Privacy Policy

1. Who We Are

Data Controller: Coomo UK Ltd (“Coomo”)

• Reg. No.: 13152984
• Unit 2 Warwick Court, Saxon Business Park Hanbury Road, Stoke Prior, Bromsgrove, United Kingdom, B60 4AD
• Tel: +44 121 272 3346
• Email: sales@coomo.uk
• Information Officer: Ms. Dora, dora@coomo.uk

2. Personal Data We Collect

We do not intentionally collect special category data. Please avoid sending it to us.

3. Why We Use Your Data and Lawful Bases

We process personal data under the UK GDPR and, where applicable, the EU GDPR. Our purposes and lawful bases include the following.

• Responding to enquiries, lawful basis, legitimate interests, or consent where you request a callback.
• Preparing and performing contracts, lawful basis, contract.
• Legal compliance for billing and taxes, lawful basis, legal obligation.
• Website security and fraud prevention, lawful basis, legitimate interests.
• Analytics, lawful basis, consent under PECR and UK GDPR, collected only after you accept non essential cookies.
• Direct marketing to existing customers for similar products, lawful basis, legitimate interests using PECR soft opt in, you can opt out at any time.
• Direct marketing to new prospects, lawful basis, consent under PECR.

You can ask us for more detail about our legitimate interest assessments.

4. Sharing and Disclosure

We never sell your data. We share it only with the following recipients.

1. Service providers acting as processors, hosting, email delivery, CRM, analytics, customer support, under written data processing agreements.
2. Professional advisers and auditors, acting as independent controllers where applicable.
3. Regulators, courts, and law enforcement when legally required.

5. International Data Transfers

We may transfer and store your personal data outside the United Kingdom, and for EU users, outside the European Economic Area. Whenever we do this, we will ensure a level of protection equivalent to that required by the UK GDPR, and where applicable, the EU GDPR.

• Adequacy: We may transfer data to countries that benefit from a UK adequacy regulation, or an EU adequacy decision for EEA users.
• Appropriate safeguards: Where adequacy does not apply, we use legally approved safeguards, for example the ICO’s International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, together with technical and organisational measures where needed. You can request a copy of these safeguards by contacting us.
• Processors and cloud services: We have data processing agreements in place with our service providers in line with Article 28 UK GDPR, including obligations on confidentiality, security, and sub processing approvals.
• Derogations: In limited cases, we may rely on a permitted derogation, for example your explicit consent, transfers necessary for the performance of a contract with you, or the establishment, exercise, or defence of legal claims.

We review our transfer mechanisms regularly and will update this notice if our destinations or safeguards change.

6. Security Measures

• TLS encryption, HTTPS
• Role based access and MFA
• Daily off site backups and periodic security testing
• Vendor due diligence and least privilege

If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner’s Office and, where required, affected individuals.

7. Retention Periods

We keep enquiry emails for 2 years, contract records for 7 years for tax, and server logs for 12 months. When fixed periods do not apply, we use these criteria, legal requirements, the nature and sensitivity of the data, and the need to establish, exercise, or defend legal claims. After the relevant period we delete or anonymise the data.

8. Your Rights

You may exercise the rights set out below, subject to conditions in law.

• Access and rectification
• Erasure, where applicable
• Restriction of processing
• Portability for data you provided to us
• Object to processing based on legitimate interests, including profiling
• Withdraw consent at any time, this does not affect processing that has already happened

Email dora@coomo.uk. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner’s Office, ico.org.uk, Tel 0303 123 1113.

9. Cookies & Analytics

We use essential cookies that are needed for the site to function. We use analytics and other non essential cookies only with your consent. You can change or withdraw your consent at any time using the cookie settings link in the footer. Blocking cookies may limit some features.

For Google Analytics, IP addresses may be truncated and data is retained according to our analytics retention schedule. We do not use analytics data to identify you directly.

10. Direct Marketing

We send newsletters only if you opted in, or, if you are an existing customer, we may send emails about similar products or services under the soft opt in permitted by PECR. You can unsubscribe at any time using the link in the email footer or by contacting us.

11. Automated Decision Making and Profiling

We do not carry out automated decision making that produces legal or similarly significant effects, and we do not profile individuals for marketing beyond basic segmentation such as subscriber status and preferences.

12. Changes to This Policy

Material updates will be announced on our website banner or via email. Updated versions take effect on publication.

13. Contact

Information Officer
Coomo UK Ltd
Unit 2 Warwick Court, Saxon Business Park Hanbury Road, Stoke Prior, Bromsgrove, United Kingdom, B60 4AD
dora@coomo.uk · +44 121 272 3346