Privacy Policy

1. Data Controller Information

This Privacy Policy sets out how FLEX SHOP UK (“Company”, “we”, “us”, or “our”) processes, stores, and protects personal data obtained from visitors, prospective clients, active clients, and partners who interact with our website (flexshopuk.com) and our e-commerce agency services.

2. Fundamental Data Protection Principles

Under the UK GDPR, we adhere strictly to the core data protection principles set out in Article 5. We ensure that personal data is:

• Processed lawfully, fairly, and in a transparent manner in relation to individuals.
• Collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes.
• Adequate, relevant, and limited to what is strictly necessary in relation to the purposes for which it is processed.
• Accurate and, where necessary, kept up to date. Every reasonable step is taken to rectify inaccurate data without delay.
• Kept in a form which permits identification of data subjects for no longer than is necessary for the processing purposes.
• Processed in a manner that ensures appropriate security, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage.

3. Comprehensive Categories of Personal Data Collected

Depending on your interaction with FLEX SHOP UK, we collect and process the following categories of personal information:

• Identity Data: First name, last name, job title, company name, or brand affiliation.
• Contact Data: Official email address, telephone number, WhatsApp contact number, and business correspondence address.
• Commercial & Project Data: Store URL (Shopify, WooCommerce, TikTok Shop), campaign objectives, product catalogues, and brief submissions.
• Financial & Transaction Data: Bank account details, transaction records, invoices, milestone payment receipts, and billing history. (We do not store full payment card numbers; payments are processed securely by PCI-DSS certified gateways).
• Technical & Usage Data: Internet protocol (IP) address, browser type and version, time zone setting, operating system, and interaction paths.
• Marketing & Communications Data: Your preferences in receiving updates, newsletters, and promotional announcements from us.

4. How We Collect Your Personal Data

We use diverse methods to collect data from and about you, including:

• Direct Interactions: You provide Identity, Contact, and Project data by filling out forms on our website, messaging our official WhatsApp channel, or exchanging emails with our team.
• Automated Technologies: As you interact with our website, we automatically collect Technical Data about your equipment, browsing actions, and patterns via cookies and server logs.
• Third Parties: We may receive data from business partners, verification services, or public registries (such as Companies House) to confirm commercial credentials.

5. Lawful Bases for Processing Under UK GDPR (Article 6)

We will only process your personal data when the law permits us to. Most commonly, we rely on the following statutory legal bases:

6. Data Sharing & Third-Party Subprocessors

FLEX SHOP UK does not sell, rent, monetize, or trade personal data under any circumstances. We disclose personal data only to authorized third parties who assist us in operating our services, including:

• Cloud Hosting & Infrastructure Providers: Secure UK and European data centers ensuring website reliability and encrypted database storage.
• Payment Gateway Processors: Tier-1 PCI-DSS compliant providers handling credit/debit card transactions and automated bank settlements.
• Platform APIs & Integrations: Authorized API connections (Shopify, WooCommerce, Meta Business Manager, TikTok Shop Partner Center, Google Analytics) strictly necessary for agency operations.
• Professional Advisers & Regulatory Bodies: Accountants, legal counsel, insurers, and HMRC when required by UK statutory legislation.

7. International Data Transfers

Whenever personal data is transferred outside the United Kingdom, we ensure a similar degree of protection is afforded to it by utilizing at least one of the approved UK International Data Transfer Agreements (IDTA), Standard Contractual Clauses (SCCs), or adequacy regulations issued by the UK Secretary of State.

8. Technical & Organizational Data Security Measures

We have implemented robust, multi-layered security measures to prevent your personal data from being accidentally lost, unauthorizedly accessed, altered, or disclosed:

• Encryption Standards: All data in transit is protected via Transport Layer Security (TLS 1.3), and resting data is stored using AES-256 standard encryption.
• Access Controls: Strict role-based access controls (RBAC) and two-factor authentication (2FA) enforced on all administrative systems.
• Regular Audits: Ongoing vulnerability assessments, database hardening, and automated redundancy backups.

9. Data Retention Schedules

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered:

• Client Financial & Invoicing Records: Retained for 6 years following the end of the relevant financial year, in full compliance with UK HMRC statutory accounting rules.
• Commercial Inquiries & Quotations: Retained for 12 months from the date of submission if no contractual relationship is established.
• Analytics & Technical Logs: Retained for 26 months, after which logs are anonymized or permanently deleted.

10. Your Enforceable Statutory Rights Under UK GDPR

Under the UK Data Protection Act 2018 and the UK GDPR, you have the following enforceable statutory rights:

• Right of Access (Subject Access Request – SAR): Obtain confirmation as to whether your data is being processed and receive a free copy.
• Right to Rectification: Request correction of inaccurate or incomplete personal records.
• Right to Erasure (“Right to be Forgotten”): Request deletion of personal data where there is no overriding legal reason for retention.
• Right to Restriction of Processing: Suspend processing under specific dispute circumstances.
• Right to Data Portability: Receive your data in a structured, commonly used, machine-readable format.
• Right to Object: Object to data processing based on legitimate interests or for direct marketing purposes.
• Rights in Relation to Automated Decision-Making: We do not conduct automated profiling or decision-making having legal effects.

11. Children’s Privacy Protection

Our website and services are directed exclusively to business professionals and individuals aged 18 and over. We do not knowingly solicit or collect personal information from individuals under the age of 18.

12. External Links & Third-Party Integrations

Our website may include links to third-party platforms (such as WhatsApp, Shopify, TikTok, and Meta). Clicking on those links may allow third parties to collect or share data. We encourage you to review the privacy policy of every website you visit.

13. Changes to This Privacy Policy

We review and update this policy periodically to reflect statutory amendments or operational adjustments. Any material revisions will be published promptly on this page with an updated revision date.

14. Supervisory Authority & Right to Complain

You have the statutory right to make a complaint at any time to the UK supervisory authority for data protection issues:

15. Official Data Protection Contact Details

If you have any questions about this Privacy Policy, wish to exercise your statutory rights, or submit a Subject Access Request, please contact our team: