Privacy Policy

TonicIT Limited is the data controller for the personal data described on this page. This policy explains what we collect when you use this site, buy from the store, or get in touch, why, who we share it with, and the rights you have over it.

1. What we collect, and why

Contact form and chat "leave a message"

Name, email, phone number (if given), business name (if given), and whatever you write in the message or chat conversation. Used only to reply to you and follow up on what you've asked.

Store orders

Name, email, phone number, billing/delivery address, and, for business purchases, company name, VAT number and company number. For bank transfer orders we also hold the payment reference you're asked to quote. We never see or store your full card number, expiry date, or CVC; card payments are entered directly on Stripe's own payment page, not this site.

Used to:

• process your order, re-check stock and pricing, and take payment
• arrange delivery with our distributor
• contact you about your order, including if something's out of stock or delayed
• meet our own legal and accounting record-keeping obligations

AI chat assistant

If you use the chat widget, your messages are sent to Anthropic (the provider of the AI model) to generate a reply. We don't ask for personal details inside the chat itself; if you choose to leave a message for us, that's handled as described above.

Automatically, when you visit the site

We use your IP address briefly to prevent abuse of the contact form, chat, and checkout (for example, rate-limiting repeated submissions), and this isn't stored beyond what's needed for that. With your consent via the cookie banner, we also use Google Analytics to see which pages are useful, as described in the Cookies section below.

2. Who we share it with

We don't sell your data, and we don't use it for ad targeting. We do share what's needed to run the site and fulfil orders with:

• Stripe: processes card payments. Stripe sees your payment details directly; we only receive confirmation that you've paid.
• Supabase: hosts the database that stores order and account records, in a UK/EU data region.
• Resend: sends transactional emails (order confirmations, replies to enquiries, chat message escalations) on our behalf.
• Our distributor (TD Synnex): receives your delivery name and address when we place the matching order for hardware/software you've bought, so they can ship it to you.
• Anthropic: processes messages you send to the AI chat assistant, to generate a reply.
• Google Analytics: only if you've accepted analytics cookies, as described below.

We may also disclose personal data if required by law, for example to a regulator or in response to a court order.

3. How long we keep it

Order records are kept for as long as required by UK tax and accounting law (currently at least 6 years). Contact form and chat enquiries are kept only as long as needed to deal with your enquiry and for a reasonable period afterwards, then deleted.

4. Cookies

This site uses essential cookies needed for it to work (for example, remembering your cookie choice and your theme preference), which don't require consent. With your consent, given via the banner shown on your first visit, we also use Google Analytics cookies to understand site usage. No advertising or cross-site tracking cookies are used. You can change your choice at any time by clearing your browser's cookies for this site, which will show the banner again.

5. Your rights

Under UK data protection law, you have the right to:

• ask what personal data we hold about you, and get a copy of it
• ask us to correct inaccurate data
• ask us to delete data we no longer have a reason to keep
• object to or restrict certain processing
• ask for your data in a portable format, where that applies

To exercise any of these, email hello@tonicit.co.uk. If you're not satisfied with our response, you can complain to the UK's data protection regulator, the Information Commissioner's Office (ICO).

6. Security

We use industry-standard measures to protect the data we hold, including encrypted connections (HTTPS) across the site and access controls on our systems. Payment card details are handled entirely by Stripe, which is certified to the Payment Card Industry Data Security Standard (PCI DSS); we never hold card data ourselves.

7. Changes to this policy

We may update this policy from time to time, for example as the site or store changes. We'll post the current version here with its last-updated date.

8. Contact

Questions about this policy, or about your data, can go to us using the details below, or to the ICO as described in section 5.