Privacy Policy & Data Protection Notice

1. Introduction & Important Information

This privacy notice provides you with details of how DA Supermart Ltd collects and processes your personal data through your use of our site https://dasupermartltd.co.uk, including any data you may provide when you browse, create an account, make an enquiry, or place an order.

We adhere strictly to the principles of lawful, fair, and transparent data processing established by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

2. The Data Controller

DA SUPERMART LTD is the data controller responsible for your personal data (referred to as "we", "us", or "our" in this privacy policy).

3. The Categories of Personal Data We Collect

Personal data, or personal information, means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data about you, grouped as follows:

• Identity Data: includes title, first name, last name, username, or similar identifier.
• Contact Data: includes billing address, delivery address, email address, and telephone contact numbers.
• Financial Data: payment card tokens and transaction identifiers. We do not capture or store raw credit/debit card numbers on our servers; payments are processed securely through PCI-DSS Level 1 compliant gateways.
• Transaction Data: includes details about payments to and from you and full records of products purchased, order dates, parcel tracking references, and returns history.
• Technical Data: includes Internet Protocol (IP) address, login data, browser type and version, time zone setting and geographical location, operating system and platform, and other browser technologies.
• Profile Data: includes your username, password (cryptographically hashed), purchases or orders made by you, your feedback, and sizing queries.
• Usage Data: includes information about how you navigate and interact with our website, catalogue pages, and shopping cart.
• Marketing and Communications Data: includes your preferences in receiving marketing updates from us and your communication preferences.

4. How We Collect Your Personal Data

We use various methods to collect data from and about you, including through:

• Direct Interactions: You may provide us with your Identity, Contact, and Financial Data by filling in forms on our Website, completing checkout, setting up an account, using our Track Your Order page, or corresponding with our support team by email.
• Automated Technologies or Interactions: As you navigate through our Website, we automatically collect Technical Data about your equipment, browsing actions, and patterns using cookies, server logs, and similar technologies. Please refer to our Cookie Policy for detailed explanations.
• Third Parties and Publicly Available Sources: We may receive personal data about you from technical payment processors (such as Stripe, PayPal, or card acquirers), fraud-prevention databases, and delivery logistics partners (such as Royal Mail, DPD, or Evri) regarding parcel tracking and successful delivery status.

5. Lawful Bases for Processing (Article 6 UK GDPR)

We will only process your personal data when the law allows us to. Most commonly, we rely on the following lawful bases:

• Performance of a Contract (Article 6(1)(b)): Where processing is necessary for the performance of a sales contract to which you are a party (e.g. processing your order, collecting payment, dispatching your leather jacket, providing delivery tracking, and handling returns).
• Legal Obligation (Article 6(1)(c)): Where we need to comply with a legal or regulatory obligation (e.g. maintaining tax, invoicing, and accounting records for HMRC, consumer rights compliance, and fraud reporting).
• Legitimate Interests (Article 6(1)(f)): Where it is necessary for our legitimate commercial interests (or those of a third party) and your interests and fundamental rights do not override those interests (e.g. fraud detection, website security, network monitoring, customer service improvement).
• Consent (Article 6(1)(a)): Where you have provided unambiguous consent for specific processing, such as subscribing to our optional email newsletter or consenting to non-essential analytical cookies. You can withdraw consent at any time.

6. Purposes for Which We Use Your Personal Data

7. Disclosures of Your Personal Data (Third-Party Service Providers)

We may share your personal data with trusted third-party service providers acting on our behalf to operate our store. We require all third parties to respect the security of your personal data and treat it in accordance with the law:

• Courier & Delivery Partners: We share your recipient name, delivery address, postal code, and contact email/phone with Royal Mail Tracked, DPD Local, or Evri solely to transport and deliver your parcels and send tracking dispatch notifications.
• Payment Service Gateways: Payment processors (such as Stripe, PayPal, Apple Pay, Google Pay) receive transaction tokens and billing addresses to authenticate card payments and execute 3D Secure fraud screening.
• Technical Hosting & Server Infrastructure: Our secure web servers (LiteSpeed infrastructure) store website databases and order records under strict access controls.
• Professional Advisers & Regulators: We may disclose records to accountants, auditors, lawyers, or HMRC where strictly required by law or legal proceedings.

8. International Data Transfers

We prioritize storing and processing your personal data within the United Kingdom and European Economic Area (EEA). Wherever our service providers transfer data outside the UK, we ensure a similar degree of protection is afforded by ensuring at least one of the following safeguards is implemented:

• The destination country has been deemed to provide an adequate level of protection for personal data by the UK Government.
• Specific contracts approved by the UK Information Commissioner's Office (ICO), including the UK International Data Transfer Addendum (IDTA) or Standard Contractual Clauses (SCCs), are implemented.

9. Data Security & Encryption

We have put in place appropriate technical and organizational security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorized way, altered, or disclosed. All communication between your browser and our store is encrypted using 256-bit SSL (Transport Layer Security) technology. Access to customer records is restricted to authorized personnel who have a genuine business need to know.

10. Data Retention Periods

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, tax, or reporting requirements:

• Order & Invoicing Data: By UK law (HMRC requirements), we must keep basic information about our customers (including Contact, Identity, Financial, and Transaction Data) for six full statutory tax years following the date of purchase.
• Customer Support Inquiries: Inquiries submitted via our contact form or email are retained for up to 24 months to assist with any follow-up sizing, warranty, or consumer rights queries.
• Inactive Customer Accounts: Account data is retained until you request account closure or following 3 years of continuous inactivity.

11. Your Statutory Legal Rights Under UK GDPR

Under UK data protection law, you have enforceable legal rights regarding your personal data:

• Right of Access (Subject Access Request): You have the right to request a copy of the personal data we hold about you and to verify that we are lawfully processing it.
• Right to Rectification: You have the right to request correction of any incomplete or inaccurate data we hold about you.
• Right to Erasure ("Right to be Forgotten"): You have the right to ask us to delete or remove personal data where there is no good reason for us continuing to process it (subject to statutory tax retention obligations).
• Right to Object: You can object to the processing of your personal data where we rely on legitimate interests or where data is processed for direct marketing.
• Right to Restrict Processing: You can ask us to suspend the processing of your personal data in certain scenarios (e.g. while accuracy is established).
• Right to Data Portability: You have the right to receive your personal data in a structured, commonly used, machine-readable format.
• Right to Withdraw Consent: Where you provided consent for marketing or cookies, you have the right to withdraw that consent at any time.

12. How to Exercise Your Rights

If you wish to exercise any of the rights set out above, please email us at hello@dasupermartltd.co.uk. You will not have to pay a fee to access your personal data (or to exercise any other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). We respond to all legitimate requests within one calendar month.

13. Third-Party Websites and External Links

Our website may include links to third-party websites, plug-ins, and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

14. Children's Privacy

Our Website and Goods are directed exclusively at individuals aged 18 and older. We do not knowingly collect personal data relating to children.

15. Right to Lodge a Complaint with the ICO

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues:

We would, however, appreciate the opportunity to deal with your concerns before you approach the ICO, so please contact us in the first instance at hello@dasupermartltd.co.uk.

16. Changes to This Privacy Notice

We keep our Privacy Notice under regular review. Any changes we make in the future will be posted on this page with an updated revision date.

17. Contact Details