1. Who we are

The controller responsible for your personal data

Elarix Medical Ltd is the data controller for personal data processed through elarixmedical.co.uk. We are a UK company supplying own-brand sleep therapy consumables to businesses, under the Alvera brand.

We are registered in England and Wales, company number 16602969, at Unit 3, Twenty4 Secure Storage, Armley, Leeds, LS12 4HP. Goods are held and dispatched from the same address.

We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

2. What personal data we collect

The categories of data we hold, and where they come from

We sell to businesses rather than consumers, so most of the data we hold relates to people acting in a professional capacity: buyers, clinicians and account contacts at the organisations we supply.

Most of this comes directly from you. Some, such as company registration and VAT details, we may verify against public registers including Companies House, HMRC's VAT checking service and the EU VIES system.

3. Trade account applications

What happens to the information on your application

When you apply for a trade account we collect your company details, VAT number, company registration number and the contact details of the person applying. We use this to confirm you are a genuine business eligible to buy from us.

Verification

We check the VAT number you give us against HMRC's public service for UK numbers, or the European Commission's VIES service for EU numbers. We may keep the consultation reference these services provide as evidence that a check was carried out. We may also check your company registration against Companies House.

Decisions

Applications are reviewed by a person, not by automated means. There is no automated decision-making or profiling that produces legal effects for you. If we decline an application we will tell you, and you may ask us to reconsider.

Unsuccessful applications

Where an application is declined we keep a minimal record of the decision and its reason, so we can answer questions and avoid repeatedly reassessing the same application.

4. Legal basis for processing

The lawful grounds we rely on

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights. You can object to this processing at any time using the contact details below.

5. How we use your data

The purposes we process it for

• Assessing and setting up trade accounts, including applying the correct pricing and payment terms
• Processing orders, arranging dispatch from Leeds, and handling collections and returns
• Issuing invoices and, where terms are agreed, managing credit and payment
• Providing product documentation such as instructions for use and declarations of conformity
• Responding to quote requests and trade desk enquiries
• Meeting our obligations for traceability and, where required, safety notices or recalls
• Improving the website, our range and our service

6. Who we share your data with

The categories of recipient, and why

• Shopify, which hosts this store and processes orders and accounts on our behalf
• Payment providers, who process card and bank payments and hold the card data we do not
• Carriers and logistics partners, who need delivery names, addresses and contact numbers
• Accounting and tax advisers, and HMRC where the law requires
• IT, hosting and support providers who maintain our systems
• Regulators and authorities, including the MHRA, where a safety or compliance obligation applies
• Professional advisers such as solicitors and insurers, where necessary

We do not sell personal data, and we do not share it with third parties for their own marketing.

7. International transfers

When data leaves the UK, and how it is protected

Some of our providers process data outside the UK. Where that happens we rely on UK adequacy regulations for the country concerned, or on the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, together with any additional safeguards the transfer requires.

You may ask us for details of the safeguards applied to a particular transfer.

8. How long we keep it

Our retention periods

9. Cookies

What we set, and how to control it

We use cookies that are strictly necessary to run the store: keeping you signed in, holding your basket, and applying your account's pricing. These cannot be turned off without breaking the site.

We also use analytics and performance cookies, which we set only with your consent. You can change your choice at any time through the cookie preferences link on this site, or by clearing cookies in your browser.

10. Marketing

What we send, and how to stop it

If you hold an account with us we may send trade updates about new lines, stock notices and price changes, on the basis of our legitimate interest in serving existing customers. Every message carries an unsubscribe link.

Where you are not yet a customer we contact you only if you have asked us to.

Some messages are not marketing and will continue regardless of your preferences: order confirmations, dispatch notices, invoices, account changes and product safety information.

11. Your rights

What you can ask us to do

• Access a copy of the personal data we hold about you
• Rectification of anything inaccurate or incomplete
• Erasure, where we no longer have a lawful reason to keep it
• Restriction of processing in certain circumstances
• Portability of data you provided, in a machine-readable form
• Objection to processing based on legitimate interests, including profiling
• Withdrawal of consent at any time, where consent is the basis we rely on

Write to support@elarixmedical.co.uk. We respond within one month, and will tell you if we need longer because a request is complex.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you raised it with us first so we can put it right.

12. Security

How we protect personal data

The store runs over encrypted connections, and payment data is handled by PCI-compliant providers rather than by us. Access to customer and account data is limited to staff who need it, and is removed when they no longer do.

If a breach occurs that is likely to result in a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours and tell you where the law requires.

13. Changes to this policy

How we handle updates

We review this policy periodically and when our practices change. The current version is always at elarixmedical.co.uk/pages/privacy-policy, with the effective date at the top. Where a change materially affects how we use your data, we will tell account holders directly.

14. Contact us

How to reach us about your data