Privacy Notice
Collecso Ltd · Company number 14496823 Registered office: Regus Manchester Business Park, 3000 Aviator Way, Manchester, England, M22 5TG ICO registration [ICO REGISTRATION NUMBER] · Version 1.0
1. Who we are
Collecso Ltd is the controller of the personal data described in this notice. We manufacture and supply gold jewellery to retail jewellers.
Contact for data protection matters: [EMAIL] Post: Collecso Ltd, Regus Manchester Business Park, 3000 Aviator Way, Manchester, England, M22 5TG.
2. What this notice covers
- Trade accounts — people who apply for, hold, or use a trade account.
- Business outreach — people at businesses we contact about supplying them.
It does not cover our consumer website, which has its own notice.
3. What we collect, and where it comes from
3.1 Trade account applicants and users
Collected from you when you apply and when you use the account:
- name, job title, business email address, business telephone number
- the business you represent and its registered details
- login and authentication data, including two-factor authentication
- device and connection data recorded for security
- records of what you did in the account — orders placed, approvals, acceptances
- correspondence with us
Collected from public and third-party sources when we verify a business:
- company status, officers, and persons with significant control (Companies House)
- VAT registration status (HMRC)
- identity verification results, where an identity check is required
3.2 Business contacts we approach
Where we contact a business that is not yet a customer, we may hold:
- name, job title, business email address, business telephone number
- the business, its sector and its published details
Where we did not obtain these details from you directly, we obtained them from publicly available sources or a data provider, and we tell you so in our first message to you. This notice is the fuller explanation that message links to.
4. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Assess and approve a trade account application | Steps prior to entering a contract; legitimate interests (fraud prevention) |
| Operate your account, take and fulfil orders | Performance of a contract |
| Verify the business is real and active | Legitimate interests — preventing fraud and impersonation |
| Keep audit records of who did what | Legitimate interests — accountability and dispute resolution; legal obligation where records are required |
| Issue invoices and keep accounting records | Legal obligation |
| Contact businesses about supplying them | Legitimate interests — business-to-business marketing |
| Keep a suppression list of people who opted out | Legal obligation — so we do not contact you again |
| Secure our systems | Legitimate interests |
Our legitimate interests are running and growing a trade supply business, keeping it secure, and being able to show what happened on an account. We balance these against your interests and rights; you can object at any time (section 8).
We do not sell personal data.
5. Decisions about your application
A trade account is approved or declined by a person, not by an automated system. Our checks gather evidence; the decision is human. You are not subject to a decision based solely on automated processing.
6. Marketing, and how to stop it
- Every marketing message we send identifies us and carries a one-click way to stop. It works without logging in and without giving us further details.
- We act on an opt-out immediately.
- We then keep the minimum record needed to make sure we do not contact you again. That record exists because you opted out, not despite it.
7. Who we share it with
- Service providers who host our systems, run our database, send our email and build our software — each acting on our instructions under contract.
- Couriers and carriers, for delivery.
- Professional advisers — accountants, lawyers, insurers.
- HMRC and other authorities, where the law requires it.
- A buyer, if the business is sold.
7.1 The providers we use
| What they do | Provider | What they can hold | Where the data is processed |
|---|---|---|---|
| Hosting and delivery of the trade application | Vercel | requests, logs, device and connection data | London, United Kingdom |
| Database and authentication | Supabase | account records, orders, audit records, authentication data | Ireland |
| Transactional email | Resend | recipient address, message content, delivery status | Ireland |
| Automated build and delivery of our software | GitHub (GitHub Actions) | recipient email addresses handled during delivery | United States |
| Our business email | Microsoft (Microsoft 365) | correspondence with us | European Union |
| Domain names and DNS | GoDaddy | no account personal data | — |
Most of our processing takes place in the United Kingdom and the European Economic Area. Where a provider processes data outside the UK, we rely on UK adequacy regulations or on the UK International Data Transfer Addendum.
8. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you
- correct it if it is wrong
- delete it, where we have no continuing reason to hold it
- restrict how we use it while a question is resolved
- transfer it to another organisation, where that right applies
- stop using it for marketing — always, without giving a reason
- object to use based on legitimate interests
Write to [EMAIL]. We respond within one month. Exercising these rights is free.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office — ico.org.uk — but we would rather you told us first so we can put it right.
9. How long we keep it
| Data | Kept for |
|---|---|
| Trade account records, orders, invoices | 6 years after the end of the relationship, for tax and accounting |
| Audit records of account activity | 6 years |
| Identity and business verification evidence | 6 years after the end of the relationship |
| Contact details of a business we approached, with no response | 12 months from last contact |
| Opt-out (suppression) records | Kept, so that we do not contact you again |
| Security and error logs | 12 months |
10. How we protect it
- Access is restricted by role: staff see only what their role requires, and access is enforced by the database itself rather than only by the screen.
- Staff accounts require two-factor authentication. An account without a second factor cannot reach our internal screens at all.
- Passwords are set by the person, not by us. We never see them.
- Actions that change money, permissions or account status are recorded with who did them and when.
- Our error logs record the page, not the address bar. Anything that could carry a credential is stripped before it is written.
11. Cookies
Our trade application uses only the cookies needed to keep you signed in and to keep the service secure. We do not use advertising or analytics cookies in it.
12. Changes
We may update this notice. The current version is always available at https://trade.majesticjewellery.co.uk/privacy. Where a change materially affects you, we will tell you.