Privacy policy
Privacy Policy
Last updated: 2 July 2026
Flexifoil International Limited ("we", "us", "our") operates this store and website, including all related information, content, features, tools, products and services (the "Services"). Flexifoil International Limited is a company registered in England and Wales (company number 02709479), and is the data controller of the personal information described in this Privacy Policy for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Flexifoil International Limited is powered by Shopify, which enables us to provide the Services to you.
This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase through the Services, or otherwise communicate with us. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.
Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read this Privacy Policy.
Personal Information We Collect
"Personal information" means information that identifies or can reasonably be linked to you. We may collect or process the following categories, depending on how you interact with the Services:
- Contact details — name, billing address, shipping address, phone number, and email address.
- Financial information — payment card details, transaction details, and payment confirmation. (Card numbers are processed directly by our payment processor and are not stored on our own systems.)
- Account information — username, password, preferences and settings, if you create an account.
- Transaction information — items you view, add to cart, or purchase, return, exchange or cancel, and your order history.
- Communications — the content of any messages you send us, e.g. customer support enquiries.
- Device and usage information — your IP address, browser type, and how you interact with the Services, typically collected via cookies (see "Cookies" below).
How and Why We Use Your Personal Information
Under UK GDPR, we must have a valid legal basis for every use of your personal information. The table below sets out our main purposes and the legal basis we rely on for each:
| Purpose | Legal basis |
|---|---|
| Processing your order, taking payment, arranging shipping, handling returns and refunds | Performance of a contract with you |
| Customer support and responding to enquiries | Performance of a contract with you / our legitimate interests |
| Sending you order and account-related notifications | Performance of a contract with you |
| Sending marketing emails about our kites and offers | Your consent, or our legitimate interests where you are an existing customer and the "soft opt-in" under the Privacy and Electronic Communications Regulations 2003 (PECR) applies — see "Marketing Emails" below |
| Fraud prevention and account security | Our legitimate interests, and compliance with legal obligations |
| Improving the Services, understanding how customers use our store | Our legitimate interests |
| Complying with tax, accounting, and legal obligations | Legal obligation |
Where we rely on legitimate interests, we have considered that this processing is proportionate and does not override your own rights and interests, and you have the right to object (see "Your Rights" below).
Marketing Emails and PECR
If you've opted in to receive marketing from us, or you are an existing customer and we're relying on the PECR "soft opt-in" (i.e. you bought from us before, we're marketing similar products, and we gave you a clear chance to opt out at the point we collected your details), we may email you about new kites, offers, and updates. You can unsubscribe at any time using the link in any marketing email, or by emailing hello@flexifoil.com. Opting out of marketing does not affect transactional emails relating to an order you've placed.
Personal Information Sources
We collect personal information:
- Directly from you — when you place an order, create an account, or contact us.
- Automatically — through cookies and similar technologies when you use our website.
- From our service providers — including Shopify and our payment processor.
How We Disclose Personal Information
We disclose personal information to:
- Shopify and other service providers who perform functions on our behalf (payment processing, fulfilment, shipping, email marketing platform, IT hosting).
- Our affiliates, where relevant.
- Third parties, where required to comply with a legal obligation, enforce our terms, or protect our rights, your safety, or the safety of others.
- A buyer or successor, in the event of a merger, sale, or restructuring of our business.
We do not sell your personal information to third parties.
Relationship with Shopify
The Services are hosted by Shopify, which collects and processes personal information about your use of the Services in order to provide and improve them. Information you submit will be transmitted to and shared with Shopify, which may act as an independent data controller for certain purposes (e.g. Shopify's own fraud prevention and platform analytics). To learn more about how Shopify uses your personal information, see the Shopify Consumer Privacy Policy.
Cookies
We use cookies and similar technologies to run our store, remember your preferences, and understand how our website is used. Some cookies are essential for the Services to function; others (such as analytics or marketing cookies) are only used with your consent, which you can manage via our cookie banner or your browser settings, in accordance with PECR. For more detail, see our Cookie Policy [LINK].
International Transfers
We may transfer, store, and process your personal information outside the UK. Where we transfer personal information out of the UK, we rely on recognised transfer mechanisms, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, unless the destination country has been assessed as providing an adequate level of protection.
Retention
We keep personal information only as long as necessary for the purposes described in this policy. As a general guide:
- Order and transaction records are retained for at least 6 years, to meet HMRC tax and accounting record-keeping requirements.
- Marketing data is retained until you unsubscribe, or until we identify you as inactive and remove you from our active marketing list.
- Account information is retained for as long as your account remains active, plus a reasonable period afterwards.
Children's Data
Our Services are not directed at children, and we do not knowingly collect personal information from children under 13 without appropriate parental consent, in line with UK GDPR. If you believe a child has provided us with personal information, contact us using the details below and we will delete it.
Security
We take appropriate technical and organisational measures to protect your personal information, but no method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please avoid sending sensitive information to us over unsecured channels.
Your Rights
Under UK GDPR, you have the right to:
- Access the personal information we hold about you.
- Rectification — ask us to correct inaccurate or incomplete information.
- Erasure — ask us to delete your personal information, in certain circumstances.
- Restrict processing — ask us to limit how we use your information, in certain circumstances.
- Data portability — receive a copy of information you've provided to us, in a portable format, and ask us to transfer it to another organisation.
- Object to processing carried out on the basis of legitimate interests.
- Object to direct marketing at any time — this is an absolute right. If you object to marketing, we will stop using your information for that purpose.
- Withdraw consent at any time, where we rely on consent, without affecting the lawfulness of processing before your withdrawal.
- Not be subject to solely automated decision-making, including profiling, that produces legal or similarly significant effects on you.
To exercise any of these rights, contact us using the details below. We may need to verify your identity before responding, and we will respond within one month as required by law.
Complaints
If you have concerns about how we handle your personal information, please contact us first so we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator:
- Website: ico.org.uk
- Helpline: 0303 123 1113
Changes to This Privacy Policy
We may update this Privacy Policy from time to time, including to reflect changes in our practices or legal requirements. We will post the revised policy here and update the "Last updated" date.
Contact
Should you have any questions about our privacy practices, this Privacy Policy, or wish to exercise any of your rights, please contact us:
Flexifoil International Limited Email: hello@flexifoil.com Phone: +44 (0)33 33 44 22 32 Address: 11 Southdown Road, Hersham, Walton-on-Thames, Surrey, KT12 4PP, United Kingdom
We are the data controller of your personal information for the purposes of UK data protection law.