The data controller responsible for your personal data is LUI1960 Ltd trading as AkiraCircuit.

• Company number: 16319092 (registered in England and Wales)
• Registered office: 8 Glendare Street, Bristol, BS5 9SG
• Privacy contact: hello@akiracircuit.co.uk

We are registered with the UK Information Commissioner’s Office (ICO) where required and comply fully with the UK GDPR and the Data Protection Act 2018.

We only collect the personal data we genuinely need. Here is exactly what and why:

We do not collect any “special category” data (e.g. health, ethnicity, religious beliefs) and we do not knowingly collect data from anyone under 18.

UK GDPR requires us to have a “lawful basis” for processing your data. Here is exactly what we use your data for and why we are allowed to:

• To fulfil your order — process payment, ship your product, send tracking, handle returns. Lawful basis: contract performance.
• To manage your account — log you in, save your preferences, show your order history. Lawful basis: contract performance.
• To meet legal obligations — keep tax and accounting records for HMRC for the period required by UK law. Lawful basis: legal obligation.
• To prevent fraud and keep the site secure — detect suspicious activity, block bots and bulk-ordering bots. Lawful basis: legitimate interests.
• To send marketing emails (e.g. restock alerts, new pre-order announcements) — only if you have opted in. Lawful basis: consent — you can withdraw any time.
• To improve the site using anonymous analytics. Lawful basis: legitimate interests / consent for non-essential cookies.

We do not sell your personal data. Ever. We share it only with the small number of trusted service providers we need to actually run the business:

• Stripe & PayPal — to process card and PayPal payments securely.
• Royal Mail / DPD — to deliver your order. They receive the name, address and phone number on the parcel.
• SiteGround — our website hosting provider (UK/EU servers).
• Google Workspace — to send and receive customer support email.
• Mailchimp / our email provider — to send opt-in marketing emails (only if you have subscribed).
• HMRC and our accountant — for UK tax and accounting purposes.
• Law enforcement or regulators — only if we are legally required to disclose data.

All third-party providers are bound by their own UK GDPR-compliant data processing agreements.

We do not keep your data forever. Each type has a defined retention period:

• Order and accounting records — 6 years (HMRC requirement).
• Active account data — until you delete your account.
• Marketing email subscription — until you unsubscribe.
• Customer support emails — 3 years from last contact, then deleted.
• Website analytics — anonymised after 14 months.

You have strong rights over your personal data. You can exercise any of these by emailing hello@akiracircuit.co.uk — we will respond within 30 days, free of charge.

• Right to access — get a copy of all the personal data we hold about you.
• Right to rectification — correct anything that is wrong or incomplete.
• Right to erasure (“right to be forgotten”) — delete your data where there is no legal reason for us to keep it.
• Right to restrict processing — pause our use of your data while a query is resolved.
• Right to data portability — receive your data in a portable machine-readable format.
• Right to object — to direct marketing or to processing based on legitimate interests.
• Right to withdraw consent — for anything you previously opted into, at any time.

If you are not satisfied with how we have handled your data, you have the right to complain to the UK Information Commissioner’s Office at ico.org.uk — but please contact us first so we can try to put it right.

We use cookies — small text files stored in your browser — to make the site work and (with your consent) to understand how it is used. The cookie banner you see on first visit lets you accept, reject or customise non-essential cookies.

• Strictly necessary — login, cart, checkout. These cannot be disabled.
• Functional — remember your preferences (e.g. wishlist, language). Optional.
• Analytics — anonymous usage stats (e.g. Google Analytics). Only with consent.
• Marketing — only used if you opt in.

Full details are in our Cookie Policy. You can change your cookie preferences at any time using the “Cookie Settings” link in our footer.

We take security seriously. Among the measures we use:

• Full-site HTTPS / TLS encryption on every page.
• Card payments processed by Stripe (PCI-DSS Level 1) — we never see card numbers.
• Strong password requirements and hashed password storage on your account.
• Limited internal access to personal data — strictly need-to-know.
• Regular software updates, automated security scanning and offsite backups.

If we ever became aware of a data breach affecting your personal data, we would notify you and the ICO within 72 hours, as required by UK GDPR.

Most of our infrastructure is hosted in the UK or EU. Some service providers (for example Google Workspace and Mailchimp) may process limited data in the United States. Where this happens, we rely on UK-approved safeguards including the UK-US Data Bridge, EU Standard Contractual Clauses, or the UK International Data Transfer Addendum.

We may update this policy occasionally — for example to reflect a new service provider, a change in the law, or how we operate. The version on this page at the time you place an order is the version that applies. Material changes are dated at the bottom and we will email account holders if changes significantly affect their rights.