Privacy Policy
Last updated: July 2026. Official terms and guidelines for Helionis Limited.
*Last updated: July 2026*
1. Who We Are
Helionis Limited ("we", "us", "our") is the data controller for personal data collected through this website and our trade and retail sales channels.
- Registered office: 77 Oakbank, New Addington, Croydon, CR0 9EF, United Kingdom
- Company number: 17338437 (incorporated 14 July 2026)
- Contact for data protection queries: [To Be Updated — dedicated privacy/DPO contact email]
2. What Data We Collect
| Category | Examples |
|---|---|
| Identity & contact data | Name, email address, phone number, delivery and billing address |
| Order & transaction data | Order history, payment confirmation (not full card details — see Section 8), invoices |
| Trade account data | Company name, company registration number, VAT number, business type |
| Account data | Login credentials (if an account system is introduced), saved addresses, wishlist, order history |
| Communications | Contact form submissions, support/technical queries, email correspondence |
| Technical/usage data | IP address, browser type, device type, pages visited, referral source (via analytics — see Section 4) |
| Marketing preferences | Newsletter subscription status and consent record |
3. Why We Collect It (Purpose)
- Processing and fulfilling your order (retail or trade).
- Verifying trade account applications (company registration, VAT validation).
- Providing customer support and handling warranty/returns claims.
- Meeting our legal, tax and accounting obligations.
- Sending order-related communications (confirmation, dispatch, delivery updates).
- Where you've opted in: sending marketing/newsletter communications.
- Improving the website through aggregated, where possible anonymised, usage analytics.
4. Cookies and Analytics
We use cookies to operate the website (essential cookies) and, where consented, to understand site usage (analytics cookies). Full detail is in our separate Cookie Policy.
Google Analytics (or equivalent): [To Be Confirmed — name the actual analytics provider once selected]. If used, this involves data being processed by that provider under their own privacy terms; we configure analytics to minimise personal data collection (e.g. IP anonymisation) where the provider supports it, and analytics cookies are not set until you consent via the cookie banner.
5. Contact Forms
Data submitted via our Contact, Trade Account Application, Quote Request, Bulk Order Enquiry, Become a Supplier, and Technical Support forms is used solely to respond to your enquiry and, where you proceed, to set up the relevant account or order. It is not used for unrelated marketing unless you separately opt in.
6. Newsletter
Newsletter sign-up is opt-in only (via the footer subscription form). You can unsubscribe at any time using the link in any newsletter email, or by contacting us directly. We do not add addresses to the newsletter list from order/account data without separate, explicit consent.
7. Accounts
If you create a customer account, we hold the account data necessary to operate it (order history, saved addresses, preferences). You can request a copy or deletion of this data at any time — see Section 12.
8. Payments
Payment card details are processed directly by our payment processor ([To Be Confirmed — name the actual PCI-DSS-compliant processor once selected]) and are not stored on Helionis Limited's own systems. We retain only the transaction confirmation and amount needed for order and accounting records, not full card details.
9. Legal Basis for Processing
| Purpose | Legal basis (UK/EU GDPR) |
|---|---|
| Order processing and fulfilment | Contract performance (Art. 6(1)(b)) |
| Trade account verification | Contract performance / legitimate interest (fraud and compliance prevention) |
| Tax and accounting records | Legal obligation (Art. 6(1)(c)) |
| Marketing/newsletter communications | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Website analytics | Consent (where cookie-based) or legitimate interest (where using privacy-preserving, non-cookie methods) |
| Fraud prevention and sanctions screening | Legal obligation / legitimate interest |
10. Retention Periods
| Data type | Retention period |
|---|---|
| Order and invoice records | 6 years (standard UK accounting record requirement) |
| Trade account KYC/verification records | 6 years from account closure, or as required by applicable AML guidance |
| Marketing consent records | Until consent is withdrawn |
| Contact form enquiries (no resulting order/account) | [To Be Confirmed — recommend 12–24 months unless a legal basis for longer retention applies] |
| Website analytics data | As set by the analytics provider's default retention, or a shorter period we configure |
11. International Transfers
Where we or our service providers (e.g. payment processor, email/newsletter platform, analytics provider) transfer personal data outside the UK/EEA, this is done under an appropriate safeguard (e.g. UK International Data Transfer Agreement, EU Standard Contractual Clauses, or an adequacy decision covering the destination country). [To Be Confirmed — list actual third-party processors and their transfer mechanism once finalised, rather than describing this generically.]
12. Your Rights
Under UK GDPR (and EU GDPR, for customers in our EU sourcing/delivery markets), you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data ("right to be forgotten"), subject to our legal obligation to retain certain records (e.g. accounting records for 6 years).
- Restrict or object to certain processing.
- Data portability, where technically feasible.
- Withdraw consent at any time for consent-based processing (e.g. marketing).
- Complain to the UK Information Commissioner's Office (ICO) or your local EU data protection authority.
To exercise any of these rights, contact us at [To Be Updated — dedicated privacy contact email] with your request; we will respond within the statutory timeframe (one month under UK/EU GDPR, extendable in limited circumstances).
13. Data Deletion
Where you request deletion and no legal retention obligation applies, we will delete your personal data within [To Be Confirmed — set an operational SLA, e.g. 30 days] of a verified request. Where a retention obligation does apply (e.g. accounting records), we will restrict further use of the data beyond that legal purpose rather than actively using it, and delete it once the retention period expires.
Developer note — do not publish with unresolved brackets. Every `[To Be Confirmed]` / `[To Be Updated]` marker above corresponds to a real operational decision (which analytics tool, which payment processor, which email platform, the DPO/privacy contact address) that must be made before this page goes live — a privacy policy describing services that don't actually exist, or omitting ones that do, is a compliance risk in itself, not just a content-accuracy issue.