1. Who we are
SPX Brands UK Pvt Ltd (trading as PolarX Ornaments) is the data controller for personal data collected through this website. Our registered office is The Oakley, Kidderminster Road, Droitwich, Worcestershire, WR9 9AY, United Kingdom. Our ICO registration reference is [ICO data-protection registration number — to be confirmed].
Questions about this policy or your data can be sent to info@polarxornaments.co.uk.
2. What we collect
When you create an account or place an order we collect:
- Account data: name, business name, email address, phone number, billing & delivery address.
- Order data: products ordered, quantities, prices, delivery instructions, order history.
- Payment data: card payments are processed directly by Stripe; we do not store your full card number. We retain the last four digits, card brand and expiry to identify saved cards.
- Communications: emails you send us and our replies.
- Technical data: IP address, browser type, pages viewed, and cookies (see our Cookie Policy).
3. Why we use it & legal basis
- To fulfil orders — performance of a contract.
- To manage your account & provide support — performance of a contract.
- To send transactional email (order confirmations, dispatch notifications, sign-in codes) — performance of a contract.
- To prevent fraud and meet our legal obligations (e.g. tax records) — legal obligation and legitimate interests.
- To send marketing email about new products and seasonal ranges — only with your consent, which you can withdraw at any time.
4. Who we share data with
We share data only with the processors needed to run the service:
- Stripe — card payment processing (PCI-DSS Level 1).
- Postmark — transactional email delivery.
- Order Desk — order management and fulfilment.
- Couriers — to deliver your order.
- Replit — website hosting and database.
We do not sell your personal data and never share it with third parties for their own marketing.
5. International transfers
Some of our processors are based outside the UK/EEA (notably in the United States). Where this is the case we rely on adequacy decisions or on Standard Contractual Clauses approved by the UK Information Commissioner.
6. How long we keep it
Account data is retained while your account is active. Order, invoice and tax records are kept for at least 6 years after the end of the relevant accounting period to meet HMRC requirements. Marketing consent is kept until you withdraw it.
7. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased (subject to our legal obligations);
- restrict or object to certain processing;
- request a portable copy of your data;
- withdraw consent for marketing at any time;
- complain to the Information Commissioner's Office — ico.org.uk.
To exercise any of these rights, email info@polarxornaments.co.uk.
8. Security
Connections to our site are encrypted in transit (TLS). We use passwordless sign-in — a one-time code is emailed to you each time you log in, so there is no password to store or leak. Card details are tokenised by Stripe and never reach our servers.
9. Changes
We will update this page when our practices change. The "Last updated" date at the top tells you when it was last revised.