Loading...
Last Updated: 12 March 2026
EVDOPES LTD ("we," "us," "our," or the "Company") is committed to protecting the privacy and personal data of all individuals who interact with our services, website, and business operations. This GDPR Privacy Policy and Data Protection Notice ("Policy") sets forth our practices regarding the collection, processing, storage, and protection of personal data in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation or "GDPR"), the UK GDPR as retained in UK law, and all applicable data protection legislation.
This Policy applies to all personal data processed by EVDOPES LTD, whether collected through our website, mobile applications, customer service interactions, marketing activities, or any other means. By accessing our services or providing your personal data, you acknowledge that you have read and understood this Policy.
For the purposes of data protection law, the data controller is:
We have not appointed a Data Protection Officer (DPO) as we do not meet the statutory thresholds requiring such appointment under Article 37 GDPR. However, all data protection queries should be directed to the contact email above.
We process personal data only where we have a valid legal basis under Article 6 GDPR. The legal bases we rely upon include:
Processing necessary for the performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. This includes processing required to provide our services, process transactions, and manage customer accounts.
Processing necessary for compliance with legal obligations to which we are subject, including tax and accounting requirements, regulatory compliance, and law enforcement requests.
Processing necessary for the purposes of legitimate interests pursued by us or a third party, except where such interests are overridden by your fundamental rights and freedoms. Our legitimate interests include business administration, fraud prevention, network and information security, and direct marketing (where consent is not required).
Processing based on your explicit consent, particularly for marketing communications, cookies and tracking technologies (where required), and processing of special categories of personal data. You have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Processing necessary to protect your vital interests or those of another natural person, applicable in emergency situations.
We collect and process the following categories of personal data:
Full name, title, date of birth, gender, and photographic identification where required for verification purposes.
Postal address, email address, telephone numbers, and other contact details provided by you.
Payment card details, bank account information, billing address, and transaction history. Please note that full payment card details are processed by our PCI-DSS compliant payment processors; we do not store complete card numbers.
Internet Protocol (IP) address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, device identifiers, and other technology on the devices you use to access our services.
Information about how you use our website, products, and services, including page response times, download errors, length of visits to certain pages, page interaction information, and methods used to browse away from the page.
Your preferences in receiving marketing from us and our third parties, your communication preferences, and records of your interactions with our marketing materials.
Where applicable, job title, employer name, professional qualifications, and employment history.
We do not intentionally collect special categories of personal data (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for identification purposes, health data, or data concerning sex life or sexual orientation) unless explicitly provided by you with your explicit consent or where required by law.
We process your personal data for the following specific purposes:
To provide our products and services, process your orders, manage your account, and fulfill our contractual obligations to you.
To respond to your inquiries, troubleshoot problems, and provide technical support.
To process payments, prevent fraud, and manage billing and collection activities.
To comply with applicable laws, regulations, court orders, and government requests, including tax and accounting obligations.
To manage our business operations, maintain our IT systems, conduct internal audits, and enforce our terms and conditions.
To send you promotional materials, newsletters, and information about products and services that may interest you, where permitted by law and in accordance with your preferences.
To analyze usage patterns, improve our website and services, develop new products, and conduct market research.
To protect our business, website, customers, and employees from fraud, security threats, and other harmful activities.
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Our retention periods are determined as follows:
| Category | Duration |
|---|---|
| 6.1 Customer Data | Retained for the duration of our business relationship with you and for six (6) years thereafter to comply with contractual limitation periods and tax obligations. |
| 6.2 Transaction Data | Retained for six (6) years from the date of transaction to comply with UK tax and accounting legislation (HMRC requirements). |
| 6.3 Marketing Data | Retained until you withdraw consent or opt out, or for three (3) years from your last interaction with us, whichever occurs first. |
| 6.4 Technical and Usage Data | Retained for twenty-four (24) months from collection, unless required for security investigations or legal proceedings. |
| 6.5 Legal Claims Data | Retained for the duration of any legal proceedings and for six (6) years following resolution to defend against potential future claims. |
Upon expiry of the applicable retention period, personal data will be securely deleted, anonymized, or destroyed in accordance with our data destruction procedures.
Under the GDPR, you have the following rights regarding your personal data:
You have the right to obtain confirmation as to whether we process your personal data and, where that is the case, access to the personal data and supplementary information. We will provide a copy of your personal data free of charge, with additional copies available upon payment of a reasonable fee based on administrative costs.
You have the right to obtain without undue delay the rectification of inaccurate personal data concerning you and to have incomplete personal data completed.
You have the right to obtain the erasure of personal data concerning you where: (a) the data is no longer necessary for the purposes for which it was collected; (b) you withdraw consent and there is no other legal basis for processing; (c) you object to processing and there are no overriding legitimate grounds; (d) the data has been unlawfully processed; (e) the data must be erased for compliance with a legal obligation; or (f) the data was collected in relation to information society services offered to a child.
You have the right to obtain restriction of processing where: (a) you contest the accuracy of the data (for a period enabling verification); (b) processing is unlawful and you oppose erasure; (c) we no longer need the data but you require it for legal claims; or (d) you have objected to processing pending verification of overriding grounds.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller without hindrance, where processing is based on consent or contractual necessity and processing is carried out by automated means.
You have the right to object at any time to processing of personal data concerning you which is based on legitimate interests or for direct marketing purposes. Where you object to processing for direct marketing, we shall cease such processing immediately.
Where processing is based on consent, you have the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
You have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your habitual residence, place of work, or place of the alleged infringement. In the UK, the supervisory authority is the Information Commissioner's Office (ICO), contactable at www.ico.org.uk.
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, except where necessary for contract performance, authorized by law, or based on your explicit consent.
To exercise any of these rights, please contact us at contact@evdopes.group. We will respond to your request within one (1) month of receipt, which may be extended by two (2) further months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one (1) month of receipt of the request, together with the reasons for the delay.
Response within 30 days guaranteed.
We may request specific information from you to help us confirm your identity and ensure your right to access your personal data or exercise any of your other rights. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it.
Your personal data may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different from the laws of your country (and, in some cases, may not be as protective).
Specifically, our website servers are located in the United Kingdom and European Economic Area (EEA), and our group companies and third-party service providers and partners operate around the world. This means that when we collect your personal data, we may process it in any of these countries.
However, we have taken appropriate safeguards to require that your personal data will remain protected in accordance with this Policy. These safeguards include implementing the European Commission's Standard Contractual Clauses (SCCs) for transfers of personal data between our group companies and third-party service providers and partners, which require all recipients to protect personal data they process from the EEA in accordance with European Union data protection law.
We have implemented similar appropriate safeguards with our third-party service providers and partners and further details can be provided upon request.
We have implemented appropriate technical and organizational measures to protect the security of your personal data, including:
Encryption of data in transit using TLS/SSL protocols, encryption of data at rest where appropriate, firewalls, intrusion detection systems, regular security assessments and penetration testing, and secure development practices.
Access controls and authentication procedures, staff training on data protection and security, confidentiality agreements with employees and contractors, incident response procedures, and regular audits of our security practices.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within seventy-two (72) hours of becoming aware of the breach, where feasible. If the breach is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.
While we implement safeguards designed to protect your personal data, no security system is impenetrable and, due to the inherent nature of the Internet, we cannot guarantee that data, during transmission through the Internet or while stored on our systems or otherwise in our care, is absolutely safe from intrusion by others.
This document provides comprehensive GDPR compliance coverage for EVDOPES LTD. It addresses all required elements under Articles 12-14 GDPR (transparency requirements).