Privacy policy
Last Updated: 1 July 2026
This Privacy Policy explains what personal data Ultra Spray collects when you visit ultrasprayuk.com or buy from us, how we use it, who we share it with and the rights you have. It is issued under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR). For customers in Ireland and the European Union, the EU General Data Protection Regulation (EU GDPR) applies in the same way.
| Purpose | Category of information | Lawful basis |
|---|---|---|
| Processing, delivering and supporting your order, including returns and refunds | Identity, contact, order and payment data | Performance of a contract |
| Answering your questions and warranty or Shipping Protection claims | Identity, contact, order data and messages | Contract; legitimate interests |
| Preventing fraud and keeping our website and payments secure | Identity, payment and technical data | Legitimate interests; legal obligation |
| Keeping accounting and tax records | Order and payment data | Legal obligation |
| Marketing emails to existing customers about similar products | Contact data and preferences | Legitimate interests (PECR "soft opt-in"); you can opt out at any time |
| Marketing emails to non-customers, and all SMS marketing | Contact data and preferences | Consent |
| Analytics, personalisation and advertising cookies and pixels | Technical and usage data | Consent |
1. Who We Are
Ultra Spray Ltd, trading as Ultra Spray, is the data controller responsible for your personal data. Our online store runs on Shopify, which processes data on our behalf. For any privacy question or to exercise your rights, email support@ultrasprayuk.com.
2. Personal Information We Collect
Information you give us:
- Identity and contact data: name, email address, phone number, billing and delivery address.
- Order data: products bought, add-ons, order history and delivery instructions.
- Payment data: payment method, card type and last four digits. Full card details go directly to our payment providers. We never see or store them.
- Messages: emails, warranty or Shipping Protection claims, photos you send us and reviews.
- Account data, if you create an account.
Information collected automatically: IP address, device and browser type, pages viewed, products browsed, how you reached our site and how you use it. This is collected through cookies and similar technologies (see section 6).
Information from others: payment confirmations and fraud checks from our payment providers, delivery updates from carriers, and advertising and analytics data from Meta, Google and TikTok where you have agreed to those cookies.
We do not collect special category data (such as health or biometric data).
3. How We Use Your Information
We use your information for the purposes, and on the lawful bases, set out in the table at the top of this policy. Where we rely on legitimate interests, we have checked that they do not override your rights.
4. Automated Decision-Making
Our payment providers use automated fraud screening, which may decline a transaction. If you think an order was wrongly declined, contact us and a member of our team will review it.
5. Who We Share Your Information With
We share personal data only with providers who need it to provide services to us, under contracts that require them to protect it:
- E-commerce platform: Shopify (hosting, checkout and order management).
- Payment providers: Shopify Payments (operated by Stripe), Apple Pay, Google Pay and Shop Pay.
- Delivery partners: Royal Mail and other tracked couriers.
- Email and SMS: Klaviyo.
- Advertising and analytics: Meta (Facebook and Instagram), Google and TikTok, only where you have consented to these cookies.
- Professional advisers: accountants, lawyers and insurers.
- Authorities: regulators, law enforcement or courts where the law requires it, or to protect our legal rights, including in payment disputes.
We do not sell your personal data.
6. Cookies and Online Tracking
We use strictly necessary cookies to run the website and checkout. Analytics, personalisation and advertising cookies and pixels (including the Meta pixel and Conversions API, Google and TikTok) are only used once you accept them in our cookie banner. You can change or withdraw your consent at any time using the cookie settings link in the website footer.
7. How Long We Keep Your Information
| Information | Retention period |
|---|---|
| Order, payment and transaction records | 6 years from the end of the financial year of the order (HMRC requirement) |
| Warranty and extended warranty records | For the length of the warranty, plus 1 year |
| Customer account data | Until you close your account, or 2 years after your last activity |
| Customer service messages | 3 years after the issue is resolved |
| Marketing preferences | Until you unsubscribe. We keep a record of the opt-out so we do not contact you again. |
| Cookie and analytics data | Up to 13 months |
8. International Transfers
Shopify, Stripe, Klaviyo, Meta, Google and TikTok may process data outside the UK and European Economic Area, including in Canada and the United States. Where data is transferred, it is protected by UK or EU adequacy decisions, the UK Extension to the EU-US Data Privacy Framework, or standard contractual clauses (including the UK International Data Transfer Addendum). You can ask us for a copy of the safeguards.
9. Your Privacy Rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased in certain circumstances;
- restrict or object to our processing, including objecting to direct marketing at any time;
- receive your data in a portable format;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email support@ultrasprayuk.com. It is free, and we will reply within one month. We may ask you to verify your identity first.
10. Marketing Emails & SMS
We only send marketing emails or texts where the law allows: to customers about similar products (you can opt out at any time), or where you have given consent. Every message includes a way to unsubscribe, and texts include a STOP option. Service messages about your order, such as confirmations and tracking, are not marketing and will still be sent.
11. Security and Data Breaches
Our website uses TLS encryption, and payments are processed by PCI DSS compliant providers. We never see your full card number. Access to customer data is limited to staff and providers who need it. If a data breach is likely to put you at high risk, we will tell you and the relevant regulator as the law requires.
12. Children
Our website and products are for adults. We do not knowingly collect data from anyone under 18. If you think we have, contact us and we will delete it.
13. Third-Party Websites
Our website may link to other websites. We are not responsible for their content or privacy practices, and this policy does not apply to them.
14. Changes to This Policy
We may update this policy from time to time. The current version and its date are always on this page, and we will tell you about any important change by email or a notice on our website.
15. Contact Us
Ultra Spray Ltd, trading as Ultra Spray
Registered Office: Unit 7, East Moons Moat Industrial Estate, Oxleasow Road, Redditch, Worcestershire, B98 0RE, United Kingdom
Phone: +44 7460 018411
Email: support@ultrasprayuk.com
Support hours: Monday to Friday, 9am to 5pm UK time (excluding UK bank holidays). We aim to reply within 1 business day.
If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. Customers in Ireland can complain to the Data Protection Commission at dataprotection.ie, and customers elsewhere in the EU to their local data protection authority.