This document explains how and why Metriful Ltd ("we", "us" or "our") collects and uses your personal information when you contact us, or when you visit or purchase from metriful.com ("the website"). This also includes our use of cookies and similar technologies.

The type of personal information we collect

We currently collect and process the following personal information:

• Name
• Email address
• Shipping address
• Billing address
• Payment information
• Telephone number
• IP address

How we get your personal information and why we collect it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

• Placing an order for goods on the website
• Contacting us to enquire about a product or a previous order
• Subscribing to our news and marketing emails

We use the information that you have given us in order to:

• Respond to your enquiries, for example by email or telephone
• Deliver goods which you have ordered
• Take your authorised payment, or provide refunds to you
• Provide you with order confirmations, shipping updates and invoices
• Screen orders for potential risk or fraud
• Determine your eligibility for product returns or refunds
• Send you news and marketing emails, if you consented.

Legal basis

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

• Your consent. You are able to remove your consent at any time. You can do this by contacting dpo@metriful.com
• The performance of the contract between you and us
• Compliance with our legal obligations

Information sharing

We will share your information with the following third parties, in the following circumstances:

• Shipping couriers and fulfilment companies: so they can deliver your goods.
• Payment processor organisations: in order to take your authorised payment, or provide refunds to you.
• Law enforcement authorities: if legally compelled to do so.

We never sell any of your personal data to third parties.

How we store your personal information

Your information is securely stored on computer systems in Ireland and the United Kingdom.

The following list shows the time period for which we retain your information:

• Email subscriptions: 3 years, unless unsubscribed
• Enquiries: 1 month
• Order information: 6 months

We will then dispose of the information by deleting it from our computer systems, unless legally compelled to retain it further.

Automated decision making

We may use your personal data for automated risk and fraud scoring when you submit an order on our website. This may result in your order being blocked, due to automated decision-making, if it appears to be fraudulent.

Your data protection rights

Under data protection law, you have rights including:

• Your right of access - You have the right to ask us for copies of your personal information.
• Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us at dpo@metriful.com if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at dpo@metriful.com. You can also complain to the UK ICO if you are unhappy with how we have used your data. The ICO's website is: https://www.ico.org.uk

EU GDPR representative

As required by the EU GDPR, our appointed representative in the EEA is Xavier Augustin, who may be contacted at x_augustin@proton.me, 30 Rue de Verdun, 91380 Chilly-Mazarin, France.

Cookies

What are cookies?

A cookie is a small file that is automatically downloaded onto your device when you access a website. Cookies are used by websites to recognise your device and store information about your preferences or past actions.

We use two types of cookies on our website: essential and non-essential.

Non-essential cookies include:

• Analytics: counting page visits and traffic sources, allowing us to monitor site performance and source attribution.
• Advertising: making adverts more relevant to you and helping us measure the effectiveness of our adverts.

Essential cookies control website settings and functionality. They do not store any personally identifiable information. Their purposes include: retaining privacy preferences, location (country or region), currency and language, website navigation.

Essential cookies cannot be disabled as they are required for the correct functioning of our website. If you do not want to accept these cookies, you must stop using our website. By continuing to use our website, you are accepting these essential cookies.

You can configure your internet browser to block cookies, and cookies which are already on your device can be deleted: please consult the help section of your browser software for details. Please note that deleting or blocking cookies may prevent parts of our website from functioning correctly.

Last updated: 14 July 2023