Privacy Policy
/privacyHow Spiral Direct Ltd handles personal data in connection with the trade portal at spiraldata.co.uk. This portal is business-to-business, but the named people who work at those businesses are still data subjects, and this policy covers them.
1. Who we are
Spiral Direct Ltd, Spiral House, 29–35 Gladstone Road, Croydon, Surrey, CR0 2BQ, is the data controller for personal data processed through this portal.
| Detail | Value |
|---|---|
| Company registration number | 03713667 |
| VAT number | GB731101985 |
| ICO registration number | Z3179802 |
| Contact for data matters | contact@spiraldata.co.uk |
| Postal address | Spiral House, 29–35 Gladstone Road, Croydon, Surrey, CR0 2BQ |
2. What we collect
Account application. Company name, trading name, company registration number, VAT number, EORI number, trading address, delivery address, business type, website or storefront links, years trading, estimated annual spend and trade references.
Named contacts. Name, job title, work email address and work telephone number for the people who use the account.
Account activity. Orders and order history, saved size curves, saved lists, invoices, payments, credit position and correspondence about specific orders.
Technical data. IP address, browser and device information, login timestamps and the pages viewed within the portal.
Communications. Emails and support messages exchanged with our sales and accounts teams.
3. Why we use it, and our lawful basis
| Purpose | Data used | Lawful basis |
|---|---|---|
| Operating the trade account, processing and dispatching orders, invoicing and collecting payment | Application, contacts, account activity | Performance of a contract |
| Credit assessment and setting or reviewing credit limits | Company identifiers, trade references, payment history | Legitimate interests — trading on credit without assessing risk is not sustainable |
| Fraud prevention and portal security | Technical data, login records | Legitimate interests — protecting the portal and trade pricing |
| Statutory accounting and tax records | Orders, invoices, payments | Legal obligation |
| Customs and export documentation for shipments outside the UK | Company identifiers, EORI and VAT numbers, delivery addresses | Legal obligation |
| New-season and clearance announcements | Contact name and work email | Consent, or legitimate interests where PECR allows for corporate subscribers |
On marketing specifically: PECR treats corporate subscribers differently from individuals. Where the account holder is a limited company or a limited liability partnership, we may send trade announcements on the basis of legitimate interests, and every message carries a one-click unsubscribe. Where the account holder is a sole trader or an unincorporated partnership, we rely on consent, taken as a separate opt-in at application and confirmed by a double opt-in email. We record the timestamp, IP address, form URL and the version of the consent wording shown.
4. Who we share it with
- Payment provider — card and bank payment processing.
- Credit reference agency — company credit checks at application and on periodic review.
- Carriers and couriers — the delivery address, contact name and telephone number needed to deliver, and nothing further.
- Customs agents — company identifiers, EORI and VAT numbers and commercial invoice data for shipments outside the UK.
- Amazon Web Services — hosting, and email delivery through Amazon SES for order, dispatch, statement and announcement email.
- Accounting software provider — invoices, credit notes and payment records.
- Professional advisers, auditors and, where we are required to, HMRC, law enforcement or a court.
We do not sell personal data, we do not share it with other stockists, and we do not use it to build advertising profiles.
5. International transfers
Our hosting and email processing take place in the United Kingdom and the European Economic Area. Where a processor accesses data from outside the UK — for support or engineering purposes — the transfer is covered either by UK adequacy regulations, or by the International Data Transfer Addendum to the EU Standard Contractual Clauses together with a transfer risk assessment. A copy of the safeguard used for any named processor is available on request.
6. How long we keep it
| Record | Retention period |
|---|---|
| Account and order records, invoices and statements | 6 years after the account closes, for accounting and limitation purposes |
| Unsuccessful account applications | 12 months from the decision |
| Marketing consent and unsubscribe records | The life of the consent, plus 2 years |
| Portal access and login logs | 12 months |
| Support correspondence | 3 years |
| Suppression list of bounced or complained addresses | Kept indefinitely — deleting it would cause us to email the address again |
7. Your rights
You have the right to access the personal data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent to marketing at any time. Withdrawing marketing consent has no effect on order, dispatch, backorder or statement email, which we send to operate your account.
To exercise any of these, write to us at the contact address in section 1. We respond within one month. Some rights are qualified: we cannot erase records we are required to keep for accounting or customs purposes until those periods expire.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone 0303 123 1113, ico.org.uk. We would rather you raised it with us first.
8. Security
- Access to the portal is by named user credentials. Shared logins are discouraged; each user at an account can have their own.
- Trade prices and stock figures are visible only after authentication and are never rendered to a logged-out visitor.
- The portal is excluded from search engine indexing and carries noindex, nofollow directives.
- Data is encrypted in transit with TLS and at rest.
- Access to account data inside Spiral is limited to the sales, accounts and warehouse staff who need it, and is logged.
9. Changes to this policy
The version number and effective date are shown at the top of this page. Where a change materially affects how we use personal data, we email account holders before it takes effect and keep the previous version available on request.