Trueergochair respects the privacy of our visitors and customers, and we process personal data in strict compliance with applicable UK Data Protection Law (including the UK GDPR and Data Protection Act 2018) and, where applicable, the General Data Protection Regulation (EU GDPR) across the European Economic Area (EEA).
This Privacy Policy outlines how personal information is collected, processed, retained, and shared, as well as the statutory rights available to individuals regarding their data.
- Data Controller
For the purposes of applicable data protection legislation, the data controller responsible for personal information collected through this website is:
Brand: Trueergochair
Company Name: [XXX]
Registered Address: [XXX]
Customer Service Email: chair@trueergochair.com
Telephone: [XXX]
- Personal Information We Collect
We collect personal information necessary to provide our services, process orders, and enhance user experience. This includes:
Identity & Contact Data: Full name, billing address, shipping address, email address, and telephone number.
Order & Transaction Data: Products purchased, transaction history, order notes, and customer service interactions.
Technical & Usage Data: IP address, browser type, device information, access times, and interaction data collected via essential and functional cookies.
Payment Information: Payment card details, billing address, and transaction verification identifiers.
- Payment Processing & PCI-DSS Compliance
Online payments on this website are processed securely by Stripe, operating as our primary payment service provider.
Payment Data Security: When an order is placed, relevant payment information is encrypted and transmitted directly to Stripe. Trueergochair does not collect, store, or process full credit/debit card numbers or sensitive authentication codes on our servers.
Role of Payment Provider: Stripe processes personal and transaction data in accordance with its own privacy policy and PCI-DSS (Payment Card Industry Data Security Standard) requirements. Stripe may act as a data processor on our behalf or as an independent data controller for specific security and fraud prevention purposes.
Transparency: Customers may review Stripe’s privacy practices directly via the official Stripe Privacy Centre.
- How We Use Personal Information & Legal Basis
We process personal information under the following legal bases recognized by data protection legislation:
Performance of a Contract: To process, fulfill, and manage purchases, handle order communications, arrange shipping, and process returns or refunds.
Compliance with Legal Obligations: To maintain mandatory statutory records, fulfill accounting and tax obligations (e.g., HMRC/EEA tax reporting), and respond to lawful government or law enforcement requests.
Legitimate Business Interests: To manage customer enquiries, prevent fraud, monitor transaction risks, enforce legal rights, optimize website stability, and resolve potential chargebacks or transaction disputes.
Consent: Where required by law (e.g., non-essential cookies or direct marketing communications). Consent can be withdrawn at any time.
- Sharing of Personal Information
We do not sell, rent, or trade personal information to third parties. Data is shared strictly on a need-to-know basis with trusted service providers who assist in operating our website and fulfilling customer orders:
Payment Processors: Stripe (for payment handling and transaction risk evaluation).
Logistics & Delivery Partners: Couriers and warehouse fulfillment centers necessary to deliver purchased items.
IT & Hosting Infrastructure Providers: Secure web hosting, website maintenance, and operational software platforms.
Professional Advisers & Regulatory Authorities: Legal advisers, auditors, tax authorities, or legal enforcement bodies where required by law or necessary for dispute resolution.
All third-party service providers are contractually bound to keep personal data confidential and secure, using it only for specified and documented instructions.
- International Data Transfers
Where personal data is transferred outside the UK or the EEA, we ensure that adequate protection mechanisms are in place. These mechanisms include transferring data to countries recognized as providing an adequate level of data protection, or employing standard contractual clauses (SCCs) and the UK International Data Transfer Agreement (IDTA).
- Data Retention
Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected, or to satisfy legal, accounting, and reporting requirements.
Order & Financial Records: Retained for up to 6–7 years following transaction completion in compliance with UK/EU statutory accounting and tax regulations.
Customer Account Data: Retained for the duration of the account’s active status or until erasure is requested, subject to legal record-keeping requirements.
Customer Correspondence: Retained for up to 2 years after inquiry resolution to maintain customer service standards and manage potential warranty or transaction disputes.
Website Analytics & Cookie Data: Retained in accordance with cookie preference settings outlined in our Cookie Policy.
- Data Security
We implement robust technical and organizational security measures—including SSL encryption and strict access controls—to protect personal data against unauthorized access, loss, misuse, or alteration. Access to personal data is restricted to authorized personnel and service providers with a legitimate business need. - Your Data Protection Rights
Under UK and EEA data protection law, individuals possess the following rights regarding their personal data:
Right of Access: Request a copy of the personal data held about you.
Right to Rectification: Request correction of inaccurate or incomplete information.
Right to Erasure (“Right to be Forgotten”): Request deletion of data where processing is no longer necessary or lawful.
Right to Restrict or Object: Limit or object to data processing based on legitimate interests or direct marketing.
Right to Data Portability: Request transfer of provided personal data to another party in a structured format.
Right to Withdraw Consent: Withdraw consent at any time where processing relies on consent.
To exercise any of these rights, please submit your request to: chair@trueergochair.com. Identity verification may be required prior to fulfilling data requests.
- Data Protection Complaints
If you have concerns regarding how your personal information is processed, we encourage you to contact us directly so we can address your inquiry promptly.
You also retain the right to lodge a complaint with the relevant supervisory authority:
UK: Information Commissioner’s Office (ICO) (www.ico.org.uk)
EEA: Your local national Data Protection Authority (DPA).
- Contact Information
Brand: Trueergochair
Company Name: [XXX]
Registered Address: [XXX]
Warehouse Address: [XXX]
Customer Support Email: chair@trueergochair.com
Telephone: [XXX]