Privacy Policy

This policy explains what personal data expanseElectronics® Ltd ("we", "us", "our") collects, why we collect it, who else sees it, and what rights you have in relation to it. We aim to keep this short and accurate. If anything below is unclear or you'd like more detail, email us at [email protected].

Who we are

expanseElectronics® Ltd is the data controller for personal data collected through our website and online store. Our company details are at the bottom of this page. The contact for any privacy-related question or request is [email protected].

What data we collect, and why

Who else sees your data

We use a small number of third-party processors to run the website and store. Each only receives the data it needs:

Ecwid (storefront)

The shop on our homepage is provided by Ecwid (operated by Lightspeed Commerce). When you place an order, your name, email, shipping and billing address, and order details are processed by Ecwid on our behalf. Ecwid sets cookies on your browser to remember your shopping cart between page loads — these are essential cookies and do not require consent under PECR.

Stripe (payment processor)

Card payments are taken by Stripe via Stripe-hosted Payment Links. When you pay, you are interacting with Stripe directly — we never see your card number, expiry, or CVC. Stripe shares with us the billing email and the result of the transaction (succeeded / failed) so we can match the payment to your order. For UK and EU customers, the Stripe entity is Stripe Payments Europe Limited (Ireland).

Formspree (contact form)

Submissions of the contact form on our homepage are processed by Formspree, a US-based service. Formspree forwards each submission to our support email and stores it in their dashboard so we don't lose anything. The data covered by international transfer to Formspree is whatever you put into the form — typically your name, email, and message.

Plausible Analytics

Page-view analytics are provided by Plausible (an EU-based service, Estonia). Plausible was chosen specifically because it does not use cookies, does not store any personal data, does not fingerprint visitors, and does not share data with third parties. The only data sent is the page URL, the referrer (if any), the visitor's country (geolocated from IP), and basic device/browser type — all aggregated and anonymous. The visitor's IP is hashed and not retained.

Web hosting

Our website is hosted on DigitalOcean infrastructure. The web server logs each request (IP, timestamp, URL, status code, user agent) for security and debugging. Logs are rotated automatically.

Cookies

The website itself sets only essential cookies via Ecwid (to remember your shopping cart). Plausible Analytics is cookieless. We do not use any tracking, advertising, or social-media cookies. Because we do not set any non-essential cookies, no consent banner is required under PECR / UK GDPR.

How long we keep your data

• Order records (name, address, order details, payment confirmation): 7 years from the date of the order. This matches HMRC's record-keeping requirement for UK businesses.
• Contact-form submissions: 7 years, in line with general business correspondence retention.
• Web server logs: rotated automatically after a short period (typically 14 days).
• Plausible Analytics: aggregated, anonymous statistics retained by the analytics service for as long as we use the service. No personal data is held.

Where data is held by a third-party processor (Ecwid, Stripe, Formspree, Plausible), retention is also subject to that processor's own retention policy.

International transfers

Some of our processors are based outside the United Kingdom — Stripe (Ireland, EU), Formspree (United States), and Plausible (Estonia, EU). Transfers to EU countries are covered by the UK's adequacy decision for the EU. Transfers to the United States are covered by the UK's data bridge for the EU–US Data Privacy Framework, where the recipient is certified, or by Standard Contractual Clauses (SCCs).

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Rectify data that is inaccurate or incomplete
• Erase data we hold (subject to our legal obligation to keep order records for 7 years)
• Restrict our processing of your data
• Object to processing based on legitimate interests
• Portability — receive your data in a machine-readable format
• Withdraw consent at any time, where we rely on consent

To exercise any of these rights, email [email protected]. We will respond within one calendar month.

Complaints

If you are unhappy with how we have handled your personal data, you can complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):

• Online: ico.org.uk/make-a-complaint
• Phone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We'd appreciate the opportunity to address any concerns directly first if you haven't already raised the issue with us.

Changes to this policy

We may update this policy from time to time — for example if we change processors, add a new feature that collects different data, or if the law changes. Material changes are flagged in the "last updated" date at the top of this page. We don't keep a running version history, but we'll only ever change the policy in a forward direction; existing data continues to be handled under the policy that was in force when it was collected.