Tonicvaultcabints Research Desk
Regulatory Compliance

Privacy Policy

Effective Date: January 1, 2026 • Corporate Entity: Tonicvaultcabints Retail Intelligence Ltd.

This Privacy Policy sets forth how Tonicvaultcabints Retail Intelligence Ltd. ("Tonicvaultcabints", "we", "us", or "our") processes, collects, secures, and retains personal data gathered when individuals visit tonicvaultcabints.com or communicate with our research desk.

1. Data Controller Identification

The legal controller responsible for personal data processing under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the European Union General Data Protection Regulation (EU GDPR) is:

Tonicvaultcabints Retail Intelligence Ltd.
Company Registration Number: 12948210 (England and Wales)
Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Designated Data Protection Officer (DPO): Data Compliance Desk
Contact Email: [email protected]

2. Categories of Information Collected

We adhere strictly to data minimization principles. The personal information processed depends on user interactions:

  • Directly Transmitted Communications: When you complete our research inquiry form or contact our editorial desk via email, we collect your full name, business or individual email address, territorial interest, and the contents of your query.
  • Technical Access Telemetry: When navigating our platform, our servers record standard access logs including truncated Internet Protocol (IP) addresses, browser type, operating system version, referring URL, timestamp, and requested server files.
  • Cookie Identifiers: We utilize technical cookies and user preference tokens as specified in our Cookie Policy to preserve cookie consent states and platform layout choices.

3. Legal Bases for Data Processing

We process personal data in accordance with Article 6 of the UK/EU GDPR under the following lawful grounds:

  1. Legitimate Interests (Art. 6(1)(f)): Processing technical server logs to safeguard network infrastructure, prevent unauthorized server requests, and optimize website stability across European networks.
  2. Contractual / Pre-Contractual Steps (Art. 6(1)(b)): Responding to trade data research requests, corporate publication licensing inquiries, or editorial submissions initiated by the user.
  3. Consent (Art. 6(1)(a)): Where optional performance or analytical cookies are activated through the consent banner interface.
  4. Legal Obligations (Art. 6(1)(c)): Maintaining statutory accounting, corporate administration, and anti-fraud documentation required by UK company law.

4. Third-Party Processors and International Transfers

We do not sell, lease, or commercially trade personal information. We engage select technical infrastructure vendors to deliver our publication services:

  • Hosting and CDN Providers: Distributed European data centres executing encrypted file delivery and denial-of-service mitigation.
  • Email Routing Infrastructure: Secure enterprise mail delivery providers complying with UK adequacy standards and standard contractual clauses (SCCs).

Where data processing requires transmission outside the United Kingdom or the European Economic Area (EEA), such transfers occur exclusively under standard contractual clauses approved by the Information Commissioner's Office (ICO) or European Commission, guaranteeing equivalent data protection.

5. Data Retention Schedules

Personal data is retained only for the duration necessary to satisfy the specific purposes outlined:

  • Inquiry Records: Contact form transmissions are retained for twenty-four (24) months following resolution to facilitate ongoing research correspondence, after which records are purged.
  • Server Diagnostic Logs: Web server log files containing truncated IP strings are automatically overwritten after thirty (30) calendar days.
  • Consent Records: Records of cookie banner consent preferences stored locally in your browser remain active until cleared by the user or for twelve (12) months.

6. Data Subject Rights Under GDPR & CCPA

Residents of the United Kingdom, the European Union, and California possess enforceable legal rights regarding their personal data:

  • Right of Access: You may request a confirmation of whether personal data concerning you is processed, along with a copy of such data.
  • Right to Rectification: You may request correction of inaccurate or incomplete personal records.
  • Right to Erasure ('Right to be Forgotten'): You may request the deletion of your personal data where retention is no longer legally justified.
  • Right to Restriction and Objection: You may restrict processing or object on grounds relating to your particular situation.
  • Right to Data Portability: You may request your data in a structured, machine-readable format.
  • California Consumer Privacy Act (CCPA) Rights: California residents have the right to know about personal information collected, disclose whether data is shared, and opt out of any data sharing (we do not sell personal information).

To exercise these rights, submit a written communication to [email protected]. We respond to all verified requests within thirty (30) calendar days without charge.

7. Supervisory Authority Complaints

If you believe our data processing violates statutory obligations, you retain the legal right to lodge a formal complaint with the supervisory authority in your jurisdiction. In the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (ico.org.uk).