Privacy Policy
This Policy explains how Removalbright.ddd (“we”, “us”) processes personal data when you use removalbright.world, correspond with us, or purchase VitaFlow products where we act as seller or distributor. We apply the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Data Protection Act 2018 (Ireland) alongside other applicable rules.
Identity of the controller
The data controller is Removalbright.ddd, trading from 123 Rathmines Rd Lower, Dublin 6, D06 X6F3, Ireland. For privacy correspondence use talk@removalbright.world with “Data protection” in the subject line. We will respond within one month unless complexity requires an extension, which we will explain under GDPR Article 12.
Scope. This Policy covers website visitors, account holders where applicable, enquirers, and customers. It does not cover third-party sites we link to; their policies apply.
Categories of personal data
Depending on how you interact with us, we may process:
- Identity and contact: name, email, phone, billing and delivery addresses.
- Transaction: order references, product selections, payment status from payment partners, delivery updates.
- Communications: free-text messages, support tickets, survey responses you choose to send.
- Technical: IP address, device type, browser, approximate location derived from IP, referring URL, timestamps.
- Cookies and similar technologies: as described in our Cookie Policy.
- Marketing preferences: opt-in or opt-out records where consent or legitimate interest applies.
We do not seek special category data through this website. If you voluntarily disclose health information, we will minimise use to what is needed to handle your request and will remind you that general product information is not medical advice.
Purposes and lawful bases
Contract and pre-contract
Processing orders, taking payment instructions, delivering goods, and answering pre-sales questions (GDPR Article 6(1)(b)).
Legal obligation
Tax, accounting, and regulatory record-keeping where Irish or EU law requires retention (Article 6(1)(c)).
Legitimate interests
Website security, fraud prevention, product improvement analytics in pseudonymous form, and limited service emails such as transactional receipts (Article 6(1)(f), balanced against your rights).
Consent
Optional marketing communications and non-essential cookies or pixels where required by ePrivacy rules (Article 6(1)(a), withdrawable at any time).
Retention periods
We keep data only as long as necessary for the purposes above. Indicative periods: marketing consent records for as long as your subscription stays active plus a short wind-down period; customer service emails for up to twenty-four months unless a dispute requires longer; contracts and tax records up to seven years where Irish revenue rules apply; server logs on a rolling basis typically under ninety days unless security monitoring extends a subset.
Recipients and processors
We use trusted processors for hosting, email delivery, payment acquiring, shipping labels, and optional analytics when you consent. Processors may only process on documented instructions. A list of categories is available on request; individual vendor names may change with commercial relationships while categories remain consistent.
International transfers
Where data leaves the European Economic Area, we rely on European Commission adequacy decisions or appropriate safeguards such as Standard Contractual Clauses with supplementary measures where required by case law. You may request a summary of safeguards applicable to your data.
Security measures
We implement TLS for website traffic, role-based access, credential hygiene, and vendor security reviews. No system is perfectly secure; if we become aware of an incident that risks your rights, we will notify regulators and, where required, affected individuals without undue delay.
Your GDPR rights
Subject to legal conditions, you may request access, rectification, erasure, restriction, portability, and may object to processing based on legitimate interests. You may withdraw consent without affecting earlier processing that was lawful. To exercise rights, email us with enough detail to identify your request. We may ask for proportionate identity verification.
Supervisory authority
You may lodge a complaint with the Irish Data Protection Commission at dataprotection.ie or another EU supervisory authority where applicable law allows.
Changes to this Policy
We update this page when practices evolve. The “Last reviewed” date at the top reflects the most recent substantive review. Continued use after notice of material changes where required will be handled in line with GDPR transparency rules.