Privacy Policy

1. Who we are

Graphite Modular is the trading name of Six Watts Ltd ("we", "us", "our"). We are the data controller for personal data collected via this website, direct customer channels, and connected marketplace integrations we use to manage orders, shipping, invoicing, and customer support.

Privacy email: hello@graphitemodular.co.uk
Support email: hello@graphitemodular.co.uk

2. What data we collect

• Identity data: name
• Contact data: email address, phone number, delivery and billing address
• Order data: products purchased, order value, delivery instructions
• Marketplace and integration data: marketplace order IDs, buyer details, shipment status, tracking numbers, invoices, and other order information provided to us through marketplace APIs such as Amazon
• Payment data: we do not store full card details; payments are processed by Stripe
• Account data: login credentials if you create an account
• Support data: messages and files you send to support
• Technical data: IP address, browser/device information, cookies and identifiers
• Marketing preferences: opt-in and opt-out status

3. How we use your data

We use personal data under UK GDPR lawful bases including contract, legal obligation, legitimate interests, and consent.

• Process orders, payment, and delivery (contract)
• Synchronise and manage orders from connected marketplaces and sales channels, including Amazon, so that fulfilment, tracking, invoicing, and support can be handled from one workspace (contract or legitimate interests)
• Generate shipping labels, record shipment events, provide tracking updates, and upload order documents such as VAT invoices where required by a marketplace or carrier (contract or legal obligation)
• Customer support and returns (contract or legitimate interests)
• Fraud prevention and security (legitimate interests or legal obligation)
• Accounting and tax records (legal obligation)
• Marketing emails where you opt in (consent)
• Website analytics where non-essential cookies are enabled (consent)

4. Sharing your data

We share personal data with trusted processors and partners only when needed to provide services, such as:

• Payment processors: Stripe
• Marketplaces and commerce partners where you place an order or where we must send order, shipping, tracking, invoicing, or compliance updates back to that platform
• Shipping carriers: DPD
• Shipping, print, fulfilment, and operational systems that help us dispatch orders and produce shipping documents
• Hosting/CDN: Kubernetes-hosted infrastructure
• Analytics (if enabled): Google Analytics
• Support and email tooling: Email support tooling and operational order management systems
• Professional advisers, tax, accounting, legal, insurance, fraud-prevention, or regulatory bodies where required

5. International transfers

If a supplier, platform, or infrastructure provider processes data outside the UK, we use appropriate safeguards such as contractual protections, adequacy arrangements, or other recognised transfer mechanisms required by applicable law.

6. Data retention

We keep personal data only as long as needed for operational, legal, accounting, support, fraud-prevention, and tax purposes. When data is no longer required, we delete it, anonymise it, or securely dispose of it.

• Order records: typically 6 years for tax/accounting
• Marketplace-origin order, shipment, and invoice records: typically aligned to the same accounting and operational retention period unless a longer legal hold is required
• Support emails: typically 12-24 months after resolution
• Marketing preferences: until you opt out or request deletion

7. Your rights

You may have rights including access, rectification, erasure, restriction, objection, data portability, and withdrawal of consent where applicable. To exercise rights, contact hello@graphitemodular.co.uk. If your request relates to data originating from a marketplace or commerce partner, we may need to coordinate with that platform where it controls part of the relationship or record.

8. Marketing

We send marketing communications only where you opt in or where otherwise permitted by law. You can unsubscribe at any time.

9. Cookies

We use cookies and similar technologies. See our Cookie Policy for details. Non-essential cookies are not set until consent is provided where required.

10. Security

We use appropriate technical and organisational measures to protect personal data, including role-based access controls, least-privilege access, managed secrets, logging of administrative activity, and encryption in transit and at rest where supported by our hosting and service providers. Access to personal data is limited to staff and processors who need it to perform their duties.

11. Complaints

Contact us first at hello@graphitemodular.co.uk. You may also complain to the UK Information Commissioner's Office (ICO).

12. Changes to this policy

We may update this policy from time to time. The latest version will always show a revised "Last updated" date.