Last updated: [PLACEHOLDER - REVIEW BEFORE GO-LIVE] DATE

1. Who We Are

• Estia Distribution Ltd
• Registered address: [PLACEHOLDER - REVIEW BEFORE GO-LIVE] registered address
• Company number: [PLACEHOLDER - REVIEW BEFORE GO-LIVE] company number
• VAT number: [PLACEHOLDER - REVIEW BEFORE GO-LIVE] VAT number when registered
• Data Controller contact: privacy@estiaco.uk

2. What Data We Collect

• Account data: name, email, phone, business name, address.
• Order data: products ordered, quantities, delivery addresses, order history.
• Payment data: payment method, transaction references (no card data stored — processed by GoCardless).
• Communication data: support conversations, email correspondence.
• Technical data: IP address, browser type, login timestamps.
• Compliance data: allergen preferences, delivery instructions.

3. Legal Basis for Processing (UK GDPR Art. 6)

• Order fulfilment — Contract (Art. 6(1)(b))
• Account management — Contract (Art. 6(1)(b))
• Payment processing — Contract (Art. 6(1)(b))
• Legal obligations (HMRC, food safety) — Legal obligation (Art. 6(1)(c))
• Platform security and fraud prevention — Legitimate interests (Art. 6(1)(f))
• Marketing communications — Consent (Art. 6(1)(a))
• Automated pricing decisions — Legitimate interests (Art. 6(1)(f))

4. Automated Decision Making (UK GDPR Art. 22)

Our pricing rules engine automatically calculates prices based on your customer group membership (e.g. B2B Standard, Net 7, Net 15). You have the right to request human review of any pricing decision that produces legal effects or similarly significantly affects you — contact privacy@estiaco.uk.

5. Data Retention Periods

• Invoice and order records — 7 years (HMRC requirement)
• Customer account data — 3 years after last order
• Support conversations — 2 years
• Activity logs — 1 year
• Stock movement records — 3 years
• Delivery records — 3 years
• Batch/lot records — 3 years after expiry date

6. Third Party Recipients

• GoCardless Ltd (payment processing) — UK/EU based
• Google Workspace (email) — US based, Standard Contractual Clauses apply
• Postmark/Wildbit (transactional email) — US based, SCCs apply
• Cloudflare Inc (CDN/security) — US based, SCCs apply
• [PLACEHOLDER - REVIEW BEFORE GO-LIVE] hosting provider name — [PLACEHOLDER - REVIEW BEFORE GO-LIVE] location
• QuickBooks/Intuit (accounting, post-launch) — US based, SCCs apply

7. International Transfers

Where we use US-based processors we rely on Standard Contractual Clauses approved by the UK ICO, and the UK-US Data Bridge where applicable, as appropriate safeguards under Art. 46.

8. Your Rights (UK GDPR Art. 15-22)

• Right of access (SAR) — 30 day response
• Right to rectification — 30 day response
• Right to erasure — 30 day response
• Right to restriction of processing
• Right to data portability — machine-readable CSV export
• Right to object to processing
• Rights related to automated decision making
• Right to withdraw consent
• Right to complain to the ICO (ico.org.uk, 0303 123 1113)

You can exercise any of these rights via the Your Rights page, or by emailing privacy@estiaco.uk.

9. Cookies

See the Cookie Policy. We use essential cookies only — no analytics or marketing cookies are set at launch.

10. Changes to This Policy

Last updated: [PLACEHOLDER - REVIEW BEFORE GO-LIVE] DATE. We will notify registered users of material changes by email.