Privacy Policy

1. Who we are

AR CART LTD, company number 17426784, registered in England and Wales at 8 Sommerville Avenue, Manchester, M9 4LZ, United Kingdom ("we", "us", "our"). We operate the website at arcartltd.co.uk.

We are the data controller for personal information you provide when using this website. Contact us at ahad@arcartltd.co.uk.

2. What data we collect

• Account data: name, email address and password hash when you register.
• Order data: name, email, phone (optional), delivery address, and order contents when you place an order.
• Payment data: card and payment details are processed directly by our payment provider (Stripe). We store only a payment reference — never full card numbers.
• Communications: email address if you subscribe to our newsletter.
• Usage data: standard web server logs (IP address, browser type, pages visited) which may be retained for security and analytics purposes.

3. How we use your data

• To process and fulfil your orders (contract performance).
• To create and manage your account (contract performance).
• To send order confirmations and transactional emails (contract performance).
• To send marketing emails if you have subscribed (legitimate interest / consent).
• To improve our website and detect fraud (legitimate interest).
• To comply with legal obligations.

4. How we share your data

We share your data only where necessary:

• Payment processors (Stripe / PayPal) to process transactions securely.
• Delivery providers to fulfil your orders.
• IT service providers that host and maintain our platform.

We do not sell your personal data to third parties.

5. Cookies

We use a single secure, HttpOnly session cookie (arcart_session) for authentication. This cookie contains only a session ID — no personal data. We do not use third-party tracking or advertising cookies.

6. Data retention

We retain your account data for as long as your account is active or as needed to provide services. Order records are kept for at least 7 years to comply with UK tax law. You may request deletion of your account data by emailing us.

7. Your rights (UK GDPR)

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request erasure (where no legal obligation requires us to retain it).
• Object to processing based on legitimate interests.
• Withdraw marketing consent at any time.
• Lodge a complaint with the ICO (ico.org.uk).

To exercise these rights contact us at ahad@arcartltd.co.uk.

8. Security

We use industry-standard security measures including HTTPS, bcrypt password hashing, and secure session management. No internet transmission is 100% secure; we cannot guarantee absolute security.

9. Changes to this policy

We may update this policy. Material changes will be notified by email or by a prominent notice on our website.