Privacy policy
Governed by: UK General Data Protection Regulation (UK GDPR) • Data Protection Act 2018 • Privacy and Electronic Communications Regulations 2003 (PECR)
AutoSaber is committed to protecting your personal data. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, and your rights in relation to it. Please read it carefully.
By visiting, using, or purchasing through the AutoSaber website, you acknowledge that you have read and understood this Privacy Policy.
If there is any conflict between this Privacy Policy and our Terms of Service with respect to the collection, processing, or disclosure of your personal information, this Privacy Policy controls.
Who We Are (Data Controller)
The data controller for the purposes of the UK GDPR is:
Monty Bowden & Shahmir Shaheryar, trading as AutoSaber
12 Holly Grove, Sale, M33 2DS, England, United Kingdom
Email: admin@loyala.com
AutoSaber is powered by Shopify Inc., which provides the technical infrastructure for our store. Where Shopify independently processes your personal data for its own purposes (for example, in connection with its platform-wide features), Shopify acts as a separate data controller. Please see the section below titled "Our Relationship with Shopify" for further detail.
What "Personal Information" Means
When we refer to "personal information," we mean any information that identifies you or can reasonably be linked to you. This does not include anonymised or de-identified data that cannot be connected back to any individual.
Personal Information We Collect
Information you provide directly
- Contact details: your name, email address, phone number, billing address, and shipping address
- Account information: your username, password, security questions, and preferences
- Payment information: card type, payment confirmation, and transaction details (card numbers are processed directly by our payment processor and are not stored on AutoSaber systems)
- Order and transaction information: items purchased, returned, exchanged, or cancelled, and your order history
- Communications with us: any information you include in emails, support enquiries, or other messages you send us
- Feedback and reviews: content you submit, post, or upload to the Services
Information collected automatically
- Device and browser information: your IP address, browser type, operating system, and device identifiers
- Usage information: pages visited, time on site, items viewed or added to your cart, and how you navigate the store
- Cookies and tracking data: information collected via cookies and similar technologies (see the Cookies section below)
Information from third parties
- From our payment processors, logistics providers, and fulfilment partners in connection with your orders
- From Shopify, including data collected in connection with platform-wide features
- From analytics or advertising partners, in aggregated or anonymised form
How We Use Your Personal Information
We use your personal information for the following purposes, on the lawful bases set out in Article 6 of the UK GDPR:
To fulfil your order and provide the Services (contractual necessity — Article 6(1)(b))
- Processing your payment and confirming your order
- Arranging dispatch, shipping, and delivery
- Managing returns, exchanges, and refunds
- Maintaining your account and preferences
- Sending order-related notifications (confirmation, dispatch, delivery updates)
To comply with legal obligations (Article 6(1)(c))
- Retaining financial transaction records for HMRC compliance (minimum 6 years under the Finance Act 1998)
- Responding to lawful requests from courts, regulators, or law enforcement
- Fraud prevention and detection
For our legitimate interests (Article 6(1)(f))
- Website analytics to understand how customers use our store and improve it
- Security monitoring and fraud prevention
- Personalising your shopping experience based on your browsing and purchase history
- Enforcing our Terms of Service and resolving disputes
With your consent (Article 6(1)(a))
- Sending marketing and promotional emails where you have opted in
- Placing non-essential cookies on your device
How We Share Your Personal Information
We do not sell your personal data. We may share it with third parties only in the following circumstances:
- Shopify: as our store platform provider. Shopify processes data on our behalf to host and operate the store, and independently for its own platform purposes (see below)
- Payment processors (e.g. Stripe, PayPal) to securely process transactions
- Logistics and fulfilment partners to arrange delivery of your order
- Marketing and analytics partners where you have consented, or where data is aggregated and anonymised
- Legal and regulatory authorities where required by law, legal process, or to protect our legal rights
- Business transfers: in connection with a merger, acquisition, or sale of assets, your data may be transferred as part of that transaction
All third-party processors who handle your data on our behalf are required to comply with applicable data protection law and are bound by appropriate data processing agreements.
Our Relationship with Shopify
AutoSaber's store is hosted on Shopify's platform. Any purchases you make are made directly with AutoSaber; Shopify is not a party to the sale. However, Shopify independently collects and processes certain personal data about your use of the store in order to provide and improve its platform services.
To the extent that Shopify processes your data for its own purposes, Shopify acts as an independent data controller and is responsible for responding to rights requests relating to that processing. You can learn more at Shopify's Privacy Policy and exercise relevant rights via the Shopify Privacy Portal.
International Data Transfers
AutoSaber operates globally and some of our service providers (including Shopify and certain logistics and analytics partners) may process your data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with Chapter V of the UK GDPR, including:
- Transfers to countries with a UK adequacy decision
- Standard Contractual Clauses (SCCs) approved for UK use by the ICO
- Other legally recognised transfer mechanisms where applicable
Data Retention
We retain your personal data only for as long as is necessary for the purposes it was collected, or as required by law. Our standard retention periods are:
- Order and transaction records: 6 years from the date of transaction (required by HMRC)
- Customer service communications: 2 years from last interaction
- Account data: for the duration your account is active, plus 12 months
- Marketing consent records: for the duration of consent plus 1 year
- Website analytics data: up to 26 months
After the applicable retention period, data is securely deleted or irreversibly anonymised.
Your Rights Under UK GDPR
If you reside in the United Kingdom or the European Economic Area, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to legal exceptions:
- Right of access (Article 15): to request a copy of the personal data we hold about you
- Right to rectification (Article 16): to request correction of inaccurate or incomplete data
- Right to erasure (Article 17): to request deletion of your data in certain circumstances
- Right to restrict processing (Article 18): to request we limit how we use your data
- Right to data portability (Article 20): to receive your data in a structured, machine-readable format
- Right to object (Article 21): to object to processing based on legitimate interests or for direct marketing purposes
- Right to withdraw consent: where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, email us at admin@loyala.com with the subject line "Data Subject Request." We will respond within one calendar month in accordance with Article 12 UK GDPR. If you are dissatisfied with our response, you may lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk. For EEA residents, a list of national data protection supervisory authorities is available at edpb.europa.eu.
We will not discriminate against you for exercising any of these rights. We may need to verify your identity before processing your request. You may designate an authorised agent to act on your behalf, subject to providing appropriate proof of authorisation.
Managing Communication Preferences
If you have opted in to marketing emails, you may unsubscribe at any time by clicking the "unsubscribe" link in any marketing email we send. If you opt out of marketing communications, we may still send you non-promotional messages relating to your account or orders.
Cookies
We use cookies and similar tracking technologies on the AutoSaber website. Cookies are small text files placed on your device by your browser. We use the following types:
- Strictly necessary cookies: essential for the website to function. These cannot be disabled.
- Analytics cookies: to understand how visitors use our store, helping us improve it. These require your consent.
- Marketing/advertising cookies: to enable relevant advertising and personalisation. These require your consent.
You can manage your cookie preferences through our cookie consent banner when you first visit the site, or at any time through your browser settings. Withdrawing consent does not affect the lawfulness of any processing that took place before withdrawal.
Children's Data
The AutoSaber website is not intended for use by children. We do not knowingly collect personal data from anyone under the age of majority in their jurisdiction. If you are a parent or guardian and believe your child has provided us with their personal information, please contact us at admin@loyala.com and we will delete it promptly. As of the effective date of this policy, we do not knowingly sell or share the personal information of individuals under 16 years of age.
Security
We implement appropriate technical and organisational security measures to protect your personal data from unauthorised access, loss, alteration, or disclosure. These measures include SSL/TLS encryption, access controls, and secure payment processing via PCI-compliant payment providers. However, no system is completely impenetrable, and we cannot guarantee absolute security. We recommend you do not communicate sensitive information to us over unsecure channels.
Third-Party Websites and Links
Our website may contain links to third-party websites or platforms. These sites operate independently of AutoSaber and are governed by their own privacy policies. We are not responsible for the privacy practices, content, or security of any third-party site. Our inclusion of a link does not imply any endorsement of that site or its operators.
Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the revised policy on this page and update the "Last updated" date. Where changes are material, we will provide notice in accordance with applicable law. We encourage you to review this page periodically.
Contact Us
For any questions about this Privacy Policy, to exercise your data rights, or to make a complaint about how we handle your personal data, contact us at:
Email: admin@loyala.com (subject line: "Privacy Enquiry" or "Data Subject Request")
Operated by: Monty Bowden & Shahmir Shaheryar trading as AutoSaber
Address: 12 Holly Grove, Sale, M33 2DS, England, United Kingdom