1. Who we are
This policy explains how SPEC LUCKY LIMITED (“Spec Lucky”, “we”, “us”) handles personal data when you visit speclucky.co.uk, place an order or contact us. We are the controller of that data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
- Company: SPEC LUCKY LIMITED, registered in Northern Ireland
- Company number: NI732995
- Registered address: Unit 1566 44a Frances Street, Newtownards, Northern Ireland, BT23 7DN
- Email: [email protected]
- Phone: +44 7723 418056
For any question about this policy or your data, email us at the address above.
2. Data we collect
Order and delivery data
When you check out, you give us:
- your full name;
- email address;
- phone number;
- delivery address, town or city and postcode;
- any notes you add to the order (for example, a safe place for the parcel);
- the products, quantities, prices and order number.
Payment data
Payments are processed by our payment provider. Your full card number, expiry date and security code go directly to the provider and are never stored or seen by us. We receive confirmation that the payment succeeded, the amount, the payment method type and the last four digits of the card for reference and refunds.
Email correspondence
If you email us — about which tripod or filter fits your camera, an order, a return or anything else — we keep your email address, the content of the messages and any attachments you send, such as photos of a damaged item.
Returns
If you cancel or return an order, we record the reason you give (if any), the condition of the returned item and the refund details.
Technical data
Our hosting provider automatically records standard server logs: IP address, browser type, pages requested and the time of the request. We do not use analytics or advertising trackers on this site.
3. Purposes and legal bases
| What we do | Legal basis |
|---|---|
| Process, pack and deliver your order; send order and dispatch confirmations; handle cancellations, returns and refunds | Contract (Art. 6(1)(b)) |
| Answer your questions before you buy, such as which accessories fit your camera | Steps at your request before a contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)) |
| Keep accounting and tax records, including invoices and VAT records | Legal obligation (Art. 6(1)(c)) |
| Prevent fraud, keep the site secure, and defend legal claims | Legitimate interests (Art. 6(1)(f)) |
| Send occasional news or offers, only if you ask to receive them | Consent (Art. 6(1)(a)) |
Where we rely on legitimate interests, we have weighed our interest in running a safe, working shop against your rights, and we only use the minimum data needed.
4. Who we share data with
We do not sell personal data. We share it only with service providers who need it to do their job for us, under contracts that require them to protect it:
- Payment provider — to take your payment, detect fraud and process refunds;
- Courier and postal services — your name, delivery address, postcode, phone number and email so they can deliver the parcel and send tracking updates;
- Email and hosting providers — to run our website and mailbox;
- Accountants and professional advisers — for bookkeeping, tax and legal advice;
- Authorities — HMRC, the police or courts where the law requires it.
5. International transfers
Some of our providers (for example, payment, email or hosting services) may store or access data outside the UK. When that happens we make sure the transfer is protected by a UK adequacy regulation, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate security measures. You can ask us for details of the safeguards used.
6. How long we keep data
- Order, payment and invoice records: 6 years after the end of the financial year of the order, as required for tax and accounting.
- Delivery details shared with couriers: kept by the courier under their own retention policy, usually up to 12 months.
- Email correspondence: 2 years after our last exchange, or longer if it relates to an order or claim.
- Returns and complaints: 6 years, to deal with any follow-up claims.
- Marketing consent: until you withdraw it, then a suppression record so we don't contact you again.
- Server logs: up to 30 days.
After these periods, data is deleted or anonymised.
7. Security
The site is served over HTTPS. Access to order data is limited to people who need it, accounts are protected with strong passwords and two-factor authentication where available, and payment card details are handled only by the payment provider. No system is completely secure; if a breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
8. Cookies
This website does not set analytics, advertising or tracking cookies. Your cart is held only in the open browser page and disappears when you close or reload it. Fonts are loaded from Google Fonts, which receives your IP address to deliver the font files. If we ever add non-essential cookies, we will ask for your consent first and update this policy.
9. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you;
- Rectification — have inaccurate or incomplete data corrected;
- Erasure — ask us to delete data we no longer have a reason to keep;
- Restriction — ask us to limit how we use your data;
- Portability — receive data you gave us in a machine-readable format, or have it sent to another organisation;
- Objection — object to processing based on legitimate interests, and to direct marketing at any time;
- Withdraw consent — where we rely on consent, at any time.
To use any of these rights, email [email protected]. We will reply within one month, free of charge. We may ask you to confirm your identity first.
10. Withdrawing consent
If you have agreed to receive news or offers, you can withdraw at any time by replying to any such email or writing to [email protected]. Withdrawing consent does not affect anything we did before, and it does not affect the handling of your orders.
11. Complaints
If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk, helpline 0303 123 1113.
12. Children
Our shop is meant for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us their details, contact us and we will delete them.
13. Changes to this policy
We may update this policy when our services or the law change. The “Last updated” date at the top shows when it was last revised. Significant changes affecting existing customers will be notified by email.
Last updated: 12 October 2026.