Legal & Compliance
Privacy Policy (UK GDPR)
Last updated: September 2026
1. Data Controller Information
Cilia Light Ltd ("we", "us", or "our") acts as the Data Controller responsible for your personal data collected via cilialight.co.uk. We are fully committed to protecting your privacy in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Personal Data We Collect
- Order Fulfillment Data: Full name, billing address, delivery address, email address, and contact telephone number.
- Payment Information: All payment transactions are tokenized and processed securely through Stripe Inc. We never store or view raw debit or credit card numbers on our servers.
- Technical Data: Anonymised IP addresses, browser types, and approximate regional geographic location collected via Cloudflare edge routing to optimize site delivery and prevent fraudulent activity.
3. Legal Basis for Processing
We process your personal information under the following lawful grounds:
- Contractual Performance: To fulfill purchases, dispatch parcels with carriers, and manage customer service inquiries.
- Legal Obligations: Retaining tax and transaction records in compliance with HM Revenue & Customs (HMRC) statutory regulations.
- Legitimate Interests: Securing our website against cyber threats, spam, and fraud.
4. Third-Party Service Providers
We share data strictly with trusted service providers who assist us in operating our store:
- Stripe: PCI-DSS Level 1 certified payment processing.
- Cloudflare: Secure global CDN edge infrastructure and DDoS protection.
- Delivery Carriers (Royal Mail / DPD): To execute shipping and order delivery to your chosen UK address.
5. Your Legal Rights
Under UK GDPR legislation, you hold the right to access, rectify, or request erasure of your personal data, as well as the right to restrict or object to certain processing. To exercise any of these statutory rights, please email our Data Privacy team at support@cilialight.co.uk.