Privacy Policy – Zempire EU

We are committed to protecting the privacy and security of your personal information. This Privacy Policy explains how we collect, use, store and share your personal information when you interact with us as a customer in the European Union, in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable local laws.

1. Data Protection Principles

Under GDPR, we must ensure that your personal data is:

Processed lawfully, fairly and transparently
Collected for specified, explicit and legitimate purposes and not further processed in a way that is incompatible with those purposes
Adequate, relevant and limited to what is necessary
Accurate and kept up to date
Kept only for as long as necessary for the purposes for which it is processed
Kept securely using appropriate technical and organisational measures

2. What Information We Collect and Why

2.1 Personal data we collect

“Personal data” means any information relating to an identified or identifiable natural person. It does not include anonymous data where the identity has been removed.

We collect, store and use the following categories of personal data when you create an account, make a purchase, interact with our website, or sign up to our newsletter:

Identity and contact details – name, title, billing and delivery addresses, telephone number, email address
Account information – login details, order history, communication preferences
Transaction data – details of products purchased, dates of orders, payment status (we do not store full card details)
Technical and usage data – IP address, browser type and version, device identifiers, pages viewed, time and date of visits, referring URLs
Marketing and communications data – your preferences in receiving marketing from us and your communication preferences

We may also collect any information you provide when you contact us (e.g. customer service queries, product feedback).

2.2 Lawful bases for processing

We process your personal data under one or more of the following lawful bases:

Contract (Art. 6(1)(b) GDPR) – to process and fulfil your orders, manage payments, deliver products, manage your account and provide customer support
Legal obligation (Art. 6(1)(c) GDPR) – to comply with legal and regulatory requirements (for example, tax and accounting rules)
Legitimate interests (Art. 6(1)(f) GDPR) – to improve our products and services, ensure website security, prevent fraud and to send limited direct marketing to existing customers, where permitted
Consent (Art. 6(1)(a) GDPR) – for email marketing and certain cookies/online tracking where required by law

2.3 Marketing and consent

We undertake marketing activities in compliance with GDPR and e-privacy rules:

We ask you to positively opt in to receive email marketing where required
Requests for consent are separate from our terms and conditions and clearly worded
You can withdraw your consent at any time (see Section 3) without detriment
We keep a record of when and how consent was obtained, and what you were told at the time

We will not sell your personal data. We will only share it with:

Payment service providers (e.g. card processors)
Postal and courier companies
IT and hosting providers
Other third parties where required by law or with your consent

3. Consent and Your Choices

3.1 How we obtain consent

When you provide personal information to create an account, complete a transaction, verify your payment method, place an order, arrange a delivery or return a purchase, we process that data to perform our contract with you.

For secondary purposes, such as email marketing, we will ask for your explicit consent where required and give you a clear opportunity to say yes or no.

3.2 How to withdraw consent

You can withdraw your consent to marketing or certain other processing at any time by:

Clicking the “unsubscribe” link in any marketing email we send, or
Contacting us at info@zempire.co.uk

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. We may still need to process some data where required by law or necessary to perform our contract with you.

4. Disclosure of Your Personal Data

We may disclose your personal data:

Where required by law, regulation or court order
To enforce our Terms and Conditions
To professional advisers (such as auditors or legal advisers) under appropriate confidentiality obligations

We ensure that any third parties who process personal data on our behalf do so only on our instructions and subject to appropriate contractual safeguards.

5. Website, Hosting and Payment Security

Our website is hosted on secure servers behind firewalls. Your personal data is stored within our business systems using technical and organisational measures designed to protect against unauthorised access, loss, misuse or alteration.

We keep and process your personal data only for as long as necessary for the purposes for which it was collected, unless we have a legal obligation or overriding legitimate interest to retain it for longer (for example for tax, accounting or legal claims).

5.1 Payment methods and security

We use secure payment service providers (for example, Sage Pay) to process card payments. These providers:

Are PCI DSS compliant
Use strong encryption (for example 256-bit encryption and SSL)
Implement fraud screening and other security measures

We do not store your full credit or debit card details on our own servers.

You may wish to review Sage Pay’s own privacy policy directly on their website for more information about how they handle your data.

6. Third-Party Services and International Transfers

6.1 Third-party service providers

We use third parties to provide services such as website hosting, payment processing, delivery and analytics. These providers will only process your data to the extent necessary to perform their services for us and are bound by contractual obligations to keep your data secure and confidential.

When you leave our website or are redirected to a third-party site or app, this Privacy Policy no longer applies and we encourage you to read the privacy policies of those third parties.

6.2 International data transfers

We may transfer your personal data outside the European Economic Area (“EEA”), including to New Zealand and other countries.

The European Commission has determined that New Zealand ensures an adequate level of data protection (Article 45 GDPR), which means transfers from the EEA to New Zealand may take place without additional safeguards.
For transfers to countries without an adequacy decision, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, and implement additional measures where necessary.

You can contact us at info@zempire.co.uk for more information about international transfers and safeguards.

7. Security

We take reasonable and appropriate technical and organisational measures to protect your personal data, including:

Encryption (including SSL for data in transit)
Access controls and authentication
Firewalls and secure hosting
Regular monitoring and testing where appropriate

Although no method of transmission or storage is completely secure, we follow industry best practices and applicable standards (including PCI-DSS for payment data processed by our payment providers).

8. Cookies

8.1 What are cookies?

Cookies are small text files stored on your device when you visit a website. They can be essential for functionality (e.g. keeping items in your basket) or used for analytics and marketing.

8.2 Types of cookies we use

Session cookies – temporary cookies that are deleted when you close your browser. They help the site function during your visit (e.g. keeping track of your basket).
Persistent cookies – remain on your device for a set period or until deleted. They remember your preferences and help us understand how our website is used over time.

We use cookies for purposes such as:

Operating and improving the website
Remembering your preferences and login details
Analysing site usage (e.g. which pages are visited)
Delivering and measuring marketing and advertising (where permitted)

8.3 Managing cookies

When you first visit our site, you may see a cookie banner allowing you to accept or manage cookies (where required by law).

You can also control cookies through your browser settings, including blocking certain types or deleting them. If you disable some cookies, parts of our website may not function properly.

For more details, please see our separate Cookie Policy if available.

9. Age of Consent

Our website and services are not intended for children under the age of 16.

By using this site, you confirm that you are at least 16 years old or, where required by local law, that you are over the age of majority in your country. We do not knowingly collect personal data from children under 16 without appropriate parental or guardian consent.

If you believe a child has provided us with personal data without consent, please contact us at info@zempire.co.uk and we will take appropriate steps.

10. Data Retention

We will retain your personal data only for as long as necessary to fulfil the purposes we collected it for, including:

Fulfilling orders and providing services
Maintaining your account (if applicable)
Satisfying legal, accounting, or reporting obligations
Handling disputes and enforcing our agreements

Retention periods are determined based on the nature of the data, the purpose of processing and applicable legal requirements. After the relevant retention period, data will be securely deleted or anonymised.

11. Your Rights Under GDPR

Under GDPR, you have the following rights (subject to certain conditions and exemptions):

Right of access – to obtain a copy of your personal data and information about how we process it
Right to rectification – to correct inaccurate or incomplete data
Right to erasure (“right to be forgotten”) – to request deletion of your personal data in certain circumstances
Right to restriction of processing – to request we limit how we process your data in certain circumstances
Right to data portability – to receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible
Right to object – to object to processing based on legitimate interests or to direct marketing
Right to withdraw consent – where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at info@zempire.co.uk.

You also have the right to lodge a complaint with your local supervisory authority (data protection authority) if you believe your data protection rights have been infringed. We would, however, appreciate the chance to deal with your concerns first.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements.

Any changes will take effect when posted on our website. If we make material changes, we may notify you separately (for example, by email or a notice on the site).

It is important that the personal data we hold about you is accurate and current. Please let us know if your personal details change during your relationship with us.

13. Contact and Questions

If you would like to:

Access, correct, amend or delete any personal data we hold about you
Exercise any of your rights under GDPR
Register a complaint, or
Ask a question about this Privacy Policy

please contact our Privacy Contact at:

Email: info@zempire.co.uk

Your cart is currently empty.