AI Generated British Privacy Policy
PDF & Word - 2026 Updated

1. Introduction

2. Your Consent and Opt-Out Rights

3. Definitions

4. Information We Collect

5. How We Collect Information

6. Legal Basis for Processing

7. How We Use Your Information

8. Sharing Your Information

9. International Data Transfers

10. Data Security

11. Data Retention

12. Your Rights

13. Exercising Your Rights

14. Cookies and Tracking Technologies

15. Children's Privacy

16. Third-Party Links

17. Changes to This Privacy Policy

18. Contact Information

19. Supervisory Authority

This Privacy Policy explains how Tech Innovations Ltd ("we", "us" or "our") collects, uses, shares, stores and protects your personal data when you visit or use our website at www.techinnovations.co.uk (the "Website"), register for an account, or use any of our services. It applies to all categories of users, including visitors to the Website, registered users, and customers.

This policy is designed to be clear and transparent, as required by Articles 12 to 14 of the UK GDPR. It tells you what personal data we collect about you, why we collect it, how we use it, who we share it with, how long we keep it, and how we protect it.

Tech Innovations Ltd is the data controller for the personal data we process through the Website and is registered with the UK Information Commissioner's Office (ICO) under registration number ZA123456. You can find our entry on the ICO register at https://ico.org.uk/register.

For information about how we use cookies and similar technologies, please see our separate Cookie Policy, available at www.techinnovations.co.uk/cookie-policy.

This Privacy Policy is effective as of 1 January 2024 and was last updated on 15 October 2024.

Where we rely on your consent as the legal basis for processing your personal data (for example, for certain types of marketing or non-essential cookies), we will obtain that consent in a clear and specific way. This may be through a cookie banner on our Website, by ticking a checkbox, or by actively choosing to sign up for communications.

Your consent must be freely given, specific, informed and unambiguous. We will always provide you with clear information about what you are consenting to before you agree.

You can withdraw your consent at any time by using the unsubscribe link in our emails, by adjusting your cookie preferences through the cookie banner, or by contacting us using the details in the Contact Information section. Withdrawing consent will not affect the lawfulness of any processing we carried out before you withdrew consent.

If you withdraw consent, we may not be able to provide certain services or features that rely on that consent.

In this Privacy Policy, the following terms shall have the meanings set out below.

Personal Data means any information relating to an identified or identifiable natural person (a data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

Legitimate Interests means the interests of our company in conducting and managing our business, for example to provide our services, to improve those services, for fraud prevention, or to keep our users informed about our products. We make sure we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests.

Special Category Data means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.

Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

Third Party means a natural or legal person, public authority, agency or body other than the data subject, controller, processor and persons who, under the direct authority of the controller or processor, are authorised to process personal data.

Data Controller means the natural or legal person, alone or jointly with others, which determines the purposes and means of the processing of personal data. Tech Innovations Ltd is the data controller for the purposes of this Privacy Policy.

Data Processor means a natural or legal person which processes personal data on behalf of the data controller.

Data Subject means any living individual who is the subject of personal data. This includes our Website visitors, registered users and customers.

The Right of Access means the right of a data subject to obtain from the controller confirmation as to whether or not personal data concerning him or her are being processed, and, where that is the case, access to the personal data.

The Right to Rectification means the right of a data subject to require the controller to rectify any inaccurate personal data concerning the data subject without undue delay.

The Right to Erasure (also known as the right to be forgotten) means the right of a data subject to require the controller to erase personal data concerning the data subject without undue delay in certain circumstances.

We collect the following categories of personal data. For each category, we have indicated how it is primarily collected (directly from you, indirectly, or automatically), the main purposes for collection, and whether it includes any special category data (we do not collect special category data such as health information, biometric data, racial or ethnic origin, political opinions, religious beliefs, or genetic data).

Identity Data: Full name and date of birth. Collected directly from you when you create an account or complete forms. Used for account management, identity verification and service provision. No special category data.

Contact Data: Email address, postal address and phone number. Collected directly from you when you register, make a purchase or contact us. Used for communicating with you, delivering services and sending important notices. No special category data.

Financial Data: Payment card details and billing information. Collected directly from you or via our payment processors when you make a purchase. Used for processing payments and preventing fraud. No special category data.

Technical Data: IP address, device identifiers, browser type, operating system and login data. Collected automatically through your use of the Website via server logs, pixels, cookies and analytics tools. Used for Website administration, security, fraud prevention and analytics. No special category data.

Usage Data: Information about how you use the Website, such as pages visited, time spent on pages and browsing history on our site. Collected automatically through cookies, pixels and analytics tools. Used to improve our services, for analytics, and to personalise your experience. No special category data.

We do not collect special category data. We do not knowingly collect personal data from children under 13.

We collect personal data in the following ways:

Directly from you: When you create an account, fill out online forms (such as contact or subscription forms), make a purchase, or correspond with us by email or phone. This includes identity, contact and financial data.

Automatically: As you interact with our Website, technical and usage data is collected using server logs, pixels, cookies, analytics tools (such as Google Analytics) and similar technologies. See our Cookie Policy for more details.

From third parties: We may receive technical data from analytics providers, advertising networks and search information providers. We do not buy personal data from data brokers.

Under Article 6 of the UK GDPR, we must have a valid lawful basis for each type of personal data we process and each purpose. The lawful bases we rely on are consent, contract, legal obligation and legitimate interests. We do not rely on vital interests or public task as these are not relevant to our activities.

Consent: We rely on consent for sending non-essential marketing communications and for certain non-essential cookies. You can withdraw consent at any time by using the methods described in the 'Your Consent and Opt-Out Rights' section or by contacting us.

Contract: We process identity, contact, financial and transaction data to perform our contract with you when you purchase our services or create an account. This includes providing the services you have requested and managing your account.

Legal Obligation: We process identity, contact and financial data to comply with legal and regulatory obligations, such as tax, accounting and anti-money laundering requirements.

Legitimate Interests: We process technical and usage data on the basis of our legitimate interests in operating and improving our Website, conducting analytics to understand how users interact with our services, maintaining security, preventing fraud, and marketing our similar products to existing customers. We have carried out a legitimate interests balancing test for each of these purposes and concluded that our interests are not overridden by your rights and freedoms, particularly as you can opt out of marketing and many tracking technologies at any time.

We do not carry out automated decision-making or profiling that produces legal effects or similarly significant effects on you.

We use your personal data only for the purposes set out below. Each purpose is linked to the relevant lawful basis from the 'Legal Basis for Processing' section.

To register you as a new customer or user (contract).

To process and deliver your orders or subscriptions, including managing payments and collecting money owed to us (contract and legitimate interests).

To manage our relationship with you, including notifying you about changes to our terms or this Privacy Policy (contract and legal obligation).

To administer and protect our business and the Website, including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data (legitimate interests).

To deliver relevant Website content and advertisements to you and measure the effectiveness of those advertisements (consent and legitimate interests).

To use data analytics to improve our Website, products, services, marketing and customer relationships (legitimate interests).

To send you marketing communications about our products and services that may be of interest to you, where we have your consent or the right to do so under legitimate interests (consent or legitimate interests).

To comply with legal or regulatory obligations (legal obligation).

To prevent and detect fraud and other illegal activities (legitimate interests and legal obligation).

We may share your personal data with the categories of recipients set out below. We distinguish between processors (who process data on our behalf and under our instructions) and independent controllers (who determine their own purposes). We only share the minimum data necessary for the specified purposes.

Processors (service providers): We share identity, contact, technical, usage and financial data with processors such as cloud hosting providers (located in the UK), payment processors (located in the UK and EU/EEA), and analytics providers such as Google Analytics (located in the United States). These providers act only on our instructions. We have data processing agreements in place with all processors that require them to keep your data secure and to use it only for the purposes we specify.

Affiliates: We do not currently share data with other companies in our corporate group. If this changes, we would share data for administrative purposes under legitimate interests.

Professional advisers: We may share identity, contact and financial data with our lawyers, accountants and auditors (located in the UK) who act as processors or independent controllers as required for the purposes of professional services.

Business transfers: In the event of a merger, acquisition or sale of assets, personal data may be transferred as part of the transaction. We will notify you in advance where required by law.

Legal disclosures: We may share any category of data with regulators, law enforcement or other third parties where we are legally required to do so, or to protect our rights, property or safety (legal obligation or legitimate interests).

We do not sell your personal data to third parties.

Some of our processors are based outside the UK, specifically in the United States. We ensure that your personal data is protected by using appropriate safeguards as required by Chapter V of the UK GDPR.

For transfers to the United States, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. We do not rely on adequacy decisions for these transfers.

You can obtain a copy of the relevant safeguards by contacting us using the details in the Contact Information section.

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures in accordance with Article 32 of the UK GDPR. These measures are designed to ensure a level of security appropriate to the risk.

Our measures include: encryption of personal data at rest and in transit using industry-standard algorithms (such as AES-256); pseudonymisation where appropriate for analytics; strict role-based access controls; multi-factor authentication for systems containing personal data; regular security audits and vulnerability assessments; firewalls, intrusion detection systems and regular software updates; and comprehensive security awareness training for all staff.

We conduct regular risk assessments and review the effectiveness of our security measures to ensure ongoing confidentiality, integrity, availability and resilience of processing systems.

In the event of a personal data breach, we will notify the ICO without undue delay and, where required by law, communicate the breach to affected individuals. Our formal incident response plan sets out the procedures we follow.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting or reporting requirements. The table below sets out our standard retention periods for the categories of data mentioned in this policy.

Category of Data | Retention Period | Reason Identity and Contact Data | 6 years after our last interaction with you | To defend potential legal claims and comply with tax laws Financial and Transaction Data | 6 years from the end of the financial year in which the transaction occurred | Compliance with tax and accounting laws Technical and Usage Data | 2 years from the date of collection | For analytics and to improve our services Marketing Data | 2 years from the date of consent or last communication (whichever is later), unless renewed | To respect your marketing preferences

To determine the appropriate retention period, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes by other means, and the applicable legal requirements.

At the end of the retention period, we will securely delete or irreversibly anonymise your personal data. Deletion means we remove the data so it cannot be recovered. Anonymisation means we remove all identifiers so the data can no longer be linked to you. We will securely delete or anonymise your data at the end of the retention period unless a legal exception requires us to keep it longer.