Switch Labs Ltd ("Switch Labs", "we", "our", "us") is committed to protecting your personal data and processing it in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all applicable data protection legislation.
This policy explains what data we collect, why we collect it, how we use it, and your rights as a data subject.
1. Who We Are (Data Controller)
Switch Labs Ltd is the data controller for the personal data you provide to us. Registered in England and Wales, company number 12345678.
Data protection contact: privacy@switchlabs.co.uk
2. What Data We Collect
2.1 Data You Provide Directly
- Account registration: name, email address, password (hashed)
- Orders: name, delivery address, email, phone number, institution name, payment reference
- Contact enquiries: name, email, message content
- Reviews: name (or pseudonym), review text, star rating
- Newsletter / marketing opt-in: email address, preferences
2.2 Data Collected Automatically
- Usage data: pages visited, time on site, referring URLs, browser type and version, operating system, IP address
- Cookies: session cookies, analytics cookies, preference cookies (see Section 9)
- Device data: device type, screen resolution
2.3 Data From Third Parties
We may receive limited data from third-party services (e.g. Google Analytics aggregated reports). We do not purchase personal data from data brokers.
3. Legal Basis for Processing
We process your personal data under the following legal bases:
- Contract performance (Article 6(1)(b) UK GDPR): Processing your order, arranging delivery, managing returns and refunds.
- Legal obligation (Article 6(1)(c)): VAT records, fraud prevention, responding to regulatory requests.
- Legitimate interests (Article 6(1)(f)): Website analytics, fraud prevention, improving our services. We have carried out a Legitimate Interests Assessment (LIA) for these uses and concluded our interests do not override your rights.
- Consent (Article 6(1)(a)): Marketing emails, non-essential cookies. You may withdraw consent at any time.
4. How We Use Your Data
- Processing and fulfilling your orders
- Sending order confirmation and dispatch notification emails
- Responding to your enquiries and providing customer support
- Sending marketing communications (only with your consent)
- Analysing website usage to improve our services
- Preventing fraud and ensuring website security
- Complying with our legal and tax obligations
- Managing trade accounts and B2B relationships
5. How Long We Keep Your Data
- Order records: 7 years (UK tax/HMRC requirement)
- Account data: For the duration of your account plus 2 years after closure
- Marketing preferences: Until you withdraw consent
- Website analytics: 26 months (Google Analytics default)
- Contact enquiry records: 2 years
6. Who We Share Your Data With
We do not sell your personal data. We share data only with the following categories of third-party processors, under data processing agreements:
- Shopify Inc. — e-commerce platform and order management (data stored in the EU/EEA). Shopify Privacy Policy ↗
- Klaviyo Inc. — email marketing and transactional emails. Klaviyo Privacy Policy ↗
- Google LLC — Google Analytics 4 (anonymised usage data). Google Privacy Policy ↗
- Royal Mail / DPD — delivery address for order fulfilment only
- NOWPayments — cryptocurrency payment processing (if selected)
- HMRC / UK authorities — as required by law
7. International Data Transfers
Some third-party processors (including Shopify and Klaviyo) may transfer your data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place under UK GDPR Article 46, including Standard Contractual Clauses (SCCs) or reliance on the UK adequacy framework.
8. Your Rights
Under UK GDPR, you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate data
- Right to erasure — request deletion of your data (subject to legal retention requirements)
- Right to restrict processing — request we limit how we use your data
- Right to data portability — request your data in a machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — withdraw marketing consent at any time
To exercise any of these rights, contact us at privacy@switchlabs.co.uk. We will respond within 30 days. We may need to verify your identity before processing a request.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk · 0303 123 1113.
9. Cookies
We use the following categories of cookies:
- Strictly necessary: Session cookies required for the website to function (cart, login state). No consent required.
- Analytics: Google Analytics 4 cookies to measure usage. We use IP anonymisation. Consent required.
- Marketing: Klaviyo email tracking pixels. Consent required.
- Preferences: Cookie to remember your cookie consent choice.
You can manage cookie preferences via our cookie banner or your browser settings. Note that disabling strictly necessary cookies will affect site functionality.
10. Security
We implement appropriate technical and organisational measures to protect your personal data, including HTTPS encryption throughout, access controls, and regular security reviews. Our e-commerce platform (Shopify) is PCI-DSS compliant for payment data.
Despite these measures, no internet transmission is 100% secure. We encourage you to use a strong password and keep your account credentials confidential.
11. Children
Our website is not directed at persons under 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data about a minor, contact us immediately at privacy@switchlabs.co.uk.
12. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be notified by email to registered customers and highlighted on this page. The "last updated" date at the top of this page indicates when the policy was most recently revised.
13. Contact
For any privacy-related questions, to exercise your rights, or to make a complaint: privacy@switchlabs.co.uk or via our Contact page.