Privacy notice.
How Refined Commerce Ltd collects and uses personal data, in plain English: on this website, when you write to us, when we work on your store, and when we write to your business.
01Who we are
Refined Commerce Ltd is the data controller for the personal data described in this notice. We are a company registered in England and Wales, company number 08802398, with our registered office at 124 City Road, London, EC1V 2NX. You can reach us at hello@refinedcommerce.com or on 020 8058 5072, and a person will answer.
02Visitors to this website
This website is a static site served through Cloudflare. It sets no cookies of its own and runs no advertising trackers or social media pixels. The fonts, images and video are served from this website itself.
We count visits with Cloudflare Web Analytics, so we can see how the site is used and keep it fast. When a page loads, a small script sends Cloudflare the page address, the site you came from, your browser and type of device, your country and how quickly the page loaded. It sets no cookies, does not follow you across other websites, and shows us totals only, never individual visitors. You can turn it off for this browser below, and it stays off if your browser sends a Global Privacy Control signal. Turning it off saves a small note in your browser so that it stays off.
Cloudflare processes connection data, such as your IP address and request headers, to deliver the site and protect it from abuse, under its own terms. It may set a strictly necessary security cookie when it checks whether traffic is automated. Links to our Google reviews, LinkedIn page, partner listings and client stores take you to other sites, which have their own privacy notices.
Our lawful basis for this processing, including the visit counts, is our legitimate interest in running a reliable, secure website and understanding how it is used.
03Enquiries and the free health check
When you fill in a form on this site, email us or call us, we collect what you give us: typically your name, email address, your store's web address and whatever you tell us about your needs, and your phone number if you call. A form submission is passed by Cloudflare to us as an email; the website itself keeps no database of what you send. We use it to answer you, to prepare the free Magento Security and Upgrade Health Check if you have asked for one, and to quote for work.
The health check is prepared from pages, headers and public records that your store already serves to every visitor and search engine. We do not log in, authenticate, run scanners, submit forms or test the store. The one-page report is sent to the email address you gave us and to nobody else.
Our lawful basis is taking steps at your request before entering into a contract and, for keeping a record of the exchange, our legitimate interest in running the business. Enquiry details are not added to any marketing list.
04Clients and their stores
When we work on a client's store we handle the personal data held in that store (customer accounts, orders, addresses) on the client's instructions and under a written agreement. In that work we are a processor and the client is the controller. We access only what the work needs, we keep access credentials in a password manager with two-factor authentication, and we do not copy customer data out of the client's systems except where a task requires it and the client has agreed.
We also keep the business contact details of the people we work with at each client (names, roles, work email addresses and phone numbers) for the duration of the relationship and for six years afterwards for accounting and legal purposes. Our lawful basis is the performance of the contract and our legitimate interests in running and defending the business.
05Business contacts we email
Refined Commerce Ltd sometimes writes to online retailers whose websites run Magento, to tell them what we can see on their public website and to offer our services. If you have received an email from us and we have not dealt with you before, this is the information we hold and why.
What we hold
Your shop's website address, the business contact email address published on it (or listed for it in a business-contact database), the shop's name, what we observed on the public website (for example the software version it shows, its security certificate, its speed figures published by Google, and whether a test copy of the site is reachable), and, where the public source gives one, the first name of the person the address belongs to. We also keep a record of what we sent you and any reply.
How we look at your website
We look only at what your website shows to any visitor or search engine. What we tell you is a snapshot of what was publicly visible when we looked. It is not a security audit or a statement that your website is or is not secure, and the website may have changed since.
Where it came from
Your own website, or a business-contact database that lists company contact details for business purposes. We do not collect anything from behind a login and we do not buy consumer data.
Why we hold it and our lawful basis
To tell you about faults we can see on your website and to offer our services. Our lawful basis is our legitimate interest in promoting our business to other businesses (UK GDPR Article 6(1)(f)). We have assessed that interest against yours and keep a record of that assessment. Where UK or Irish electronic marketing law requires it, we only email limited companies and other corporate bodies, or business addresses used for commercial purposes.
How long we keep it
For up to twelve months after the last email, unless you become a client, in which case section 4 applies. If you object, we keep only your email address on a suppression list so that we do not write to you again.
Your rights, and how to stop us
You can object to direct marketing at any time, and we will stop at once: reply “no” to any email from us, or write to rowan@refinedcommerce.com. We also honour an objection sent to any of our other addresses or made by phone. You also have the right to ask what we hold about you, to have it corrected or deleted, and to complain to the Information Commissioner's Office (ico.org.uk) or, in Ireland, the Data Protection Commission.
Who else sees it
Our email-sending platform, Smartlead, sends the emails on our behalf under a data-processing agreement, and your replies arrive in our own business mailbox, run by the email provider named in section 6. We do not sell the data or pass it to anyone else.
06Who we share data with
We do not sell or rent personal data. We share it only with the suppliers we need to run the business, each under a contract that restricts what they can do with it: Cloudflare, which serves this website, counts visits and passes form submissions to us; our email and document provider (Google Workspace); the platform that sends our business emails (Smartlead); our ticket and project tools; our accountants; and, where a client's project requires it, the hosting or software companies named in the agreement for that work. Some of these suppliers process data outside the UK; where they do, the transfer is covered by the UK's adequacy regulations or by the International Data Transfer Agreement or Addendum.
We will disclose personal data where the law requires it, for example to a court or a regulator.
07What we hold and for how long
| Data | Why we hold it | Lawful basis | Kept for |
|---|---|---|---|
| Connection data when you visit (IP address, request headers) | To deliver and protect the website | Legitimate interests | Held by Cloudflare under its own policy |
| Visit statistics (page, referring site, browser, device type, country, page speed) | To understand how the website is used and keep it fast | Legitimate interests | Held by Cloudflare under its own policy; we see totals only |
| Enquiries by form, email or phone | To reply and to give estimates | Steps at your request before a contract; legitimate interests | Twelve months from the last message, if no work follows |
| Health check requests and reports | To prepare and send the report you asked for | Steps at your request | Six months from sending |
| Client contacts, contracts, invoices and correspondence | To do the work and keep proper accounts | Contract; legal obligation | Six years after the relationship ends |
| Business contacts we email, and what we observed on their website | To tell a business about faults we can see on its website and offer our services | Legitimate interests | Twelve months from the last email, unless the business becomes a client |
| Suppression list | To make sure we do not contact you again | Legitimate interests | Indefinitely, so that we honour your objection |
08Your rights
Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to our processing it (including, at any time, to direct marketing), ask us to restrict it, and ask for it in a portable form where that applies. We do not make decisions about you by automated means alone. Email hello@refinedcommerce.com and we will respond within one month. We may ask you to confirm your identity first.
If you are in Ireland, the same rights apply under the GDPR and the Irish Data Protection Act 2018.
09Complaints
If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. If you are in Ireland, you can complain to the Data Protection Commission at dataprotection.ie.
10Changes to this notice
We will update this page when our practices change and show the date of the last change at the top. Material changes to how we use data you have already given us will be explained to you directly where we can.