Privacy Policy
At Atoxor, we are committed to protecting and respecting your privacy. This Privacy Policy outlines how we collect, use, store, and protect your personal data when you use our services, visit our website, or engage with us in any other way.
1 Who is responsible
Atoxor Limited, company number 09115657, is the controller for the activities described here. Our registered office and correspondence address is The Old Bakery, 90 Camden Road, Tunbridge Wells, England, TN1 2QP. Contact info@atoxor.co.uk about your information or privacy rights.
We apply the UK GDPR, Data Protection Act 2018 and Privacy and Electronic Communications Regulations 2003, as amended, and other applicable data-protection law. If we process personal information solely on a client's instructions under a consultancy engagement, the client's notice and our separate data-processing arrangements apply to that processing.
2 Information we collect and its sources
You provide information when you complete a form, place an order, subscribe, send an enquiry or correspond with us. Your employer, a colleague or an adviser may provide your business contact details when arranging work involving you.
Contact and business information may include your name, email, telephone number, role, organisation, billing address and correspondence. Order information includes the Product, licence details, order reference, amount and tax information, payment status, delivery and support records, and evidence of acceptance of Terms and of your confirmation that you are buying for business purposes.
Payment-card details are handled by the provider identified at checkout; Atoxor does not store full card details.
Resource-request information includes your email address, any other clearly identified form fields, the resource and version requested, and the date and delivery record. Newsletter information includes your email address, subscription preferences, the wording and date of consent, and unsubscribe status. We do not require newsletter subscription to deliver a requested free resource.
Technical information may include IP address, device and browser information, necessary security and server records, cookie choices and, where enabled with the required consent, website analytics and advertising interactions. Details of enabled cookies and similar technologies are available through Cookie Settings.
Newsletter engagement information. With your prior consent, we record whether our newsletter emails are opened and which links are clicked, so that we can understand which content is useful. We ask for this consent separately when you subscribe. You can withdraw it at any time by emailing info@atoxor.co.uk, and unsubscribing from the newsletter also ends it. We do not record opens and clicks for subscribers who have not given this consent. Where our email system cannot apply this choice to individual subscribers, we do not record opens and clicks for any subscriber.
We may hold project and support information you choose to send us. Please do not send unnecessary personal information, special-category information or personal data about others. Downloaded templates do not automatically transmit your completed entries to Atoxor.
3 Why we use information and our lawful bases
Orders and delivery. We use order and contact details to accept and fulfil purchases, administer licences, provide files and handle support, corrections, cancellations and refunds. Where you are personally party to the contract, our basis is contractual necessity. Where you act for an organisation that is the customer, our basis is our legitimate interest in administering that business relationship and communicating with its representatives.
Free resources. We use the information needed to respond to your request, send the requested resource and resolve delivery problems. Our basis is our legitimate interest in providing the resource you requested and administering that request. We assess necessity and the effect on your rights. Required fields are marked; if you do not provide the delivery email, we cannot email the resource. Optional fields are not required for delivery.
Enquiries and business relationships. We use contact details and correspondence to respond and manage business relationships, relying on legitimate interests. Where you personally ask us to take steps towards a contract with you, contractual necessity may apply instead.
Newsletter and promotional updates. We use your details to send the newsletter and promotional updates you opt into, relying on consent.
This includes EUDR and framework news and information about Atoxor products, resources and services. Where you separately consent, we also record whether our newsletter emails are opened and which links are clicked, relying on that consent. You may unsubscribe or withdraw either consent at any time. A request for a resource or a purchase alone does not subscribe you.
Essential product messages. We may send order confirmations, access information, responses to support requests, promised purchased updates and material corrections affecting a Product you obtained. These are sent for the relevant delivery or customer-administration purpose, not to override a marketing opt-out. Messages that promote further products or services remain subject to our marketing arrangements.
Accounting and legal requirements. We retain relevant transaction and business records and respond to lawful requirements on the basis of legal obligation. Where necessary for establishing, exercising or defending legal claims, preventing fraud or protecting our systems, we rely on legitimate interests or an applicable legal obligation.
Website technologies. We rely on consent for non-essential analytics and advertising technologies that require it. Necessary security and service operation relies on our legitimate interests in operating a secure website and, where relevant, contractual necessity. A cookie consent exemption does not remove the need for a lawful basis for associated personal-data processing.
Consent evidence and suppression. We keep proportionate evidence of consent and records of objections or unsubscribes to demonstrate compliance and avoid further unwanted marketing, relying on legal obligations and our legitimate interest in maintaining reliable preference records as applicable.
When relying on legitimate interests, we assess the purpose, necessity and balance with your rights. We do not use a list of possible lawful bases as permission to process information for unrelated purposes.
4 Newsletter choices
Marketing subscription is optional and separate from purchases, free-resource requests and acceptance of product licences. We use a separate, unticked opt-in and keep a record of your choice. You can withdraw consent through the unsubscribe link in each marketing email or by emailing info@atoxor.co.uk. Withdrawal does not affect the lawfulness of earlier processing.
We do not sell or rent personal information or pass your email to other organisations for their independent marketing. We may retain a minimal suppression record after unsubscribe so your preference is respected. This does not stop necessary order, support or material product-correction messages.
5 Who receives information
Access within Atoxor is limited to people who need the information for their work. We use Wix for website hosting, forms, customer records and newsletter delivery. We also use payment services identified at checkout, business email and IT providers, and professional advisers where necessary.
Payment provider: payments are processed through Wix Payments, the payment service provided by Wix. Wix Payments and its payment-processing partners may act as independent controllers for activities such as fraud prevention, anti-money-laundering checks and statutory compliance, as described in the Wix Privacy Policy (https://www.wix.com/about/privacy).
If we add another payment provider at checkout, we will identify it here and at checkout, with a link to its privacy notice.
Google provides website analytics and, where enabled with the required consent, advertising and conversion measurement. The enabled services and their purposes are identified in Cookie Settings. Other providers acting on our instructions are subject to appropriate contractual data-protection obligations. A provider's independent processing, where applicable, is described in its own privacy information.
We may disclose information to authorities where legally required and to advisers, insurers or courts where necessary to address legal claims. A business transfer may involve proportionate disclosure to prospective or actual buyers and advisers under appropriate safeguards. The purposes and legal requirements described in this notice continue to apply.
6 International transfers
Our website and related services are provided through Wix. Wix initially processes personal information through Wix.com Ltd in Israel, which benefits from UK adequacy recognition. Wix and its service providers may also process information in other countries. Its Data Processing Addendum provides for applicable adequacy decisions or approved contractual and other safeguards for onward transfers.
Where we use Google Analytics or Google Ads, Google may process information in the United States and other countries where Google or its service providers operate. Google's applicable terms provide for recognised adequacy mechanisms, including the UK Extension to the EU-US Data Privacy Framework for eligible transfers, and standard contractual clauses where applicable.
Further information: Wix Data Processing Addendum (https://www.wix.com/about/privacy-dpa-users); Google Ads Data Processing Terms (https://business.safety.google/adsprocessorterms/); Google data transfer frameworks (https://policies.google.com/privacy/frameworks).
Wix Payments is part of the Wix services, so the transfer arrangements described above for Wix also apply to payment information processed through Wix Payments.
You can contact info@atoxor.co.uk for further information about the safeguards relevant to your information and how to obtain a copy.
7 Retention
We retain information for the purpose for which it is needed and review whether it can be deleted or anonymised. We consider the transaction or relationship, the need to evidence consent or a licence, applicable accounting requirements, legal limitation periods and any actual dispute or investigation.
Order, invoice and tax records are retained for the applicable accounting and statutory periods. Contract, licence, acceptance and support records are retained for the duration needed to administer rights and deal with reasonably anticipated claims. Where continued licence evidence is needed, we minimise the personal information retained rather than keeping every related communication indefinitely.
Resource-delivery and enquiry records are retained while the request is being handled and for a proportionate follow-up period for support and accountability. They are not automatically retained as a marketing list. Newsletter details are retained while subscribed, subject to periodic review of whether continued retention is justified. After unsubscribe, we retain only information necessary for suppression, evidence and any other separately justified purpose.
Technical and analytics retention depends on the enabled service and stated purpose. Cookie durations appear in Cookie Settings. Backups are removed or overwritten on their retention cycle and access is restricted. Legal holds may extend a period where needed for a specific matter. You may request more information about the period applicable to your records.
8 Security
We use appropriate technical and organisational measures, including access controls and secure transmission arrangements, to protect personal information. No system can be guaranteed completely secure. We assess incidents and make notifications to the regulator and affected people where legally required, including the applicable 72-hour regulator notification requirement where relevant.
9 Your rights and complaints
Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your information. You may object to processing based on legitimate interests and withdraw consent where processing relies on it. Rights are subject to the conditions and exemptions in applicable law.
You have the right to object at any time to use of your personal information for direct marketing. We will stop using it for that purpose when you object.
Contact info@atoxor.co.uk or write to our correspondence address to exercise a right. We may reasonably verify identity and clarify a request where necessary. We respond within the applicable legal time limits, normally one month for rights requests, and explain any permitted extension or pause. Rights requests are normally free of charge.
To complain about our handling of personal information, use the same email or postal address. Using the subject “Data Protection Complaint” is helpful but not required. We will acknowledge your complaint within 30 days, investigate appropriately, keep you informed as appropriate and communicate the outcome without undue delay. This complaints acknowledgement period does not replace the separate deadlines for rights requests.
You may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or telephone 0303 123 1113. You do not have to complain to us first. Where applicable, you may also complain to the supervisory authority in your country of residence, work or the alleged infringement.
10 Cookies and similar technologies
Necessary technologies support requested features, security and website operation. Non-essential analytics and advertising technologies that require consent are not activated until you consent. You can reject them or change your choice through Cookie Settings. Rejecting optional technologies does not prevent you from requesting a resource or buying a Product, although necessary technologies remain required for relevant functions.
With consent, analytics such as Google Analytics help us understand use of the website. Where enabled with consent, Google Ads and similar tools measure campaigns and conversions and may support advertising audiences. These technologies may involve identifiers, device information, browsing activity and form or purchase events. The live inventory in Cookie Settings identifies actual providers, purposes and durations. Our controls and any associated consent information must reflect the services actually enabled.
11 Automated decisions and children
We do not use solely automated decisions producing legal or similarly significant effects about individuals in the activities described here. Where enabled with the required consent, advertising audiences may involve limited profiling to measure engagement and make advertising more relevant. You can control optional advertising technologies through Cookie Settings.
Our website products and resources are intended for professional and adult audiences, not children under 16. If you believe a child under 16 has provided information, contact us so we can assess and remove it where appropriate.