Privacy Policy

Last updated: 15/06/2026

This Privacy Policy explains the way in which we handle your personal data.

It explains the ways in which COSMOS HIGH TECH LTD (“we”, “us”, “our”) obtains, handles, shares and secures information about you when you browse our website https://cosmos-hitech.com (the “Website”), place an order with us, or are otherwise in contact with us.

We are committed to protecting your privacy and to processing your personal data in line with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

Please read this Privacy Policy carefully. If you do not accept it, you should not use our Website or supply your personal data to us.

1. Definitions and terminology

In this Privacy Policy, the terms below carry the meanings set out here:

“Controller” – the natural or legal person that decides why and how personal data is processed. For the purposes of this Policy, the Controller is COSMOS HIGH TECH LTD.

“Personal data” – any information relating to an identified or identifiable living individual (“data subject”); an identifiable person is one who can be recognised, directly or indirectly, in particular by reference to an identifier such as a name, an ID number, location data, an online identifier, or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.

“Processing” / “to process” – any operation or set of operations carried out on personal data, whether or not by automated means, including collecting, recording, organising, structuring, storing, adapting, retrieving, consulting, using, disclosing, disseminating, aligning, combining, restricting, erasing or destroying it.

“UK GDPR” – the UK General Data Protection Regulation, being the retained EU law version of Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland under section 3 of the European Union (Withdrawal) Act 2018, as amended.

“Data subject” / “you” / “your” – any identified or identifiable individual whose personal data we process, such as a Website visitor, customer or contact person.

“Third party” – any natural or legal person, public authority, agency or body other than the data subject, the Controller, the processor and the persons authorised to process the data under the direct authority of the Controller or processor.

“Website” – our website at https://cosmos-hitech.com together with any of its subpages or online resources that we operate and control.

Any term used but not defined here has the meaning given to it in the UK GDPR.

2. Data controller and contact details

We act as the controller of your personal data.

The controller responsible for your personal data is:

COSMOS HIGH TECH LTD
Company Number: 09099499
Registered office: 1 Argyle Street, Bath, BA2 4RF, United Kingdom

For any question about this Privacy Policy or our data protection practices, you can reach us at: info@cosmos-hitech.com

3. Scope and who this Policy applies to

This Policy covers your dealings with us in relation to our Website and products.

It applies to:

  • people who visit our Website;
  • customers who buy our products;
  • people who contact us (for instance by email, through contact forms or via social media);
  • individuals who receive our marketing communications (where permitted).

This Policy does not extend to websites, apps or services run by third parties, including carriers (such as DHL or other delivery partners), payment providers or social media platforms, all of which are governed by their own privacy notices.

4. Categories of personal data we collect

We collect different types of personal data depending on how you interact with us.

Subject to those interactions, we may collect and process the following categories:

Identity and contact data

  • name;
  • billing and delivery address;
  • email address;
  • telephone number (where you provide it).

Order and transaction data

  • products ordered;
  • order dates and amounts;
  • payment status;
  • delivery status and tracking details;
  • information about returns, reversals and chargebacks.

Payment data

basic payment information such as the payment method and transaction references. We do not store full card details — these are handled by our third-party payment processors on our behalf.

Technical and usage data

  • IP address;
  • browser type and version;
  • device identifiers;
  • time-zone setting and approximate location;
  • information about how you use our Website (pages viewed, on-page interactions, referring URLs, session length and similar statistics), gathered automatically through server logs and comparable technologies.

Marketing and communication data

  • your preferences for receiving marketing from us;
  • records of your communication preferences and any consent you have given;
  • information about how you engage with our marketing (including whether you open or click our emails).

Customer support and communication data

  • messages you send us (for example by email, contact form, webchat or social media);
  • information about complaints, returns, reversals and chargebacks;
  • anything else you choose to share when communicating with us.

Social media and online community data (where applicable)

If you interact with us on social media (for example by following our page, commenting, sending a direct message or joining a promotion we run on a platform), we may collect your public profile information (name, username or handle, profile photo), the content of your messages, comments or posts directed to us, and any further information the platform shares with us subject to your settings.

5. How we collect your personal data

We obtain personal data directly from you and from certain third parties.

Data you provide directly. We collect personal data when you:

  • complete forms on our Website (for example at checkout or via a contact form);
  • create or update an account (where this is available);
  • subscribe to our newsletters or other marketing;
  • contact us by email, phone, webchat, social media or other channels;
  • take part in promotions, surveys or similar activities we run.

By completing a submission form and selecting the “send” or “checkout” button you accept the terms of this Policy and give the Controller your informed consent to process your personal data where consent is the applicable legal basis, and you acknowledge that we may also process your data on the other legal bases described in this Policy.

We also assume that the information you submit is accurate and complete; we do not verify its authenticity, and the risk of providing false or incomplete information rests with you. We further assume that you are entitled to give the relevant consent, and that where you are not, consent is provided on your behalf by your legal representative.

Data we collect automatically. When you use our Website, certain technical and usage data is gathered automatically through our IT systems (for example server logs), which enables us to operate, secure and improve the Website and to understand how it is used.

Data we receive from third parties. We may receive personal data about you from:

  • payment service providers (for example payment confirmation, limited payment details, chargeback and reversal information);
  • delivery and logistics partners (such as shipment and delivery status, proof of delivery, and information about returns);
  • analytics and advertising providers (such as aggregated or pseudonymised information about how you use our Website or adverts);
  • social media platforms, when you interact with our content or contact us through them;
  • fraud-prevention and risk-management providers, where applicable.

6. Purposes and legal bases for processing

We only process personal data where we have a lawful basis to do so. Depending on the purpose, we rely on one or more of the following bases under the UK GDPR:

  • processing necessary to perform a contract with you, or to take steps at your request before entering a contract (Art. 6(1)(b) UK GDPR);
  • processing necessary to comply with a legal obligation to which we are subject (Art. 6(1)(c) UK GDPR);
  • processing necessary for our legitimate interests or those of a third party, except where overridden by your interests or fundamental rights (Art. 6(1)(f) UK GDPR);
  • processing based on your consent (Art. 6(1)(a) UK GDPR).

To process and fulfil your orders

Purposes: to receive and process orders; handle payments and transactions; arrange shipping, delivery and returns; keep you informed about your order; and administer reversals and chargebacks.

Legal basis: performance of a contract or pre-contractual steps (Art. 6(1)(b)); and our legitimate interest in running our operations properly and preventing abuse (Art. 6(1)(f)).

Customer service and after-sales support

Purposes: to deal with your enquiries and support requests; manage complaints, reversals, chargebacks and disputes; and administer our returns and refunds (including any statutory cooling-off period or other consumer rights).

Legal basis: performance of a contract (Art. 6(1)(b)); and our legitimate interest in providing good customer service and defending legal claims (Art. 6(1)(f)).

Website operation, security and fraud prevention

Purposes: to run and maintain the Website; safeguard the security and integrity of our systems; detect, investigate and prevent fraud or misuse (including fraudulent payment use and unusual ordering, reversal or chargeback patterns); and enforce our terms.

Legal basis: our legitimate interest in keeping our services secure and protecting our business and customers (Art. 6(1)(f)); and, in some cases, compliance with legal obligations (Art. 6(1)(c)).

Marketing and analytics

Purposes: to send you newsletters and other marketing about our products, offers and promotions where the law allows; tailor that marketing to your history and preferences where permitted; and understand and improve how visitors use our Website, products and campaigns.

Legal basis: your consent (Art. 6(1)(a)), including where required for email or SMS marketing; and our legitimate interest in promoting and developing our business (Art. 6(1)(f)). You may withdraw consent or object to legitimate-interest marketing at any time.

Compliance with legal obligations and legal claims

Purposes: to meet our legal obligations (for example tax, accounting, consumer-protection and data-protection laws); establish, exercise or defend legal claims; and respond to requests from authorities, regulators or courts where legally required or permitted.

Legal basis: compliance with a legal obligation (Art. 6(1)(c)); and our legitimate interest in protecting and defending our rights (Art. 6(1)(f)).

7. Disclosure and recipients of your personal data

We share your personal data only where necessary, and with recipients bound to protect it. These may include:

  • payment service providers handling your payments on our behalf;
  • delivery and logistics partners, including DHL and other carriers, to deliver your orders and manage returns;
  • IT and hosting providers, including providers of website hosting, email, cloud storage and maintenance;
  • analytics and marketing providers, where we use them in accordance with applicable law;
  • customer-support tools (for example webchat or ticketing systems), where used;
  • fraud-prevention, risk-management and security providers, where applicable;
  • professional advisers, including lawyers, accountants and auditors, where needed for advice or to protect our legal rights;
  • public authorities, regulators, law-enforcement bodies or courts, where required by law or necessary to protect rights.

In the event of a corporate transaction such as a merger, acquisition, restructuring, sale of assets or transfer of business, we may pass your personal data to the prospective or actual buyer or successor, subject to appropriate confidentiality and data-protection obligations, and we will ensure any recipient continues to handle it in line with this Policy and applicable law.

8. International transfers

Your personal data may be transferred outside the United Kingdom.

Some of the third parties we engage (for example certain carriers, IT, analytics or payment providers) may process your personal data outside the UK.

Where that happens, we make sure appropriate safeguards apply, such as:

  • a UK Government adequacy decision for the destination country; or
  • standard contractual clauses or other appropriate contractual safeguards approved under the UK GDPR.

You can contact us for more information about the specific safeguards we rely on.

9. How long we keep your personal data

We keep your personal data only for as long as reasonably necessary for the purposes described in this Policy, including to meet legal, tax, accounting or reporting requirements. As a general guide, and subject to legal obligations:

  • technical and usage data of Website visitors is normally kept for up to 12 months from your last interaction, unless a longer period is needed for security or legal reasons;
  • order and transaction data, with the related identity and contact data, is usually held for the statutory retention period under tax and accounting law (as a rule up to 6 years from the end of the relevant financial year, or longer where needed for legal claims);
  • records of customer-support communications are normally kept for as long as needed to resolve the matter and for a reasonable period afterwards (up to 3 years, depending on the issue);
  • marketing data is kept until you withdraw consent or object, or for a shorter period if the law requires, and in any event no longer than 3 years from your last interaction with us.

Once these periods end, we securely delete or anonymise your personal data; in some cases we may retain it in aggregated or anonymised form that no longer identifies you.

10. Security of your personal data

We take appropriate steps to protect your personal data.

We put in place reasonable technical and organisational safeguards designed to keep your personal data secure from unlawful or unauthorised processing, as well as from accidental loss, destruction or damage, having regard to how sensitive the data is and the level of risk involved. Such safeguards may include:

  • access controls, authentication and role-based permissions;
  • encryption or pseudonymisation of data where appropriate;
  • secure hosting environments and regular security updates;
  • internal policies and staff training on data protection and information security;
  • procedures to identify, assess and respond to data breaches.

No system is ever completely secure, however, and we cannot guarantee absolute security, though we work to reduce risks and respond promptly to incidents as required by law.

11. Your rights as a data subject

You have rights in relation to your personal data. Under the UK GDPR these include, subject to conditions and limitations:

  • Right to be informed – to receive clear information about how we use your data (which this Policy aims to provide).
  • Right of access – to confirm whether we process your data and to obtain a copy and related information.
  • Right to rectification – to have inaccurate or incomplete data corrected or completed.
  • Right to erasure – to ask us to delete your data in certain circumstances.
  • Right to restriction – to ask us to restrict processing in certain situations.
  • Right to data portability – to receive data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible.
  • Right to object – to object, on grounds relating to your situation, to processing based on our legitimate interests, which we will then stop unless we show compelling legitimate grounds or need it for legal claims.
  • Right to object to direct marketing – an absolute right to object at any time to use of your data for direct marketing, after which we will stop using it for that purpose.
  • Rights regarding automated decision-making and profiling – where applicable, to obtain information about the logic involved, to seek human intervention, to express your view and to contest the decision.

To exercise any right, contact us at info@cosmos-hitech.com. We may need to verify your identity first.

You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner’s Office (ICO), reachable via ico.org.uk. We would, however, welcome the chance to address your concerns first, so please contact us where possible before approaching the ICO.

12. Automated decision-making and profiling

We do not normally use automated decision-making with legal or similarly significant effects.

We may use certain automated tools (including fraud-detection tools) to help monitor transactions for potentially fraudulent or abusive activity, taking into account factors such as technical information, transaction patterns or chargeback history.

As at the date of this Policy, we do not make decisions based solely on automated processing (including profiling) that produce legal effects concerning you or similarly significantly affect you. Should we do so in future, we will update this Policy and provide the information required by law, together with details of your related rights.

13. Children’s data

Our services are not aimed at children.

Our Website and products are not intended for anyone under 18, and we do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will take steps to delete it as soon as reasonably possible. If you believe a child has given us personal data, please contact us using the details in section 2.

14. Changes to this Privacy Policy

We may update this Policy from time to time, including to reflect changes in our processing, legal requirements or guidance. The latest version will always be available on our Website, and the “Last updated” date shows when it was last revised.

Your continued use of the Website after changes are published constitutes acceptance of the updated Policy. Where changes materially affect your rights, we will take reasonable steps to notify you in advance (for example by email or a prominent notice on the Website).