Last updated: 2026
1. Who We Are and How to Contact Us
HHA COMMERCE LTD (“we”, “us”, or “our”) is a private limited company registered in England & Wales under company number 17405826. Our registered office is 318a Green Street, London, England, E13 9AP.
We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
If you have any questions about this privacy policy or how we handle your personal data, please contact us at [email protected].
2. The Personal Data We Collect
We may collect and process the following categories of personal data:
- Identity data — full name, title, date of birth, and company affiliation.
- Contact data — email address, telephone number, postal address, and delivery address.
- Transaction data — details of products or services you have purchased, payment information (processed securely by our payment providers), and order history.
- Technical data — Internet Protocol (IP) address, browser type and version, operating system, device type, and referring URLs.
- Usage data — information about how you interact with our website, including pages visited, time spent on pages, and navigation paths.
- Marketing and communications data — your preferences for receiving marketing from us and your communication preferences.
3. Lawful Bases for Processing
We process your personal data only when we have a lawful basis to do so under UK GDPR. The applicable bases are:
- Consent — where you have given clear consent for us to process your personal data for a specific purpose, such as sending you marketing communications. You may withdraw consent at any time.
- Performance of a contract — where processing is necessary for the performance of a contract to which you are a party, or to take steps at your request before entering into a contract (for example, fulfilling an order you have placed).
- Legal obligation — where processing is necessary for compliance with a legal obligation to which we are subject (for example, tax reporting requirements).
- Legitimate interests — where processing is necessary for our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override those interests. Our legitimate interests include operating and improving our business, preventing fraud, and ensuring network security.
4. How We Use Your Data
We use your personal data for the following purposes:
- To process and fulfil orders for products or services.
- To manage your account and provide customer support.
- To communicate with you, including responding to enquiries and sending service-related notifications.
- To improve our website, products, and services through analysis of usage data.
- To send marketing communications where you have opted in to receive them.
- To comply with legal and regulatory obligations.
- To detect, prevent, and address fraud, security breaches, and other harmful activity.
5. Cookies
Our website uses cookies and similar technologies to distinguish you from other users and to improve your browsing experience. Cookies are small text files placed on your device when you visit a website.
- Strictly necessary cookies — required for the website to function correctly (for example, session cookies that enable you to navigate between pages). These do not require your consent.
- Analytics cookies — help us understand how visitors interact with our website by collecting and reporting information anonymously. These are only placed with your consent.
- Preference cookies — allow the website to remember choices you make (such as language or region) to provide a more personalised experience.
You can control and manage cookies through your browser settings. Disabling certain cookies may affect the functionality of the website.
6. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. The criteria we use to determine retention periods include:
- The duration of our ongoing relationship with you.
- Whether there is a legal obligation to which we are subject.
- Whether retention is advisable in light of our legal position (for example, applicable statutes of limitation, litigation, or regulatory investigations).
When personal data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.
7. Who We Share Your Data With
We may share your personal data with the following categories of recipients:
- Service providers — third parties who provide IT, hosting, payment processing, analytics, or delivery services on our behalf.
- Professional advisers — including lawyers, auditors, and insurers who provide consultancy, banking, legal, insurance, and accounting services.
- Regulators and authorities — where disclosure is required by law, regulation, or legal process.
- Prospective buyers — in the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the relevant third party, subject to the same privacy protections.
We do not sell your personal data to third parties.
8. International Transfers
Your personal data may be transferred to, and processed in, countries outside the United Kingdom. Where we transfer data internationally, we ensure appropriate safeguards are in place, including:
- Transferring data to countries that have been deemed to provide an adequate level of data protection by the UK Government.
- Entering into approved contractual arrangements (such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses) with recipients outside the UK.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, regular security assessments, and staff training on data protection obligations.
While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security, but we will promptly notify you and the relevant supervisory authority of any data breach that is likely to result in a risk to your rights and freedoms.
10. Your Rights as a Data Subject
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access — you may request a copy of the personal data we hold about you.
- Right to rectification — you may request that we correct any inaccurate or incomplete personal data.
- Right to erasure — you may request that we delete your personal data where there is no compelling reason for its continued processing.
- Right to restriction of processing — you may request that we restrict the processing of your personal data in certain circumstances.
- Right to data portability — you may request to receive your personal data in a structured, commonly used, and machine-readable format.
- Right to object — you may object to our processing of your personal data based on legitimate interests, including for direct marketing purposes.
- Right to withdraw consent — where we process your data based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month.
11. Your Right to Complain to the ICO
If you are not satisfied with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
You can contact the ICO at:
- Website: ico.org.uk
- Telephone: 0303 123 1113
- Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
12. Changes to This Policy
We reserve the right to update this privacy policy at any time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically to stay informed of how we protect your data.
Your continued use of the website following any changes to this policy constitutes your acceptance of the revised policy.
Contact Us
If you have any questions about this privacy policy or wish to exercise any of your data protection rights, please contact us:
- HHA COMMERCE LTD
- 318a Green Street, London, England, E13 9AP
- Email: [email protected]