Privacy Policy (UK)

Your information and choices

For a privacy request, email info@aresfit.co.uk or use the cookie controls on the site. This is an interim privacy notice. We cannot yet confirm the complete list of active data recipients or how every connected service applies cookie choices. The outstanding Avada service details are set out below.

Who is responsible for your information?

Kloer Ltd (trading as AresFit) · Company No. 15575148 · VAT GB 488 9466 09 · info@aresfit.co.uk · 0333 880 6486 · Registered office and postal contact: Kloer Ltd, 3 Station Road, Stansted, England, CM24 8BE.

Scope

How we collect, use, share and protect your personal data under UK GDPR and the Data Protection Act 2018.

Your rights

Your rights include access and correction, and, where applicable, deletion, restriction, portability and objection; the rights depend on the processing and lawful basis. You have the right to object to direct marketing at any time, and we will stop using your data for that purpose while retaining only an appropriate suppression record. You can withdraw consent without affecting earlier lawful processing. We respond without undue delay and normally within one calendar month. If a lawful extension or other applicable rule changes that deadline, we explain the reason and the applicable time limit. Contact info@aresfit.co.uk. You can complain to the ICO at ico.org.uk or 0303 123 1113.

We explain which information is needed to process your order or request and the consequences of not providing it. If we obtain personal information from another source, we will identify that source and the relevant categories in the applicable privacy information. If we use significant automated decision-making or profiling, we will explain its use, significance and consequences before that processing.

Cookies & consent

We use cookies and similar technologies for store functions, security and remembering privacy choices. Avada Cookie Consent is used for our cookie banner and preference controls. You have the right to refuse or withdraw consent for optional analytics, personalisation and advertising. Use the cookie controls to set your preferences or contact us for help.

Where consent is required, it must be obtained before the relevant technology is used. Withdrawing consent does not affect earlier lawful processing. It requires us to stop the processing based on that consent and address deletion of the related personal information and notification to recipients where required. Other lawful record-keeping obligations can still apply. Contact info@aresfit.co.uk if you need help with your choice or a data-rights request. You can request a quote using the same address.

We use Shopify for our store, Avada Cookie Consent for cookie controls, Judge.me for reviews and Shopify Inbox for chat. Other services associated with our store include AfterShip Tracking, Meta (Facebook and Instagram), Google & YouTube, Klaviyo, TikTok and SalesPOP. The descriptions below explain the roles that apply when a service is used. Depending on the service and purpose, information can include device and browser information, online identifiers, and page, product or order interactions.

Klaviyo's onsite feature is turned off. Disabling a website feature does not necessarily delete earlier information or stop separate services provided by the same company. Essential order and service information is handled under the separate purposes and legal bases described in this notice.

What we collect

• Identity & contact: name, email, phone, billing/shipping addresses.
• Order & account: items ordered, payment confirmation, order history, account details.
• Usage & device: IP address, browser/device information, IP-derived approximate location and interactions, subject to the applicable purpose and your privacy choices.
• Support: messages and photos you send to us.

We do not intentionally collect special category data.

Why we use your information

• Order fulfilment, delivery, returns, warranty administration and service messages: contract where this is necessary for a contract with you, or steps you ask us to take before contracting. For contacts acting for a business customer, our legitimate interest is administering that business relationship where appropriate. Accounting and tax records are retained where required by legal obligation.
• Site security and fraud prevention: legitimate interests in protecting our business, customers and systems, subject to assessing necessity and your rights.
• Email marketing: consent where you opt in, which you can withdraw. Where every applicable customer soft-opt-in condition is met, we may instead rely on legitimate interests in promoting our own similar products or services: we obtained your details directly during a sale or sale negotiation, offered an opt-out then, and provide an opt-out in every message. Soft opt-in is not consent and does not cover purchased contact lists.
• Business marketing: for corporate subscribers where electronic-marketing law does not require consent, legitimate interests may apply only after the necessary assessment and provision of privacy information. Individual subscribers, including sole traders and some partnerships, require the applicable consent or soft-opt-in conditions. You can object to direct marketing at any time.
• Optional analytics, personalisation and advertising technologies: consent through our cookie choices. You can refuse or withdraw consent for optional purposes. We remain responsible for honouring your choices and handling data-rights requests. This is separate from essential security, order processing and legally required records.

Who we share information with

We use Shopify for our store, payment providers for payments, delivery and service partners for fulfilment, and IT/security providers for support and protection. Necessary information may also be shared for legal obligations or a business transfer. Some services can involve personalised advertising, as described below. You have the right to refuse or withdraw consent for optional advertising purposes through the available controls or by contacting us.

Shopify and enhanced shopping services

Our store is hosted by Shopify, which collects and processes personal information when you visit and make purchases. Shopify Network Intelligence is enabled for this store. Shopify Network Intelligence enhanced services can also use information about your interactions with our store, other merchants and Shopify for shopping features, personalisation, analytics and advertising. Where those enhanced services apply, Shopify acts as an independent controller. Required consent and privacy choices still apply. These services can involve sharing information with Shopify and other third parties in other countries. See this notice, Shopify Consumer Privacy Policy and Shopify privacy portal for further information and ways to withdraw consent, object or opt out of relevant processing.

Delivery tracking

Where we use AfterShip, it processes merchant shipment and tracking information on our behalf; carriers and its separate consumer services can have their own controller roles.

Email marketing and reviews

Where its merchant email and marketing services are used, Klaviyo acts as a processor. Judge.me processes merchant review-service information on our behalf and acts separately for its own direct user accounts.

SalesPOP and chat

Relay Commerce provides SalesPOP sales-notification services. Shopify Inbox supports messages you choose to send through the site. Providers' separate services are covered by their own privacy information.

Meta

Where UK Meta Business Tools are used, Meta Platforms, Inc. acts as a processor for the matching and measurement services covered by its terms. Collection and transmission for advertising targeting and personalisation are covered by the applicable joint-controller arrangement, while Meta acts independently for later processing. The actual service and purpose determine the role. Our responsibilities include the site notice, consent and correct implementation. Meta handles applicable rights requests concerning data it stores. See the UK controller arrangement and Meta privacy information. You may also contact us to exercise your rights.

TikTok

TikTok's UK terms distinguish joint-controller collection, transmission and measurement from later independent-controller targeting and ad improvement; contact matching can involve processor services. The relevant entities for those UK terms are TikTok Information Technologies UK Limited and TikTok Technology Limited. The role depends on the particular service used. See the TikTok controller arrangement, TikTok privacy information and rights contact. You may also contact us.

Google measurement and advertising

Google's role depends on the measurement or advertising service: its published terms distinguish processor services from services for which it acts as a separate controller. Changing a cookie choice does not itself delete information already held by Google or change its separate controller responsibilities. Our obligations to address withdrawal, deletion and recipient notification are described above.

Correspondence and professional services

Where necessary for correspondence, accounting or legal obligations, we use accountants and registered-office or mail-handling providers, including digital mail forwarding. Their role depends on the actual service.

Suppliers and service partners

For fulfilment, warranty registration, servicing or safety, we share only the necessary order, contact, delivery and equipment-serial information with the relevant supplier or service partner. We limit this sharing to information needed for that purpose.

Approximate location

Avada has told us that its IP-based country lookup uses GeoJS first and ipbase if that fails. A paid geolocation service is used if both free services fail or for visitors in certain US states that the free services do not cover. This processing can involve your IP address and IP-derived approximate location. GeoJS and ipbase publish information describing use of Cloudflare infrastructure. The identity and infrastructure of the paid service, complete processing chain and applicable UK transfer details remain unconfirmed.

Finance enquiries

If you ask us to refer a finance enquiry, we will explain the actual finance provider, information to be shared, purpose, applicable lawful basis and each party's data-controller role before sharing. A finance enquiry does not guarantee approval. The provider's own privacy information and finance terms will be made available where relevant. We do not make an application or share referral information merely because finance is mentioned in a quotation.

Information processed outside the UK

Our providers can process personal information outside the UK. Shopify's European Union hosting setting does not mean that all processing stays there: its international services include Canada, the United States and other locations. Meta's UK Business Tools terms name Meta Platforms, Inc. in the United States; Klaviyo describes US hosting. Other providers use international affiliates, hosting or service partners.

The relevant recipient, service and destination determine the transfer rules and safeguard needed. Shopify, AfterShip, Klaviyo, Judge.me, Meta, TikTok and Relay Commerce publish transfer terms describing adequacy or contractual routes, including standard contractual clauses with the UK Addendum where applicable. These mechanisms apply only where the conditions for the particular transfer are met. Contact info@aresfit.co.uk for information about the safeguard applicable to your data and how to obtain a copy.

Avada Cookie Consent is used for our cookie banner and preference controls. For this service, the contracting and processing entities, current terms and data processing agreement, processing countries and subprocessors, and applicable UK transfer safeguards and documents remain unconfirmed. Contact info@aresfit.co.uk with questions or to exercise your rights concerning this processing.

How long we keep information

Retention depends on the purpose of the information and applicable legal obligations. The normal retention period for order and accounting records is six years from the end of the last company financial year the records relate to, subject to longer retention where a specific legal obligation, unresolved dispute or claim requires it.

For enquiry and support records, the relevant criteria include whether the requested service or enquiry has ended, whether an active customer relationship remains, applicable warranty and statutory-claim periods, and any unresolved or reasonably anticipated claim. Warranty expiry alone does not determine how long information is needed.

Avada has told us that consent logs are not deleted automatically and are removed only when deletion is requested. You can contact us to request deletion. We remain responsible for handling requests under the rights explained above and keeping personal information no longer than necessary.

For marketing and consent records, retention depends on the relevant valid permission or other applicable basis and the evidence needed to demonstrate it. The criteria for retaining minimum opt-out or suppression information are respecting the choice and preventing renewed contact. For security logs, the criteria are the security purpose and any identified incident. Providers acting as independent controllers can retain information under their own applicable obligations and policies.

Data protection complaints

You can complain about how we handle your personal information using the email or phone details above. You do not have to use a particular form or legal wording, and this does not exclude another legally effective complaint or notice. We acknowledge data protection complaints within 30 days, counting from the day after we receive them. If the last day falls on a weekend or public holiday, the deadline moves to the next working day. We start investigating promptly, keep you informed and explain the outcome without undue delay. You can also complain to the ICO. This complaint acknowledgement period is separate from the time limits for responding to your data rights requests.

Children

Our services are for 18+.

Security

We are responsible for using appropriate technical and organisational measures to protect personal information. No measure can guarantee absolute security; please avoid sending sensitive data by email.

Changes

We'll update this notice when needed.

ICO registration reference: ZB873281.

Related information: Delivery · Returns and refunds · Terms · Contact · FAQs · Business finance