LEGAL / PRIVACY
Privacy and data protection
How Altheray handles website use, enquiries, RFQs, Partner and Representative accounts, security data and your information rights.
Effective date: 13 August 2026. This English notice is the authoritative privacy notice for Altheray's UK operations.
1. Who is responsible for your information
ALTHERAY LTD is the controller for the personal data described in this notice. ALTHERAY LTD is registered in England and Wales under company number 17047992. Registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
Privacy enquiries and data-rights requests can be sent to info@altheraygroup.com or through our protected contact route.
2. Information we collect
Depending on how you use Altheray, we may process: your name, business email, telephone number, organisation and role; RFQ, sourcing and commercial information you submit; Partner or Representative profile and agreement information; uploaded catalogues, quotations and other business documents; account, authentication and security-event data; correspondence and support messages; public professional or company information used for legitimate business research; and limited website/device information used for security and aggregate statistical analytics.
We do not intentionally collect special-category personal data through the public website. Please do not include unnecessary sensitive personal information in RFQs, catalogues or free-text messages.
3. Why we use information and our lawful bases
Enquiries, RFQs and requested services: to respond to you, assess requirements, source products and coordinate technical or commercial discussions. We rely on steps at your request before entering a contract and, where appropriate, our legitimate interests in operating a B2B technology and sourcing business.
Partner and Representative relationships: to create and administer accounts, agreements, opportunities, commissions, sourcing requests and relationship records. We rely on contract, steps before contract and our legitimate interests in managing our commercial network.
Security and abuse prevention: to authenticate users, prevent spam, fraud and automated abuse, investigate incidents and protect our systems. We rely on our legitimate interests in securing Altheray and our users, and legal obligations where applicable.
Legal, financial and governance records: to meet accounting, tax, sanctions, compliance, dispute and record-keeping obligations. We rely on legal obligation and our legitimate interests in establishing, exercising or defending legal rights.
Aggregate website statistics: to understand use of Altheray's own website and improve it. We use privacy-first statistical analytics only; not advertising or visitor profiling. You can object at any time using the controls below.
4. Website analytics, local storage and similar technologies
Altheray uses Umami Cloud for aggregate, privacy-focused website statistics such as page usage, general device/browser characteristics, approximate geography, referrer and performance. We do not send RFQ text, names, email addresses, telephone numbers, uploaded document contents, Partner account data or Workspace session data to public analytics.
Altheray does not use advertising analytics or behavioural advertising on this website. Website analytics can be turned off at any time. Essential local storage may still be used for security, language, theme, authenticated-session and preference functionality.
5. Human verification and security providers
We use Cloudflare Turnstile on sensitive public or account actions to distinguish legitimate use from automated abuse. Turnstile produces security signals used to decide whether a request should be accepted or challenged; it is not used to make commercial decisions about you. Authentication may also involve Supabase and, when you choose them, Google or Microsoft identity services.
6. Who receives information
We share information only where necessary with service providers and professional advisers supporting Altheray. Core categories include hosting and application infrastructure, database/authentication/storage, security and human verification, transactional email, aggregate analytics, and professional legal/accounting advisers. Current core technology providers include Netlify, Supabase, Cloudflare, Resend and Umami. Google or Microsoft receives authentication data only if you choose that sign-in method.
Where an RFQ or sourcing request needs supplier involvement, we disclose only the information reasonably necessary for that supplier to evaluate or respond to the requirement. We do not sell personal data.
7. International transfers
Some providers may process information outside the United Kingdom. Where UK personal data is transferred internationally, Altheray requires an available lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards including the UK International Data Transfer Agreement or UK Addendum, as applicable. You may ask us for further information about the safeguards relevant to your data.
8. How long we keep information
We keep personal data only for as long as reasonably necessary for its purpose. As a working retention framework: ordinary enquiries and unsuccessful RFQs are normally reviewed for deletion after 24 months without meaningful activity; active Partner, Representative, order, commission and contractual records are retained for the relationship and normally up to six years afterwards where required for legal, tax, accounting or dispute purposes; uploaded operational documents are normally kept while the account or relevant commercial matter remains active and then reviewed for deletion; security/abuse logs are generally short-lived and normally reviewed within 90 days unless needed for an investigation. Aggregate analytics retention is reviewed periodically and kept only for trend comparison and service improvement.
9. Whether information is required
Fields marked as required on an RFQ, account or agreement are needed to provide that service, verify authority or form/administer the relevant relationship. If required information is not supplied, we may be unable to process the request or activate the account. Optional information is labelled or can be omitted.
10. Your rights
Subject to the circumstances and exemptions in UK data-protection law, you may request access to your personal data, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw consent without affecting earlier lawful processing. You also have the right to object specifically to direct marketing; Altheray does not currently use the public website for behavioural advertising.
To exercise a right, contact info@altheraygroup.com. We may need proportionate information to verify your identity before disclosing or changing account data.
11. Automated decisions
Altheray does not currently make solely automated decisions about individuals that produce legal or similarly significant effects. Automated security controls may block, rate-limit or challenge suspicious technical activity, but commercial Partner, Representative and RFQ decisions remain subject to human or ordinary business review.
12. Complaints
Please contact Altheray first if you have a privacy concern so we can investigate it. You also have the right to complain to the UK Information Commissioner's Office (ICO). Information about making a data-protection complaint is available at ico.org.uk.
13. Changes to this notice
We may update this notice when our services, providers or legal obligations change. The effective date above identifies the current version. Material changes will be reflected on this page before or when they take effect.