PRIVACY POLICY
1. Who We Are
CRU Kit Ltd (company number 15126671) is the data controller responsible for your personal information. We operate the website crukit.co.uk and are registered in England and Wales.
Unit 3 Threshelfords Business Park Inworth Road, Feering, Colchester, Essex, United Kingdom, CO5 9SE
For any questions about this Privacy Policy or how we handle your personal data, please contact us at:
We are registered with the Information Commissioner's Office (ICO). Our ICO registration number is:
ZB738421
This Privacy Policy applies to personal information we collect when you visit crukit.co.uk, purchase from us, create an account, or otherwise interact with us (collectively, the "Services"). It applies to customers and visitors in the UK, the EU/EEA, the USA, Canada, and any other territory from which you access our Services.
2. What Personal Data We Collect
a) Data you provide directly
-
Contact details — name, email address, phone number, billing and delivery address
-
Account information — username, password, security questions
-
Order information — purchase history, payment confirmation details
-
Shopping activity — items viewed, added to your basket or wishlist
-
Communications — messages you send us via customer support
b) Data collected automatically
When you visit our Site, we and our third-party partners automatically collect certain usage data, including:
-
IP address and approximate location
-
Device type, operating system, and browser
-
Pages visited, time spent, and links clicked
-
Referring URLs and search terms
This data is collected using cookies and similar tracking technologies. See Section 6 (Cookies) for more detail.
c) Data from third parties
-
Payment data from our payment processor (Stripe), who collects and processes payment card details on our behalf
-
Technical and analytics data from Wix (our website platform) and Google Analytics
-
Advertising and engagement data from Meta (Facebook/Instagram), where you interact with our adverts
3. Our Lawful Basis for Processing
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we must have a valid lawful basis for each type of processing activity. We rely on the following:
Purpose
Data Used
Lawful Basis
Fulfilling your order and processing payment
Contact details, order information, payment confirmation
Contract (Article 6(1)(b) UK GDPR)
Managing your account
Account information, contact details
Contract (Article 6(1)(b))
Sending order confirmations, shipping updates, and service notifications
Contact details, order information
Contract (Article 6(1)(b))
Sending marketing emails and promotional communications
Email address, purchase history
Consent (Article 6(1)(a)) — you can opt out at any time
Personalised advertising (Google, Meta)
Usage data, cookie identifiers
Consent (Article 6(1)(a)) — via cookie consent
Improving our website and services via analytics
Usage data, device information
Legitimate interests (Article 6(1)(f)) — to understand how our Site is used and improve it
Fraud detection and security
Contact details, usage data, IP address
Legitimate interests (Article 6(1)(f)) — to protect our business and customers
Complying with legal obligations
As required
Legal obligation (Article 6(1)(c))
Handling customer support enquiries
Communications, contact details
Legitimate interests (Article 6(1)(f)) — to respond effectively to customers
4. How We Use Your Personal Data
-
Order fulfilment — Process and fulfil your orders, including payment, shipping, returns, and exchanges
-
Account management — Maintain and manage your customer account
-
Service communications — Send you transactional communications such as order confirmations and shipping updates
-
Marketing — Send promotional emails and offers where you have consented or where we have a legitimate interest under PECR (e.g. existing customers). You may opt out at any time using the unsubscribe link in any email
-
Advertising — Serve targeted advertisements on Meta and Google platforms based on your browsing and purchase behaviour, subject to your cookie and advertising consent
-
Analytics — Analyse website traffic and user behaviour to improve our Site and services
-
Security and fraud prevention — Detect and prevent fraudulent transactions and protect our platform
-
Customer support — Respond to customer support requests and resolve disputes
-
Legal compliance — Meet our obligations under applicable law
5. International Data Transfers
As a UK-based company trading internationally, and because some of our third-party service providers operate outside the UK, your personal data may be transferred to and processed in countries outside the United Kingdom, including the USA (Google, Meta, Stripe, Wix).
Where we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:
-
UK International Data Transfer Agreements (IDTAs) or equivalent standard contractual clauses
-
Transfers to countries that have received UK adequacy regulations
-
Reliance on the provider's binding corporate rules or equivalent mechanisms
If you are located in the EU or EEA, your data may also be processed under the EU GDPR. Our EU-facing suppliers (such as Meta Platforms Ireland Ltd) process EU data under EU GDPR frameworks.
You may request further information about the safeguards in place for international transfers by contacting us at the address in Section 1.
6. How Long We Keep Your Data
We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Policy, or as required by law. Our standard retention periods are:
-
Order and financial records — 7 years after the transaction, in line with HMRC requirements for tax and accounting records
-
Account data — For as long as your account remains active, plus 2 years after closure
-
Marketing data — Up to 3 years from your last interaction with us, unless you opt out earlier
-
Cookie and analytics data — Up to 2 years, or as defined by your cookie consent settings
-
Customer support records — Up to 3 years from resolution of the matter
When data is no longer needed, we securely delete or anonymise it.
7. Cookies and Tracking Technologies
We use cookies and similar technologies on our Site. Cookies are small text files stored on your device that help us operate the Site and improve your experience.
We use the following categories of cookies:
-
Strictly necessary — Required for the Site to function (e.g. shopping basket, login session). These cannot be disabled
-
Functional — Help us remember your preferences (e.g. language, currency)
-
Analytics — Allow us to measure how visitors use our Site (Google Analytics). This data is anonymised where possible
-
Marketing and advertising — Used by Meta (Facebook Pixel) and Google to deliver targeted advertisements based on your interests and browsing history
Under the UK Privacy and Electronic Communications Regulations (PECR), we require your prior consent before placing non-essential cookies on your device. You will be asked to provide this consent via our cookie banner when you first visit the Site.
You can withdraw your consent or manage your cookie preferences at any time by:
-
Using the cookie settings tool on our Site
-
Adjusting your browser settings to block or delete cookies
-
Opting out of Google Analytics at tools.google.com/dlpage/gaoptout
-
Managing your Meta ad preferences at facebook.com/ads/preferences
Please note that disabling certain cookies may affect the functionality of our Site.
8. How We Use Your Personal Data
-
Order fulfilment — Process and fulfil your orders, including payment, shipping, returns, and exchanges
-
Account management — Maintain and manage your customer account
-
Service communications — Send you transactional communications such as order confirmations and shipping updates
-
Marketing — Send promotional emails and offers where you have consented or where we have a legitimate interest under PECR (e.g. existing customers). You may opt out at any time using the unsubscribe link in any email
-
Advertising — Serve targeted advertisements on Meta and Google platforms based on your browsing and purchase behaviour, subject to your cookie and advertising consent
-
Analytics — Analyse website traffic and user behaviour to improve our Site and services
-
Security and fraud prevention — Detect and prevent fraudulent transactions and protect our platform
-
Customer support — Respond to customer support requests and resolve disputes
-
Legal compliance — Meet our obligations under applicable law
9. Your Rights
-
Under UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:
-
Right of access — To obtain a copy of the personal data we hold about you
-
Right to rectification — To have inaccurate data corrected
-
Right to erasure ("right to be forgotten") — To request deletion of your data in certain circumstances
-
Right to restrict processing — To ask us to limit how we use your data in certain situations
-
Right to data portability — To receive your data in a portable format and transfer it to another provider
-
Right to object — To object to processing based on legitimate interests or for direct marketing purposes
-
Right to withdraw consent — To opt out of or withdraw consent for marketing emails at any time via the unsubscribe link or by contacting us
-
Rights related to automated decision-making — Rights in relation to any automated decision-making or profiling (we do not currently use solely automated decision-making that produces legal effects about you)
-
To exercise any of these rights, please contact us using the details in Section 1. We will respond within one calendar month. We may need to verify your identity before processing your request.
-
If you are located in the EU or EEA, you may also have the right to lodge a complaint with your local supervisory authority.
10. Right to Complain to the ICO
-
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection.
-
Website: ico.org.uk
-
Helpline: 0303 123 1113
-
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
-
We would, however, appreciate the opportunity to address your concerns before you contact the ICO, so please reach out to us first.
11. Children's Data
-
Our Services are not directed at children under the age of 18, and we do not knowingly collect personal data from children. The UK age of digital consent is 13.
-
If you are a parent or guardian and believe your child has provided us with personal data, please contact us and we will take steps to delete it promptly.
12. User-Generated Content
-
Our Site may allow you to submit product reviews or other public content. Any content you submit to a public area of the Site will be visible to other visitors. We are not responsible for how others use information you choose to make publicly available.
13. Third-Party Websites and Links
-
Our Site may contain links to third-party websites. We have no control over those sites and are not responsible for their privacy practices. We recommend you review the privacy policy of any site you visit via a link on our Site. Our inclusion of a link does not constitute an endorsement.
14. Security of Your Data
-
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include encrypted data transmission (HTTPS), access controls, and use of PCI-DSS compliant payment processing.
-
However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security.
-
If you have an account with us, you are responsible for keeping your login credentials confidential. Please contact us immediately if you suspect unauthorised access to your account.
15. Changes to This Privacy Policy
-
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we do, we will update the "Last updated" date at the top of this page.
-
Where changes are significant, we will notify you by email or by a prominent notice on our Site.
-
Continued use of our Services after any changes constitutes your acknowledgement of the updated policy.