Last updated: 3 November 2026

1. Who We Are

Shadotech Limited operates shadotech-rs.com, supplying automotive paint and bodyshop products. We are the controller of the personal information we use to run our business and this website.

For privacy questions, marketing opt-outs or requests about your information, contact shadotechsolutions@gmail.com, telephone 07939 025 022, or write to Shadotech Limited, 8 Fullbrook Close, Maidenhead, Berkshire, SL6 8UE, United Kingdom. This is a correspondence address, not an invitation to visit a public shop.

2. Information We Use And Where It Comes From

  • Accounts and orders: your name, contact details, login/account information, billing and delivery addresses, products, quantities, prices, order history, invoices, payment status and delivery, return or refund correspondence. This includes website orders and orders invoiced outside the website.
  • Payments: payment confirmations, transaction references and information needed to reconcile payments. Stripe handles online payment processing; bank transfers are paid into our Tide business account. Payment providers collect the payment and fraud-prevention information required for their services. This notice does not mean that we hold your full card number.
  • Communications: information you provide in an enquiry, quotation request, complaint, email, telephone call, product review or live-chat conversation.
  • Website and security information: IP address, browser/device details, pages and interactions, diagnostic/security logs and privacy preferences. Optional analytics and third-party services are explained below.
  • Marketing contacts: contact details and the permission or opt-out information associated with occasional customer mailings.

We obtain information from you and your use of the website. Payment and delivery providers may also send us confirmations or updates needed for your order. Please do not put sensitive information, passwords or full payment-card details into enquiries, reviews or chat.

3. Purposes And Lawful Bases

  • Contract: taking and fulfilling orders, processing payments, arranging delivery, managing your account and handling contractual returns or refunds. Requested pre-purchase quotations and enquiries may be steps taken at your request before a contract.
  • Legal obligations: keeping required tax, VAT and accounting records and responding to applicable legal or regulatory requirements.
  • Legitimate interests: operating and securing the business and website, preventing fraud and misuse, resolving general enquiries and complaints, and establishing or defending legal claims. We consider the effect on your rights when relying on these interests.
  • Consent: optional website analytics and optional chat/media technologies controlled through Cookie settings, and marketing emails where we rely on your permission.

We need sufficient contact, delivery and payment information to fulfil an order. Without it we may be unable to process your purchase or answer a requested quotation. Accepting optional technologies or marketing is not a condition of shopping.

4. Cookies, Analytics And Live Chat

Essential technologies support the basket, checkout, login, security and remembering your privacy choices. They remain available when optional services are rejected.

Google Analytics 4 measures visits and website interactions only after Statistics consent. It may process online identifiers, device/browser information, page addresses and interaction information. We do not intentionally send names, email addresses, postal addresses or payment-card details as Analytics event data. This notice does not represent ecommerce purchase tracking as an enabled feature.

Optional Chat & Media consent permits third-party services such as Tawk.to live chat and external Google Fonts. Loading these services sends technical information, including your IP address, to their providers. Information you choose to send in chat is processed to answer you. Automatic recognition of a logged-in visitor’s name and email is disabled. You can contact us by email or telephone without enabling chat.

We also use Burst Statistics on our own WordPress website, configured in its no-cookie, no-fingerprint mode with Do Not Track enabled. Security tools, including Wordfence, process information needed to protect the website. A cookieless setting does not mean that every technical request is anonymous.

Use Cookie settings to accept, reject or customise optional services and to change your decision later. Withdrawing consent applies to future consent-based processing; it does not undo processing lawfully carried out beforehand. Browser controls can also remove stored cookies, but removing essential cookies may interrupt your login or basket. Further information is in our Cookie Policy.

5. Marketing Choices

We use Mailchimp for occasional customer marketing emails where we have the required permission. You can withdraw permission or ask to stop these emails at any time by emailing shadotechsolutions@gmail.com. We do not use SMS marketing or share our mailing list for other businesses’ marketing. Essential messages about an order or a privacy request are separate from marketing.

6. Who Receives Information

We disclose relevant information to providers and advisers involved in the service you use, rather than making your information public:

  • GoDaddy: website hosting and related infrastructure.
  • Stripe and Tide: online payments and bank-transfer processing/reconciliation respectively, including their applicable fraud-prevention and legal functions.
  • Delivered (delivered.net) and Royal Mail: recipient contact, address and shipment information needed for delivery.
  • Our accountants and their Sage accounting system: order, invoice, VAT and accounting records.
  • Mailchimp: mailing-list management and occasional marketing emails.
  • Google Analytics and Tawk.to: the optional analytics and chat functions described above. Google also receives technical requests when optional external fonts are enabled.
  • Website/security service providers, professional advisers and authorities: where needed for maintenance, protection, legal advice or an applicable legal requirement.

WooCommerce and Burst are software used on our WordPress website; their installation does not by itself mean every order is sent to a separate cloud service. Payment providers and some other recipients may also act as independent controllers for their own legal, payment or security purposes. Their privacy notices explain that processing.

7. International Processing

Some providers and their subprocessors operate outside the UK, including in the United States. The applicable transfer protection depends on the provider, destination and service. Published provider arrangements include UK adequacy arrangements, the UK Extension to the EU-US Data Privacy Framework for participating recipients, and contractual safeguards such as standard contractual clauses with the UK Addendum where applicable. These mechanisms are not a statement that all information stays in the UK.

See the published information from GoDaddy, Stripe, Google, Tawk.to and Mailchimp. Contact us for information about the safeguards relevant to your data or a copy of applicable safeguards, subject to necessary redactions.

8. How Long Information Is Kept

Retention depends on the record’s purpose and any legal requirement, unresolved transaction or dispute. Archiving restricts routine use; it is not the same as deletion. The business’s retention schedule is not a promise that website software automatically erases every copy on a particular date.

  • Orders and accounts records: website orders are normally archived after 12 months. The business keeps order records for its six-year recordkeeping period. Where they form part of company accounting, invoice or VAT records, the applicable period is normally six years from the end of the relevant company financial year, with longer retention where legally required, for example during a tax enquiry or an unresolved claim. Records no longer needed for these purposes are due for deletion.
  • Enquiries and complaints: the normal business retention period is 12 months. Information that remains necessary to resolve an open matter, fulfil an order or meet a separate legal/claims requirement may need to be retained with that matter’s records instead.
  • Inactive customer accounts: normally retained for three years before archiving. Any continued archive retention is assessed against linked order/accounting requirements, outstanding balances, disputes and legal claims; archiving is not a new reason to use the account for marketing. You can request review or erasure, subject to applicable exceptions.
  • Marketing: contact information is used while the relevant permission remains in place. On an opt-out, the minimum information needed to respect that request may need to remain rather than being re-added to future mailings.
  • Chat, technical records and backups: retention is assessed against answering the conversation, investigating security or support incidents, recovering the service and any associated legal obligation. A conversation needed for an order or complaint follows the relevant record’s purpose. Provider copies and recovery backups may have separate expiry processes; contact us for the information applicable to a particular record.
  • Google Analytics: the current property settings retain event-level data for two months and user-level data for 14 months, with the user period reset by new activity. These controls do not apply to most standard aggregated reports. Browser storage has separate expiry and can be removed through browser controls.

9. Your Rights

Depending on the circumstances, you may request access, correction, erasure, restriction or portability of your personal information. You may object to processing based on legitimate interests and object to direct marketing. You can withdraw consent where processing relies on it. These rights have legal conditions and exceptions, including where records must be kept by law.

Contact us using the details above. We may request proportionate information to verify identity and locate the relevant record. You can complain to the Information Commissioner’s Office without having to finish our own complaints process first.

10. Automated Decisions And Updates

Shadotech does not use its own solely automated system to reject orders without human review. Independent payment providers may carry out their own payment or fraud checks under their privacy notices. Contact us if you need help with an order decision.

We update this notice when our practices change. The date at the top identifies the latest version.