1)(f) — Legitimate interest: fraud prevention, security, service improvement, business continuity. Balancing test on file.
  • Article 6(1)(a) — Consent: marketing emails; non-essential cookies. Granular, freely-given, withdrawable.
  • Article 6(1)(c) — Legal obligation: accounting (6 years HMRC), AML where engaged, lawful response to court orders.

4. Sources of data

Direct from you (account, order, correspondence); from payment processors (transaction tokens, AVS/CVV results, never full card numbers); from carriers (delivery confirmation, customs records); from analytics tools after consent.

5. How we use your data

To accept and process orders; deliver them; handle returns and refunds; respond to customer-care requests; honour trade-account commitments; send transactional communications (order confirmations, dispatch notices, returns, customs); send marketing if you opted in; comply with tax and consumer law; investigate suspected fraud; defend legal claims; improve our service through aggregated, anonymised analysis.

6. Recipients and processors

  • Shopify Inc. / Shopify International Ltd — store hosting, checkout, customer accounts, hosted email automations.
  • Payment processors: Shopify Payments, Stripe, PayPal (PCI-DSS v4.0). We do not store full card numbers.
  • Carriers: Royal Mail, DHL Express, DPD, FedEx, Evri, regional last-mile partners as required. Address and order reference only.
  • Customs brokers / fiscal agents for DDP shipments to GCC, Iraq, EU, US/Canada.
  • Email infrastructure: Google Workspace (admin@archalign.co.uk and aliases) — UK + EU data residency where supported.
  • Analytics (with consent): Google Analytics 4 with consent mode and IP-anonymisation; Shopify native analytics; Judge.me reviews.
  • Professional advisors (accountants, legal, insurers) bound by confidentiality.
  • Public authorities where compelled by law.

7. International transfers

We may transfer your data outside the UK/EEA to suppliers that operate globally. Transfers are protected by: UK adequacy decisions where available; the EU–US Data Privacy Framework where applicable; or Standard Contractual Clauses with UK addendum where neither applies. Detail available on request to legal@archalign.co.uk.

8. Retention

  • Order and accounting records: 6 years from the end of the relevant tax year (Companies Act 2006, HMRC).
  • Account: for as long as your account remains active, then 12 months dormancy plus 30-day deletion notice.
  • Marketing list: until you withdraw consent, plus suppression record to prevent re-mailing.
  • Server logs: 90 days for security; aggregated metrics may be retained indefinitely in anonymised form.
  • Trade-account documentation: for the life of the trading relationship plus 6 years.

9. Your rights (UK GDPR Articles 12–22)

  • Right of access (a copy of your personal data we hold).
  • Right to rectification of inaccurate data.
  • Right to erasure (“right to be forgotten”) subject to legal retention obligations.
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object to processing based on legitimate interest.
  • Right to withdraw consent at any time.
  • Right to lodge a complaint with the Information Commissioner’s Office (ico.org.uk) or your national EU supervisory authority.

To exercise any right, email legal@archalign.co.uk. We respond within one calendar month (UK GDPR Article 12(3)).

10. Cookies and tracking

Governed in detail by our Cookie Policy. We seek consent under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) before placing non-essential cookies.

11. Marketing

We email you marketing only after opt-in consent. Withdraw consent in one click via the unsubscribe link in any marketing email, or by emailing legal@archalign.co.uk. Transactional emails (order, dispatch, customer care) are not marketing and are sent regardless of marketing consent.

12. Children

Our web properties are not directed at children under 16. We do not knowingly process the personal data of children under 16. If you believe we hold such data, contact legal@archalign.co.uk and we will delete it.

13. Security

Industry-standard technical and organisational measures: HTTPS/TLS in transit; encryption at rest where supported; two-factor authentication on administrative accounts; least-privilege access; supplier contracts with binding data-protection terms. Personal data breaches are reported to the ICO within 72 hours where the threshold is met (UK GDPR Article 33).

14. Changes to this Policy

We revise this Policy as our practices evolve. The effective date at the top reflects the current version. Material changes are communicated by email to account-holders and by a notice on our web properties for at least 14 days. Earlier versions are available on request.

15. Contact

Data Protection: legal@archalign.co.uk · Order & customer care: support@archalign.co.uk · WhatsApp +44 7478 628063 · Postal: Archalign Limited, 1000 Great West Road, c/o KM Accountancy Services, Brentford, London TW8 9DW, United Kingdom.

Archalign Limited. Registered in England and Wales. Company No. 14635926.

Privacy Policy

Controller: Archalign Limited (Companies House No. 14635926) · Data Protection contact: legal@archalign.co.uk · Registered office: 1000 Great West Road, c/o KM Accountancy Services, Brentford, London TW8 9DW, United Kingdom.

Effective: 12 May 2026 · Supersedes the version dated August 2025. Written to UK GDPR and EU GDPR standards because we serve consumers in both jurisdictions, and to the Data Protection Act 2018.

How we think about your data

Personal data is held in confidence. We collect only what is necessary to operate the relationship between Archalign and you, retain it only as long as needed, and never sell it. Where the standard differs between regulations, we apply the higher.

1. Scope

This Policy applies to personal data processed by Archalign Limited through our web properties archalign.store, archalign.ltd, and archalign.co.uk, and through the email aliases admin@, support@, shipping@, trade@, orders@, legal@, marketing@, and ai@archalign.co.uk. Suppliers, carriers, and processors operate under separate notices and contracts.

2. Personal data we collect

  • Voluntarily provided: name, billing and shipping address, telephone, email, order content, account password (hashed), trade-account documentation, complaint correspondence, marketing preferences.
  • Automatically collected: device type, browser type, IP address (truncated for analytics), pages viewed, referrer URL, basket state, session cookies, fraud signals from payment providers.
  • Special category data: we do not knowingly collect special category data (UK GDPR Article 9). If unsolicited special data arrives via correspondence we redact and delete.

3. Lawful bases (UK GDPR Article 6)

  • Article 6(1)(b) — Contract: order processing, delivery, customer care, returns.
  • Article 6(1)(f) — Legitimate interest: fraud prevention, security, service improvement, business continuity. Balancing test on file.
  • Article 6(1)(a) — Consent: marketing emails; non-essential cookies. Granular, freely-given, withdrawable.
  • Article 6(1)(c) — Legal obligation: accounting (6 years HMRC), AML where engaged, lawful response to court orders.

4. Sources of data

Direct from you (account, order, correspondence); from payment processors (transaction tokens, AVS/CVV results, never full card numbers); from carriers (delivery confirmation, customs records); from analytics tools after consent.

5. How we use your data

To accept and process orders; deliver them; handle returns and refunds; respond to customer-care requests; honour trade-account commitments; send transactional communications (order confirmations, dispatch notices, returns, customs); send marketing if you opted in; comply with tax and consumer law; investigate suspected fraud; defend legal claims; improve our service through aggregated, anonymised analysis.

6. Recipients and processors

  • Shopify Inc. / Shopify International Ltd — store hosting, checkout, customer accounts, hosted email automations.
  • Payment processors: Shopify Payments, Stripe, PayPal (PCI-DSS v4.0). We do not store full card numbers.
  • Carriers: Royal Mail, DHL Express, DPD, FedEx, Evri, regional last-mile partners as required. Address and order reference only.
  • Customs brokers / fiscal agents for DDP shipments to GCC, Iraq, EU, US/Canada.
  • Email infrastructure: Google Workspace (admin@archalign.co.uk and aliases) — UK + EU data residency where supported.
  • Analytics (with consent): Google Analytics 4 with consent mode and IP-anonymisation; Shopify native analytics; Judge.me reviews.
  • Professional advisors (accountants, legal, insurers) bound by confidentiality.
  • Public authorities where compelled by law.

7. International transfers

We may transfer your data outside the UK/EEA to suppliers that operate globally. Transfers are protected by: UK adequacy decisions where available; the EU–US Data Privacy Framework where applicable; or Standard Contractual Clauses with UK addendum where neither applies. Detail available on request to legal@archalign.co.uk.

8. Retention

  • Order and accounting records: 6 years from the end of the relevant tax year (Companies Act 2006, HMRC).
  • Account: for as long as your account remains active, then 12 months dormancy plus 30-day deletion notice.
  • Marketing list: until you withdraw consent, plus suppression record to prevent re-mailing.
  • Server logs: 90 days for security; aggregated metrics may be retained indefinitely in anonymised form.
  • Trade-account documentation: for the life of the trading relationship plus 6 years.

9. Your rights (UK GDPR Articles 12–22)

  • Right of access (a copy of your personal data we hold).
  • Right to rectification of inaccurate data.
  • Right to erasure (“right to be forgotten”) subject to legal retention obligations.
  • Right to restriction of processing.
  • Right to data portability.
  • Right to object to processing based on legitimate interest.
  • Right to withdraw consent at any time.
  • Right to lodge a complaint with the Information Commissioner’s Office (ico.org.uk) or your national EU supervisory authority.

To exercise any right, email legal@archalign.co.uk. We respond within one calendar month (UK GDPR Article 12(3)).

10. Cookies and tracking

Governed in detail by our Cookie Policy. We seek consent under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) before placing non-essential cookies.

11. Marketing

We email you marketing only after opt-in consent. Withdraw consent in one click via the unsubscribe link in any marketing email, or by emailing legal@archalign.co.uk. Transactional emails (order, dispatch, customer care) are not marketing and are sent regardless of marketing consent.

12. Children

Our web properties are not directed at children under 16. We do not knowingly process the personal data of children under 16. If you believe we hold such data, contact legal@archalign.co.uk and we will delete it.

13. Security

Industry-standard technical and organisational measures: HTTPS/TLS in transit; encryption at rest where supported; two-factor authentication on administrative accounts; least-privilege access; supplier contracts with binding data-protection terms. Personal data breaches are reported to the ICO within 72 hours where the threshold is met (UK GDPR Article 33).

14. Changes to this Policy

We revise this Policy as our practices evolve. The effective date at the top reflects the current version. Material changes are communicated by email to account-holders and by a notice on our web properties for at least 14 days. Earlier versions are available on request.

15. Contact

Data Protection: legal@archalign.co.uk · Order & customer care: support@archalign.co.uk · WhatsApp +44 7478 628063 · Postal: Archalign Limited, 1000 Great West Road, c/o KM Accountancy Services, Brentford, London TW8 9DW, United Kingdom.

Archalign Limited. Registered in England and Wales. Company No. 14635926.