1This policy
CCTV Gear: the personal data collected from customers and site visitors, its purposes and the protection applied to it.
2Data collected
Collection points: account sign-up, ordering, contact with us. Data: name, business name (optional), postal address, email, phone number, payment details.
3Purposes
Order processing, account management, support when you contact us, relevant product updates, legal compliance.
4Recipients
Personal data is never sold. Recipients: couriers and payment processors, for delivery and payment, plus any body the law requires us to disclose to.
5Security
Technical and organisational safeguards against loss, misuse and access without permission.
6Your rights
Rights over your data: see it, correct it, delete it; object to, or restrict, some processing. To use one, contact us.
Activity log: specification
Activity log, kept apart from analytics. Use: evidence for four incident types: disputed order, account takeover, suspected fraud, catalogue and price scraping by bots.
Logged
- Pages opened, with timestamps
- Account events: failed sign-in, sign-in, sign-out
- Shop events: add to basket, checkout start, order placed, quote request, file download
- IP address
- Device type, OS and browser (e.g. “desktop, Linux, Firefox”)
- Staff accounts: each record change, what changed, and any refused access attempt
Not logged
- Passwords, card numbers, security codes: stripped before storage
- Query strings, meaning anything after
?in a URL, since reset tokens and sign-in links can be carried there - Typed content, keystrokes, mouse movement, scrolling
Identity link
Signed in: entries are filed under the account. Not signed in: under a random browser ID only, never name, email or address; and nothing is written until analytics cookies are accepted (see the Cookie Policy).
Retention
- Entries: 180 days, then deleted automatically.
- Audit log (retained beyond 180 days, because a legal claim may have to be defended or resolved): data exports, refunds, permission changes, staff views of customer records, sign-ins.
Lawful basis
- Not signed in: consent, set via the cookie banner, with refusal the default until you choose and always available.
- Signed in: legitimate interests (ours): payment and account security; fraud prevention; resolving disputes over an order’s contents or who placed it. Balanced against your interests. Limits: only what those purposes need; no typed content; search restricted to staff with specific access; each search is logged; entries expire after six months.
Access
Opened only by CCTV Gear staff named for it and cleared for support, security or fraud work; closed to other staff, withheld from advertisers, never sold.
Rights
Your record: a copy, or its deletion, on request. Objection: you may object to the record being retained where legitimate interests are the basis. Analytics consent: revocable any time, via your browser’s cookie settings. Requests: [email protected].
Regulator for complaints: Information Commissioner’s Office, ico.org.uk.