Privacy policy

PRIVACY POLICY

Last updated: June 2026

This Privacy Policy explains how Serraphea Limited ("we", "us", "our") collects, uses, shares, and protects your personal data when you visit our website or use our services. We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

Serraphea Limited

Company Number: 78544783

Registered Office: Office 3906, 39th The CTR 99, Queen's Road Central, Central, Hong Kong

Email: support@serraphea.com

We are the data controller responsible for your personal data within the meaning of the UK GDPR.

2. Our UK Representative

As Serraphea Limited is established outside the United Kingdom, we have appointed a UK representative in accordance with Article 27 of the UK GDPR.

3. What Data We Collect

We collect the following categories of personal data:

  • Identification data: name, email address, telephone number, delivery and billing address

  • Order and payment data: products ordered, purchase history, amounts, payment method (full payment details are processed directly by our payment providers and are not retained by us)

  • Account data: username, encrypted password, preferences, language

  • Technical and navigation data: IP address, browser type, operating system, pages visited, duration of visits, traffic source

  • Communication data: correspondence by email, contact forms, conversations with customer service

  • Cookies and similar identifiers: see Section 7

We do not process any special category data (health, ethnicity, opinions, etc.) and we do not knowingly collect data from anyone under 16 years of age.

4. Why We Use Your Data and on What Legal Basis

Purpose

Legal basis

Processing and delivering your order, managing your customer account

Performance of contract — UK GDPR Art. 6(1)(b)

Customer service, handling complaints and returns

Performance of contract — UK GDPR Art. 6(1)(b)

Accounting, tax, and legal obligations

Legal obligation — UK GDPR Art. 6(1)(c)

Fraud prevention and site security

Legitimate interests — UK GDPR Art. 6(1)(f)

Site improvement and analytics

Legitimate interests — UK GDPR Art. 6(1)(f)

Direct marketing (promotional emails, newsletters)

Consent — UK GDPR Art. 6(1)(a)

Non-essential cookies (advertising, analytics)

Consent — PECR + UK GDPR Art. 6(1)(a)

5. Who We Share Your Data With

We share your data only with the following categories of recipients, and only to the extent necessary:

  • E-commerce platform and hosting: Shopify Inc. (site hosting, order management)

  • Payment providers: PayPal (Europe) S.à r.l. and Shopify Payments — who process your payment data directly under their own privacy policies

  • Carriers and delivery services: depending on your order

  • Marketing and communication tools: only with your consent (email marketing, advertising retargeting where applicable)

  • Public authorities: only when required by law (judicial requests, tax obligations, etc.)

  • In case of business merger or acquisition: your data would be transferred under the same protections set out in this policy

We never sell your personal data to third parties.

6. How Long We Keep Your Data

Category of data

Retention period

Order and billing data

6 years after the order (UK accounting and tax obligations)

Customer account data

For the lifetime of the account + 3 years after last activity

Marketing prospect data (consent-based)

Until consent is withdrawn, or 3 years after last contact

Cookies

As set out in our Cookie Policy (maximum 13 months for non-essential cookies)

Navigation data (technical logs)

Maximum 12 months

Customer service correspondence

3 years after last interaction

Beyond these periods, your data is deleted or anonymised.

7. Cookies

Our site uses cookies to ensure proper functioning, analyse traffic, and — subject to your consent — provide personalised content. You can review and manage your preferences at any time through our cookie banner or your browser settings.

For further details, please consult our dedicated Cookie Policy [link to be added].

8. International Data Transfers

Your data may be processed outside the United Kingdom in the following cases:

  • In Hong Kong (Serraphea Limited's registered office): Hong Kong is not currently subject to a UK adequacy decision. Transfers to Hong Kong are therefore protected by appropriate safeguards under the UK GDPR, specifically the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

  • Other non-UK providers (for example, certain cloud services): we put in place appropriate safeguards as required by the UK GDPR.

You may request a copy of these safeguards by contacting us at support@serraphea.com.

9. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, disclosure, or destruction: encryption of transmissions (HTTPS/TLS), access controls, regular backups, and selection of UK GDPR-compliant partners.

10. Automated Decision-Making

We do not use any fully automated decision-making process that produces legal effects on you. Some fraud-prevention tools (used for example by Shopify or PayPal) may carry out automated risk assessments; in that case, you may contact us to request a human review.

11. Your Rights

Under the UK GDPR, you have the following rights:

  • Right of access to your personal data

  • Right to rectification of inaccurate data

  • Right to erasure ("right to be forgotten"), under certain conditions

  • Right to restriction of processing

  • Right to object to processing based on legitimate interests

  • Absolute right to object to direct marketing (UK GDPR Art. 21(2)) — you may at any time object to receiving commercial communications, without needing to justify your request

  • Right to data portability

  • Right to withdraw consent at any time, without affecting the lawfulness of prior processing

To exercise these rights, send your request to support@serraphea.com or to our UK representative (see Section 2). We may ask you for proof of identity before processing your request and will respond within one month.

12. Complaints

If you believe we are not respecting your rights, you may lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)

Website: https://ico.org.uk

Phone: 0303 123 1113

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

We encourage you to contact us first so that we can try to resolve any issue directly.

13. Changes to This Policy

This policy may be updated to reflect legal or operational changes. The date of last update is shown at the top of this page. We invite you to consult it regularly.

14. Contact

For any question regarding this Privacy Policy:

  • Email: support@serraphea.com

  • Post: Serraphea Limited, Office 3906, 39th The CTR 99, Queen's Road Central, Central, Hong Kong