Privacy Statement 

 

The Purpose of this privacy statement is to explain how the staff of Eja Cruz Ltd, trading as Kulture Tonic (KT), processes your personal data 

The Role of KT in data protection terms is that of a data controller where it determines the purpose and use of the personal data being processed. Once received it becomes the responsibility of the privacy manager (PM), to ensure that it is processed in accordance with UK data protection law. You can email the PM using hello@kulturetonic.co.uk. 

The sort of personal data processed by KT will be your basic contact information sufficient to follow up general enquiries, fulfil your orders and to be able to stay in touch with you. The information being requested will be kept to a minimum and will only be used in relation to the purposes for which it is needed. Payment details for orders are processed through a third-party (‘Stripe’), independently of KT. 

KT’s duty of confidentiality means that our staff will treat your personal data with respect and in confidence. It is only disclosed to staff that need to know it. We also expect the same duty of confidentiality of all third parties with whom we share personal data. We use appropriate organisational and technical measures to safeguard all personal data. 

KT processes personal data against a lawful basis in instances described below: 

• In support of our legitimate interests to deal with your general enquiries and to stay in touch with you after you have placed an order with us, via our newsletter 

• To comply with our legal obligations 

• To fulfil our contractual obligations for you such as processing your orders 

• When processing for a pre-defined purpose, for which your prior consent will be sought (please note that your consent can be withdrawn at any time by contacting the PM) 

In all cases the processing of your personal data shall be done in accordance with the principles of data protection as set out in UK data protection legislation. 

KT will share personal data, but only when necessary, with some or all of the following: 

• The Inland Revenue (HMRC) 

• Accountants appointed by KT 

• Trusted third parties if they are of interest to you, but only with your prior permission 

KT processes your personal data primarily in the UK but it is backed up to Apple iCloud. Your data relating to orders are stored temporarily on the website server, located in the EU. 

Marketing will be limited to post sales newsletters or when we have your consent to send you them, if you have not placed an order before. If you want us to stop sending you them, please use the unsubscribe function embedded with each message or notify the PM directly. 

KT follows a retention schedule to determine the length of time it holds different types of personal data. The retention schedule is shown below: 

  • General correspondence that does not lead to an order will be retained for 2 years after our last contact with you

  • Contract/ sales related personal data, will be retained up to 4 years after the order

  • Contact data is stored indefinitely but we will consider all requests for its erasure

  • Financial records and invoices, which may include personal data, will be retained for 6 years after the end of the current tax year of processing

  • By exception, material that includes personal data may be retained by KT beyond the schedule by exception, and then only for a specific purpose and where KT believes it has a legitimate interest or a legal obligation to do so

At the end of the retention schedule KT will either return, destroy or delete your personal data and any associated emails, documentation or similar. If it is technically impractical to delete electronic copies of personal data, it will put it beyond operational use. KT allows up to 3 months after the retention schedule to complete this action. 

The KT website uses cookies (and similar technologies) but any non-essential cookies, if used, will require your permission before they are dropped. 

The website links to other websites of potential interest. Please be aware that KT has no responsibility for the processing of your personal data by these sites. 

The General Data Protection Regulation defines the rights that you have (although these do not apply in all situations); for convenience, these rights are shown below: 

  • Right to be informed as to how your personal data is being processed by us – this is done through this statement or specific privacy notices that may be issued separately

  • Right to access your personal data held by us which is done by making a ‘Data Subject Access Request’ (DSAR) to the PM

  • Right to rectification of your personal data if you believe KT has collected it incorrectly or it needs to be updated

  • Right to erasure of your personal data for which we no longer have a legitimate purpose to process it or where your interests outweigh our own

  • Right to restrict processing under certain circumstances, during which time your personal data will not be in operational use until the related matter is resolved

  • Right to data portability of your personal data in a machine-readable version, but this only applies to data provided with your consent or under contract

  • Right to object to KT processing your personal data for which there is no associated legal or contractual obligation

  • Rights related to automated decision making and profiling however KT does not use these techniques in its decision making

Further details on data subjects’ rights can be found on the Information Commissioner’s Office (ICO) website using https://ico.org.uk. 

Raising concerns, exercising rights or making queries about our processing of your personal data can be done by contacting the PM. Please be aware that we will need to verify your identity before responding fully, therefore, you may be asked for proof of your ID. Alternatively, you have the right to contact the ICO directly, using the details provided above, but naturally we welcome the first opportunity to handle any concerns you have. 

v1.0 

March 2022