1. Who we are
We are Daphney Healthcare Ltd, a company registered in [England and Wales] with company number [NUMBER], whose registered office is at [REGISTERED ADDRESS]. Our VAT number is [VAT NUMBER]. We are the controller of the personal data described in this notice. We are registered with the Information Commissioner’s Office (ICO), registration number [ICO REGISTRATION NUMBER].
For any question about this notice or your data, contact [DATA PROTECTION CONTACT NAME] at [PRIVACY EMAIL] or write to the address above.
2. The data we collect
- Account and contact details: name, email, phone, organisation and job title.
- Orders and payments: products ordered, delivery and billing addresses, purchase order numbers and payment status. Card details are handled by our payment provider and are not stored by us.
- Trade account applications: organisation details, contacts, invoice address and information used for credit checks.
- Bookings: site address, contact, equipment details and inspection reports for LOLER examinations and furniture surveys.
- Enquiries and forms: what you tell us in contact, quote, safety alert and job application forms.
- VAT relief declarations: the name of the person the products are for and a description of their condition. This is health information and is treated as special category data.
- Website use: basket contents, saved preferences and technical data such as device and browser type. See our cookie policy.
3. How we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Processing orders, deliveries, returns and bookings | Contract |
| Running trade accounts, invoicing and credit control | Contract; legitimate interests in managing credit risk |
| Keeping accounting and tax records, including VAT relief declarations | Legal obligation. For health information in a VAT declaration: [condition under Article 9 UK GDPR and Schedule 1 DPA 2018, to be confirmed with your adviser] |
| Product traceability, safety notices and recalls | Legal obligation; legitimate interests in product safety |
| Answering enquiries and providing customer service | Legitimate interests; contract where you are a customer |
| Sending safety alerts and marketing emails you have asked for | Consent, which you can withdraw at any time |
| Recruitment | Steps before a contract; legitimate interests |
| Keeping the website secure and working | Legitimate interests |
4. Who we share it with
We share personal data only where needed, with:
- our website, ecommerce and booking platform provider (Wix.com), which hosts this site and processes orders on our behalf;
- payment providers, to take payments securely;
- couriers and delivery partners, to deliver your order;
- manufacturers and regulators such as the MHRA, where needed for a safety notice or recall;
- our accountants, auditors, insurers and professional advisers;
- HM Revenue and Customs and other authorities where the law requires.
We do not sell personal data.
5. International transfers
Some of our providers process data outside the UK. Where this happens, we rely on UK adequacy regulations or use the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with any additional safeguards needed.
6. How long we keep it
| Data | Retention |
|---|---|
| Orders, invoices and VAT records | 6 years from the end of the financial year |
| Medical device traceability records | [Period required by the manufacturer or regulation] |
| LOLER examination reports | [At least 2 years, or until the next report] |
| Website accounts | Until you close your account, then [period] |
| Enquiries | [2 years] from our last contact |
| Unsuccessful job applications | [6 months] after the role is filled |
| Safety alert subscriptions | Until you unsubscribe |
7. Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have data erased in some circumstances;
- restrict or object to our use of your data;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
We do not make decisions about you based solely on automated processing.
To make a request, use our online contact form and choose data protection as your subject, or email [PRIVACY EMAIL]. We respond within one month, and may extend this by up to two further months for complex requests, in which case we will tell you why.
8. Complaints
If you are unhappy with how we have used your personal data, please tell us first so that we can put it right. You can complain using our online contact form, by email to [PRIVACY EMAIL] or by post.
- We acknowledge your complaint within 30 days of receiving it.
- We investigate it and keep you informed of progress.
- We tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. The ICO usually expects you to have raised the complaint with us first.
9. Security and changes
We use appropriate technical and organisational measures to protect personal data, including access controls, encrypted connections and staff training. We review this notice regularly and will post any changes on this page.
Questions about this page?
Call [PHONE], email [EMAIL] or write to Daphney Healthcare Ltd, [REGISTERED ADDRESS].