Privacy policy
This Privacy Policy applies between you, the user of this website (the "Website"), and Grafton Ecommerce Limited, the owner and provider of this Website.
Grafton Ecommerce Limited takes the privacy and security of your personal information seriously. This Privacy Policy explains how we collect, use, store, protect and share personal data provided by you or collected by us in connection with your use of the Website and our services.
Please read this Privacy Policy carefully.
1. Scope of This Privacy Policy
This Privacy Policy applies to the actions of Grafton Ecommerce Limited and users of this Website.
It does not extend to third-party websites that may be accessed from this Website, including websites operated by our banking partners, payment service providers, social media platforms or other third parties. We encourage you to read the privacy policies of those organisations before providing personal information to them.
For the purposes of applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Grafton Ecommerce Limited is the data controller where we determine the purposes and means by which your personal data is processed.
2. Data We May Collect
We may collect and process personal data including:
- Your name;
- Contact information, including your email address, telephone number, billing address and delivery address;
- Account and customer information;
- Order and transaction information;
- Payment-related information required to process purchases, payments, refunds and returns;
- Information required for fraud prevention, transaction verification and compliance with applicable legal or regulatory requirements;
- Communications between you and Grafton Ecommerce Limited;
- Technical and usage information relating to your use of our Website, including your IP address, browser information, dates and times of access and how you interact with the Website; and
- Any other information you choose to provide to us when using our services or contacting us.
Payment information may be collected or processed directly by our banking partners, payment processors or other financial service providers. Where this occurs, those organisations may process your personal data in accordance with their own privacy policies and applicable legal obligations.
3. How We Collect Data
We may collect personal data in the following ways:
- Data you provide directly to us; and
- Data collected automatically when you use our Website.
Data You Give to Us
Grafton Ecommerce Limited may collect your personal data when you:
- Contact us through the Website, by telephone, email, post or another communication method;
- Register with us or create an account;
- Place an order or purchase products or services from us;
- Make or receive a payment, refund or return;
- Use our Website or services;
- Communicate with our customer service team;
- Elect to receive marketing communications from us; or
- Otherwise provide information to us in connection with our business.
Data Collected Automatically
When you access the Website, certain information may be collected automatically.
This can include your IP address, browser and device information, the date and time you access the Website, the frequency with which you access it and information concerning how you use and interact with the Website.
We may use this information to operate the Website, maintain security and improve our Website, products and services.
4. How We Use Your Data
We may use your personal data where necessary to:
- Process and fulfil orders;
- Process payments, refunds and returns;
- Provide our products and services;
- Manage your customer account;
- Communicate with you regarding orders, transactions, payments and our services;
- Maintain internal business and transaction records;
- Improve our Website, products and services;
- Provide customer support;
- Detect, investigate and prevent fraud, money laundering, unauthorised transactions and other unlawful activity;
- Protect the security of our Website, customers and business;
- Work with our banking partners, payment processors and financial service providers;
- Meet legal, tax, accounting and regulatory requirements;
- Establish, exercise or defend legal claims; and
- Send marketing communications where we have an appropriate legal basis to do so.
We will only process personal data where we have a lawful basis under applicable data protection law.
Depending on the circumstances, this may include processing necessary for the performance of a contract with you, compliance with a legal obligation, our legitimate interests or your consent.
5. Marketing
Where required by law, we will obtain your consent before sending direct electronic marketing communications.
In certain circumstances, we may rely on the "soft opt-in" where permitted by applicable law. This may apply where you have previously purchased from us or expressed an interest in our products or services and we market similar products or services to you.
You can withdraw your consent or opt out of marketing communications at any time by contacting us at info@graftonecom.co.uk or by using the unsubscribe option included in applicable marketing communications.
Withdrawing consent will not affect the lawfulness of processing carried out before consent was withdrawn.
6. Who We Share Data With
We may share personal data with the following categories of recipients where necessary:
- Our employees, contractors, agents and professional advisers;
- Service providers that provide technology, hosting, fulfilment, delivery, customer support or other services to us;
- Banks, banking partners, payment processors, payment service providers and other financial institutions involved in processing or facilitating payments, refunds and transactions;
- Fraud prevention, identity verification, security and compliance service providers;
- Accountants, auditors, legal advisers and other professional advisers;
- Tax authorities, regulators, law enforcement agencies, courts and other competent authorities where disclosure is required or permitted by law; and
- Prospective purchasers, investors or other relevant parties in connection with a potential sale, restructuring or transfer of all or part of our business.
Our banking partners and payment providers may need to process personal and transaction information to provide their services, prevent fraud, comply with anti-money laundering requirements, meet regulatory obligations and process payments or refunds.
Some of these organisations may act as independent data controllers in respect of the information they receive and may therefore process your information in accordance with their own privacy policies.
We will only share personal data where there is an appropriate reason and lawful basis for doing so.
7. Keeping Your Data Secure
We use appropriate technical and organisational measures designed to safeguard your personal data from unauthorised access, accidental loss, misuse, alteration or disclosure.
These measures may include:
- Secure systems and servers;
- Access controls;
- Password protection;
- Encryption and secure transmission technologies where appropriate; and
- Procedures for identifying, investigating and responding to suspected personal data breaches.
Where payment information is transmitted through our Website or payment providers, appropriate security technologies may be used to protect the transmission of that information.
If you suspect misuse, loss or unauthorised access to your personal data in connection with our services, please contact us as soon as possible at info@graftonecom.co.uk.
8. Data Retention
We will retain personal data only for as long as reasonably necessary for the purposes for which it was collected.
We may retain information for longer where necessary to comply with legal, tax, accounting, regulatory, fraud-prevention or contractual requirements or to establish, exercise or defend legal claims.
Even where personal data is removed from our active systems, copies may remain temporarily in secure backup or archival systems where required for legitimate business, legal or regulatory purposes.
9. Your Rights
Under applicable data protection law, you may have the following rights in relation to your personal data:
- Right of access – the right to request information about the personal data we hold about you and obtain a copy of it;
- Right to rectification – the right to request correction of inaccurate or incomplete personal data;
- Right to erasure – the right, in certain circumstances, to request deletion of your personal data;
- Right to restriction – the right, in certain circumstances, to request that we restrict how we process your personal data;
- Right to data portability – the right, in certain circumstances, to receive personal data you have provided to us in a structured, commonly used and machine-readable format and/or have it transferred to another organisation;
- Right to object – the right, in certain circumstances, to object to processing based on our legitimate interests, including an absolute right to object to processing for direct marketing purposes; and
- Right to withdraw consent – where processing is based on consent, you may withdraw that consent at any time.
These rights are subject to applicable legal conditions and exemptions.
To exercise your rights or make an enquiry concerning your personal data, please contact us at:
Email: info@graftonecom.co.uk
We may need to verify your identity before responding to a request.
If you are dissatisfied with how we have handled your personal data or a privacy complaint, you also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection supervisory authority.
It is important that the personal data we hold about you is accurate and current. Please inform us if your information changes.
10. Links to Other Websites
Our Website may contain links to websites operated by third parties.
We do not control those websites and are not responsible for their content, security or privacy practices. This Privacy Policy does not apply to your use of third-party websites.
You should review the privacy policy of the relevant third party before providing personal information to them.
11. Changes of Business Ownership and Control
Grafton Ecommerce Limited may expand, restructure, sell or reduce its business from time to time.
Where this involves a sale or transfer of all or part of our business, personal data relevant to the transferred business may be disclosed or transferred to a prospective purchaser, new owner or controlling party where permitted by law.
We will take appropriate steps to protect personal data in connection with any such transaction.
12. International Transfers
Some of our service providers, banking partners, payment providers or technology providers may process personal data outside the United Kingdom.
Where personal data is transferred internationally, we will take appropriate measures where required by applicable data protection law to ensure that the information receives an appropriate level of protection.
13. General
If any provision of this Privacy Policy is found by a court or competent authority to be invalid, illegal or unenforceable, the remaining provisions will continue to apply.
Nothing in this Privacy Policy is intended to limit any rights you have under applicable data protection legislation.
This Privacy Policy and matters relating to it will be governed by the laws of England and Wales, subject to any mandatory rights or protections that apply under data protection or consumer law.
14. Changes to This Privacy Policy
Grafton Ecommerce Limited may update this Privacy Policy from time to time, including where necessary to reflect changes to our services, banking or payment arrangements, business practices or applicable law.
Any updated version will be published on our Website. Where appropriate, we may also notify you of material changes.
15. Contact Us
If you have questions about this Privacy Policy, how we process your personal data or wish to exercise your data protection rights, please contact:
Grafton Ecommerce Limited
Email: info@graftonecom.co.uk
Last updated: August 2026