Privacy Policy

Last updated: 13 May 2025

1. Who we are

Chabrias Ltd (“Chabrias”, “we”, “our”, “us”) is a private limited company registered in England and Wales (Company No. 09912140 ). Our registered office is Carleton House, 266-268 Stratford Road, Shirley, Solihull, West Midlands, United Kingdom, B90 3AD. We act as the “controller” for the personal data we collect.

2. How to contact us

If you have questions about this policy or your data, contact us:

• Email: Admin@chabrias.co.uk
• Post: Data Protection Officer, Chabrias Ltd, 194 Waterloo Road, Yardley, Birmingham B25 8LD United Kingdom
  You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

3. The data we collect

4. How we collect data

• Directly from you (forms, emails, phone calls)
• Automated technologies (cookies, server logs, analytics)
• Third‑party partners (payment providers, marketing platforms)

5. How we use your data

We process personal data to:

1. Provide and improve our products/services
2. Manage user accounts and fulfil contracts
3. Respond to enquiries and provide support
4. Send service‑related or marketing communications (only with consent or soft‑opt‑in)
5. Maintain security, detect fraud and comply with legal obligations

We do not conduct automated decision‑making that produces legal or similarly significant effects.

6. Marketing

We’ll send marketing emails only if you have opted in or where a “soft‑opt‑in” applies (Section 22 PECR). You can opt out at any time by clicking “unsubscribe” in any message or emailing Admin@chabrias.co.uk.

7. Sharing your data

We share data only with:

• Service providers (hosting, analytics, payment processors) under data‑processing agreements
• Professional advisers (lawyers, accountants, insurers)
• Regulators or authorities where required by law

We never sell personal data.

8. International transfers

Some partners are located outside the UK. Where we transfer data internationally, we rely on:

• UK adequacy regulations, or
• Standard Contractual Clauses plus supplementary measures, as required by UK GDPR.

9. Data retention

We keep personal data only as long as necessary for the purpose collected, or to meet legal, accounting or reporting requirements. Typical retention periods:

• Accounts & contracts: six years after last interaction
• Marketing preferences: until you opt out + one year
• Support tickets: two years

10. Your rights

Under UK GDPR you can:

• Access your personal data
• Correct incomplete or inaccurate data
• Request erasure (“right to be forgotten”)
• Restrict or object to processing
• Port your data to another provider
• Withdraw consent at any time (where we rely on consent)

Contact us through the channels in Section 2 to exercise these rights.

11. Cookies

We use cookies and similar technologies to operate our site, perform analytics and personalise content. Essential cookies load by default; non‑essential cookies are set only after you give consent via our cookie banner. For details see our separate Cookie Policy.

12. Security

We follow industry‑standard technical and organisational measures including encryption in transit (HTTPS), regular penetration testing, least‑privilege access control, and staff training.

13. Children

Our services are not directed to children under 13, and we do not knowingly process their data. If you believe we have data about a child, contact us and we will delete it.

14. Changes to this policy

We may update this notice periodically. Material changes will be flagged on our website or emailed to registered users. The “Last updated” date at the top tells you when it was last revised.