Privacy Policy – UK
Last updated: Novembe 20, 2025
This Privacy Policy explains how GTI Graph Tech Innovations Ltd. (“Graph Tech”, “we”, “us”, “our”) collects, uses, and protects your personal data when you use our website and purchase our products, including from the UK, in accordance with the UK General Data Protection Regulation (“UK GDPR”).
1. Who we are (Data Controller)
The data controller responsible for your personal data is:
GTI Graph Tech Innovations Ltd.
5–7551 Vantage Way
Delta, BC V4G 1C9
Canada
5–7551 Vantage Way
Delta, BC V4G 1C9
Canada
Email: support@graphtech.com
We are based in Canada and use third-party logistics (“3PL”) partners in the United Kingdom to store and ship goods to UK customers. These partners act on our instructions as service providers; they are not the data controller.
Our current UK 3PL provider is:
Vader Group Ltd
c/o Miage Fulfilment
Unit 3 Station Business Park
Back Station Road
Mirfield, West Yorkshire
WF14 8QF
United Kingdom
c/o Miage Fulfilment
Unit 3 Station Business Park
Back Station Road
Mirfield, West Yorkshire
WF14 8QF
United Kingdom
If you have any questions about this Privacy Policy or how we handle your personal data, you can contact us at the email above.
2. What personal data we collect
We may collect and process the following categories of personal data:
Information you provide directly
-
Contact details (name, billing and shipping address, email address, phone number)
-
Account details (login, password, order history)
-
Payment information (payment method, transaction details – card details are processed by our payment provider and are not stored in full by us)
-
Communications (emails, contact forms, customer service enquiries, reviews, warranty/registration forms)
Information collected automatically
-
Device and usage data (IP address, browser type, device type, operating system, time zone, pages viewed, links clicked)
-
Cookie and tracking data (for essential site functionality, analytics, and online advertising – see “Cookies & similar technologies” below)
Information from third parties
-
Data from payment providers, fraud-prevention services and delivery partners
-
Data from advertising partners (for example, which advertisement or campaign referred you to our site – usually aggregated or pseudonymous)
3. Why we use your personal data (legal bases)
We process your personal data only where we have a lawful basis under UK GDPR. Depending on the context, this will be:
a) Performance of a contract
To process and fulfil your orders, including:
To process and fulfil your orders, including:
-
Creating and managing your account
-
Taking payment and providing refunds
-
Shipping your products and managing delivery issues
-
Providing customer service and after-sales support
b) Legitimate interests
To pursue our legitimate business interests, for example:
To pursue our legitimate business interests, for example:
-
To respond to enquiries and provide customer support
-
To improve our website, products and services
-
To prevent fraud and protect the security of our systems
-
To conduct basic analytics on how our website is used
Where we rely on legitimate interests, we always balance them against your rights and expectations.
c) Legal obligations
To comply with our legal and regulatory obligations, such as:
To comply with our legal and regulatory obligations, such as:
-
Tax and accounting requirements
-
Record-keeping, including VAT and customs records
-
Complying with lawful requests from public authorities
d) Consent
We may rely on your consent for:
We may rely on your consent for:
-
Certain types of marketing communications (where required by law)
-
Non-essential cookies and similar tracking technologies
Where we rely on consent, you can withdraw it at any time (see “Your rights” below).
4. How we use your personal data
We use your personal data for the following purposes:
-
To provide our products and services – processing your orders, payments, deliveries, returns and warranty claims.
-
To manage your account – registration, login, order history and preferences.
-
To communicate with you – service emails related to orders, account changes, or customer support.
-
To send marketing communications – where permitted, we may send you news, product updates, offers and promotions that we think may interest you. You can opt out at any time via the unsubscribe link or by contacting us.
-
To improve and protect our business – analytics, testing, troubleshooting, security monitoring, fraud prevention and site optimisation.
-
To comply with law – keeping appropriate records for tax, VAT, customs and regulatory purposes.
5. Cookies & similar technologies
Our website uses cookies and similar technologies:
-
Strictly necessary cookies – required for the site to function (e.g. shopping cart, checkout, security). These are always active.
-
Analytics cookies – to help us understand how visitors use our site (for example, pages visited, time on page), so we can improve performance and user experience.
-
Advertising / referral cookies – used together with our online advertising partners to understand which adverts brought you to our website and measure the effectiveness of campaigns. This information is generally collected in an aggregated or pseudonymous way and does not directly identify you where possible.
On your first visit, and periodically thereafter, you may be presented with a cookie banner allowing you to accept or manage non-essential cookies. You can also control cookies through your browser settings; however, blocking certain cookies may affect site functionality.
6. Who we share your personal data with
We do not sell your personal data.
We may share your personal data with trusted third parties who help us operate our business, for example:
-
Payment processors – to process your payments securely.
-
Logistics and delivery partners – including Vader Group Ltd / Miage Fulfilment in the UK, to store inventory, pick and pack orders, and handle deliveries and returns.
-
IT and hosting providers – to host our website, store data and provide technical support.
-
Analytics and advertising partners – to operate analytics and online advertising (in a way that does not directly identify you, where possible).
-
Professional advisers – such as accountants, auditors, lawyers and tax advisers.
-
Authorities and regulators – where required by law, or to protect our rights or the rights of others.
These service providers are only allowed to use your data as necessary to provide their services to us, and must keep your information confidential and secure.
7. International data transfers
We are a Canadian-based company and your personal data will be stored and processed in Canada and other countries outside the UK, including where some of our service providers are located (for example, IT hosting, payment processing and logistics partners).
These countries may have different data protection laws than those in the UK. When we transfer your personal data outside the UK, we take steps to help ensure it is protected, such as:
-
Including data protection terms or standard contractual clauses in our contracts with service providers; and
-
Limiting access to your personal data to those who need it to perform their services for us.
You can contact us if you would like more information about these safeguards.
8. How long we keep your data
We keep your personal data only for as long as necessary for the purposes described above, including:
-
Orders and accounts – generally kept for up to 6–7 years to meet tax, accounting and legal requirements.
-
Customer service communications – kept as long as needed to manage your enquiry or claim.
-
Marketing data – kept until you unsubscribe or object, or until we determine it is no longer useful.
When data is no longer required, we will delete it or anonymise it.
9. Your rights (UK & EU residents)
Under data protection law, you have the following rights (subject to certain conditions and exemptions):
-
Right of access – to obtain a copy of the personal data we hold about you.
-
Right to rectification – to correct inaccurate or incomplete data.
-
Right to erasure (“right to be forgotten”) – to request deletion of your data where we no longer need it, or where you withdraw consent and there is no other legal basis.
-
Right to restriction – to restrict how we use your data in certain circumstances.
-
Right to data portability – to receive some of your data in a structured, commonly used, machine-readable format and transmit it to another controller.
-
Right to object – to object to processing based on our legitimate interests, including profiling, and to object at any time to direct marketing.
-
Right to withdraw consent – where we rely on your consent, you can withdraw it at any time.
To exercise any of these rights, please contact us at [insert privacy email] with sufficient information to identify you (e.g. name, email, order number).
10. Complaints
If you are unhappy with how we handle your personal data, please contact us first so we can try to resolve your concerns.
You also have the right to lodge a complaint with the UK data protection authority:
11. Children
Our website and products are not intended for children under 16, and we do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.
12. Changes to this Privacy Policy
We may update this Privacy Policy from time to time, for example to reflect changes in law or how we operate. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy regularly.
13. Your rights under the California Consumer Privacy Act (CCPA) – for US visitors
If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect and use, the right to request deletion of your personal information, and the right to opt out of the “sale” of your personal information.
We do not sell your personal information for money; however, certain data sharing for advertising may be considered a “sale” under the CCPA. If you are a California resident and want to exercise your CCPA rights, please contact us at [insert privacy email] and mention “CCPA request” in your message.
