PRIVACY POLICY

Last updated: 25 September 2026

Iron Raft Ltd respects your privacy and is committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and share personal information when you visit iron-raft.co.uk, purchase from us, create an account, subscribe to marketing, contact us or otherwise use our services.

Iron Raft Ltd is the data controller responsible for personal information processed for our own purposes.

Our details are:

Iron Raft Ltd
Company number: 10711064
Registered in England and Wales
4A Thornton Way
Girton
Cambridge
CB3 0NJ
United Kingdom

Email: info@iron-raft.co.uk

Personal Information We Collect

Depending on how you interact with us, we may collect:

Contact information

This may include:

• your name;
• email address;
• telephone number;
• billing address; and
• delivery address.

Order and transaction information

This may include:

• products purchased;
• order history;
• returns and exchanges;
• delivery details;
• transaction value;
• discounts used; and
• payment status.

Account information

Where you create an account, we may process information relating to your account, preferences and settings.

Passwords and authentication information may be processed through Shopify or other service providers operating our website.

Payment information

Payments are processed through third-party payment providers such as Shopify's payment services, Stripe or another payment option displayed at checkout.

We do not normally receive or store your complete payment card number or card security code.

We may receive limited payment information such as:

• the payment method used;
• payment confirmation;
• transaction identifiers;
• card type; and
• limited card information such as the final digits of a payment card.

Communications

If you contact us, we may retain your correspondence and information you provide to us, including customer service enquiries, complaints, returns and product questions.

Device and website information

When you visit our website, we and our service providers may collect information including:

• IP address;
• browser type;
• device information;
• approximate location derived from an IP address;
• pages viewed;
• referring website;
• products viewed;
• items added to a basket;
• interactions with our website; and
• information collected through cookies and similar technologies.

How We Collect Your Information

We may collect information:

• directly from you;
• when you place an order;
• when you create an account;
• when you contact us;
• when you subscribe to marketing;
• automatically when you use our website;
• from Shopify and our other service providers;
• from payment providers;
• from delivery and fulfilment providers; and
• from analytics, advertising or other business partners where legally permitted.

How and Why We Use Personal Information

We only process personal information where we have an appropriate legal basis.

Fulfilling our contract with you

We process information where necessary to:

• process and fulfil orders;
• take payment;
• arrange delivery;
• manage returns and refunds;
• provide customer service;
• communicate with you about an order; and
• administer your customer account.

Legal obligations

We may process and retain information where necessary to comply with legal, tax, accounting, consumer protection or regulatory obligations.

Legitimate interests

Where appropriate, we may process information where it is necessary for our legitimate business interests and those interests are not overridden by your rights.

These interests may include:

• operating and improving our business;
• improving our website;
• understanding how customers use our services;
• preventing fraud;
• maintaining security;
• responding to customer enquiries;
• managing disputes;
• protecting our legal rights; and
• keeping appropriate business records.

Consent

Where required, we rely on your consent for activities such as certain marketing communications, analytics technologies, advertising technologies or other non-essential cookies.

You can withdraw consent at any time.

Marketing Communications

We may send you information about Iron Raft products, offers, events or other relevant news where:

• you have consented to receive it; or
• we are otherwise permitted to contact you under applicable electronic marketing laws.

Where legally permitted, we may use the existing customer "soft opt-in" for marketing our own similar products or services, provided the applicable requirements have been met.

Every electronic marketing message will provide a way to unsubscribe.

You can also contact info@iron-raft.co.uk to change your marketing preferences.

Opting out of marketing does not prevent us from sending necessary service messages relating to your orders or account.

Cookies and Similar Technologies

Our website uses cookies and similar technologies.

Some cookies are strictly necessary for functions such as:

• operating the website;
• maintaining security;
• remembering your basket;
• processing checkout; and
• maintaining account sessions.

We may also use optional cookies or similar technologies for:

• analytics;
• measuring website performance;
• personalisation;
• advertising; and
• understanding how visitors use our website.

Where consent is legally required, non-essential cookies and similar technologies will only be used after you have provided the relevant consent.

You can manage available cookie choices using the cookie or privacy controls presented on our website.

Depending on our website configuration, third-party services such as Shopify and Google Analytics may also use cookies or similar technologies.

Shopify

Our online store is powered by Shopify.

Shopify processes information about visitors and customers in order to provide ecommerce, security, payment, checkout and other services.

Information submitted through our store may therefore be processed by Shopify and its service providers.

Depending on the Shopify services and features enabled on our store, Shopify may also process information for its own purposes in accordance with Shopify's own privacy terms.

Other Organisations We Share Information With

We do not sell customer databases.

We may disclose personal information where reasonably necessary to organisations including:

• Shopify;
• payment processors;
• banks and payment networks;
• delivery companies and couriers;
• fulfilment providers;
• website hosting and IT providers;
• analytics providers;
• marketing providers;
• accountants and professional advisers;
• insurers;
• fraud prevention and security providers;
• government, regulatory or law enforcement bodies where legally required; and
• prospective buyers or advisers in connection with a legitimate sale, restructuring or transfer of our business.

We only disclose information where there is an appropriate reason and legal basis for doing so.

International Transfers

Some of our service providers, including technology and ecommerce providers, may process information outside the United Kingdom.

Where personal information is transferred internationally, we will take appropriate steps as required by applicable data protection law. This may include relying on recognised adequacy regulations or approved contractual safeguards.

How Long We Keep Information

We do not retain personal information indefinitely.

The appropriate retention period depends on why the information was collected and our legal and business obligations.

For example:

• information forming part of accounting and transaction records will generally be retained for the period required under applicable tax and company law, which may be at least six years;
• customer service correspondence will be retained for as long as reasonably necessary to deal with the enquiry and any related legal issues;
• account information may be retained while the account remains active and for an appropriate period afterwards;
• marketing information may be retained until you unsubscribe or until it is no longer reasonably required; and
• suppression records may be retained so that we can honour an unsubscribe request.

We may retain information for longer where necessary for a legal claim, investigation or regulatory requirement.

Your Data Protection Rights

Depending on the circumstances, UK data protection law may give you rights including:

• the right to access personal information we hold about you;
• the right to have inaccurate information corrected;
• the right to request deletion of information in certain circumstances;
• the right to request restriction of processing;
• the right to object to certain processing;
• the right to data portability in certain circumstances; and
• the right to withdraw consent where processing is based on consent.

You have the right to object to the use of your personal information for direct marketing at any time.

These rights are not absolute and may be subject to legal exemptions.

To exercise your rights, contact:

info@iron-raft.co.uk

We may need to verify your identity before fulfilling a request.

Complaints

If you are unhappy with how we use your personal information, please contact us first so that we have an opportunity to investigate.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator.

Security

We use reasonable technical and organisational measures intended to protect personal information.

However, no website, electronic communication or information storage system can be guaranteed to be completely secure.

You are responsible for keeping any account password or other authentication information confidential.

Children's Information

Our website and services are not specifically directed at children and we do not knowingly seek to collect children's personal information where it is not appropriate to do so.

If you believe a child has provided personal information to us inappropriately, please contact us.

Third-Party Websites

Our website may contain links to websites operated by other organisations.

Those organisations are responsible for their own privacy practices. You should review their privacy information before providing personal information to them.

Changes to this Privacy Policy

We may update this Privacy Policy where our practices, technology or legal obligations change.

The latest version will be published on our website with an updated revision date.

Contact Us

For questions about this Privacy Policy or the way we process personal information:

Iron Raft Ltd
4A Thornton Way
Girton
Cambridge
CB3 0NJ
United Kingdom

Email: info@iron-raft.co.uk