Privacy Policy

1. Who We Are

This Privacy Policy explains how {{COMPANY_LEGAL_NAME}} (“we”, “us”, “our”), trading as {{TRADING_NAME}}, collects, uses, stores and discloses personal information when you visit cactus.auzite.com (the “Site”), create an account, place an order, or otherwise interact with us.

For the purposes of the UK GDPR and the EU General Data Protection Regulation, {{COMPANY_LEGAL_NAME}} is the data controller.

Registered address: {{REGISTERED_ADDRESS}}
Company/registration number: {{COMPANY_NUMBER}}
Privacy contact: haroon.webdev@gmail.com
Data Protection Officer / representative: {{DPO_CONTACT_OR_NA}}

2. Scope of This Policy

This Policy applies to the Site and to any orders, accounts, enquiries or communications handled through it. It does not apply to third-party websites we link to, which operate under their own privacy policies.

3. Age Restriction

The Site is intended solely for research professionals, laboratories and institutions, and is restricted to individuals aged {{MINIMUM_AGE}} or over. We do not knowingly collect personal information from anyone below that age. If we learn that we have collected such information, we will delete it and cancel any associated order. See our Terms and Conditions for full eligibility requirements.

4. Information We Collect

4.1 Information you give us

Account details — name, email address, username, password (stored only as a salted hash, never in readable form).
Order and billing details — billing name and address, shipping name and address, telephone number, email address, order contents, order notes.
Business and eligibility details — institution or company name, VAT/tax number, and where we request it, evidence that you are a qualified purchaser, together with any age or research-use declaration you submit at checkout.
Correspondence — the content of emails, contact form submissions, support tickets and any attachments you send us.
Reviews and user content — any review, comment or other material you choose to publish on the Site.
Marketing preferences — your consent status for newsletters and promotional email.

We do not receive or store full payment card numbers. Card details are entered directly into our payment provider’s environment and are never transmitted to or stored on our servers.

4.2 Information collected automatically

Technical and connection data — IP address, browser type and version, operating system, device type, screen characteristics, language and time zone settings.
Usage data — pages viewed, referring URLs, products viewed, cart contents, session duration, and the date and time of each request.
Server and security logs — requests made to the Site, login attempts (including failed attempts and the username used), and requests blocked by our firewall.
Cookie data — as described in section 6.

4.3 Information from third parties

Payment and fraud-screening results from our payment provider (for example, an authorisation outcome or risk score — not card data).
Delivery status and tracking updates from shipping carriers.
Threat intelligence from our security provider indicating whether an IP address is associated with malicious activity.

5. How We Use Your Information, and Our Legal Bases

Purpose	Data used	Legal basis (UK/EU GDPR)
Processing and fulfilling your order, arranging delivery, issuing invoices	Account, order, billing and shipping data	Performance of a contract
Creating and managing your account, and providing customer support	Account data, correspondence	Performance of a contract
Sending transactional email (order confirmations, shipping notices, password resets)	Name, email address, order data	Performance of a contract
Verifying eligibility, age and intended use; screening and, where necessary, refusing orders	Eligibility declarations, order data, technical data	Legal obligation; legitimate interests (lawful and responsible supply)
Preventing fraud, abuse, bot traffic, credential-stuffing and other attacks against the Site	IP address, technical data, security logs, reCAPTCHA signals	Legitimate interests (protecting our systems, customers and business)
Keeping accounting, tax and transaction records	Order, billing and payment records	Legal obligation
Responding to legal requests, exercising or defending legal claims	Any relevant data	Legal obligation; legitimate interests
Sending marketing email and newsletters	Name, email address, purchase history	Consent (withdrawable at any time)
Analytics, advertising measurement and improving the Site	Usage data, cookie identifiers	Consent

6. Cookies and Similar Technologies

We use cookies and comparable technologies to operate the Site, keep your cart and session working, secure your login, and — where you consent — to measure traffic and advertising performance.

6.1 Strictly necessary

Cookie	Set by	Purpose	Typical duration
`woocommerce_cart_hash`	WooCommerce	Detects when the cart contents change	Session
`woocommerce_items_in_cart`	WooCommerce	Detects when the cart contents change	Session
`wp_woocommerce_session_*`	WooCommerce	Links your browser to your cart and session data on our server	48 hours
`wordpress_logged_in_`, `wordpress_sec_`	WordPress	Keeps you signed in and authenticates each request	Session or up to 14 days
`wp-settings-*`	WordPress	Remembers interface preferences for signed-in users	1 year
`_GRECAPTCHA`	Google	Bot detection and abuse prevention (see 7.3)	Up to 6 months
`wfwaf-authcookie-`, `wf_loginalerted_`, `wfCBLBypass`	Wordfence	Firewall and login-security functions (see 7.4)	Session to 1 year

6.2 Optional cookies

Analytics and advertising cookies, including those set by {{ANALYTICS_PROVIDERS}}, are only placed after you consent through our cookie banner. You can change or withdraw your choice at any time via the cookie settings link in the site footer, or by clearing cookies in your browser. Blocking strictly necessary cookies will prevent checkout and login from working.

7. Third-Party Services That Process Your Data

We use the providers below. Each acts as a processor or, where indicated, an independent controller. We share only the data each needs to perform its function.

7.1 Payment processing

Payments are handled by {{PAYMENT_PROCESSORS}}. When you pay, your card or account details are submitted directly to the provider, which processes them as an independent controller under its own privacy policy. We receive only the transaction reference, authorisation result, the last four digits and card type, and any fraud-risk indicator. We never see or store your full card number, expiry date or security code.

7.2 Transactional and marketing email (SMTP)

Email from the Site — order confirmations, shipping notifications, password resets, contact-form messages and, where you have consented, newsletters — is not sent directly from our web server. It is relayed through a third-party SMTP provider, {{SMTP_PROVIDER}}, so that messages are authenticated and reliably delivered.

This means the following is transmitted to and processed by that provider:

Your name and email address, and any other recipient addresses on the message.
The subject line and full content of the message, which may include order numbers, product names, quantities, prices and your shipping address.
Delivery metadata — sending and receiving IP addresses, timestamps, delivery, bounce and spam-complaint status, and (where engagement tracking is enabled) whether a message was opened and which links were clicked.

The provider retains message logs for its own operational and abuse-prevention purposes for the period stated in its documentation. Its privacy policy is available at {{SMTP_PROVIDER_PRIVACY_URL}}. Some of these providers are located outside the UK/EEA — see section 9.

7.3 Google reCAPTCHA

We use Google reCAPTCHA on the login, registration, checkout, review and contact forms to distinguish human visitors from automated software and to prevent spam, fake account creation, carding attacks and other abuse. reCAPTCHA is provided by {{GOOGLE_ENTITY}} (“Google”).

When reCAPTCHA runs, it collects hardware and software information from your device and transmits it to Google for analysis. This can include your IP address, the referring URL, browser and operating system details, installed plug-ins, screen resolution, the date and time of your visit, cookies already placed by Google, and behavioural signals such as mouse movement, scrolling and keystroke timing on the page. Google uses this data to produce a risk score for the interaction. Some analysis takes place automatically in the background without any action from you.

Google acts as an independent controller for this data. Your use of reCAPTCHA is subject to the Google Privacy Policy and Google Terms of Service. Our legal basis is our legitimate interest in protecting the Site and our customers from abuse and fraud. Google may transfer this data outside the UK/EEA — see section 9.

If you disable JavaScript or block Google domains in your browser, reCAPTCHA-protected forms, including checkout and login, may not submit.

7.4 Wordfence (website security)

We run Wordfence to protect the Site against hacking attempts, malware, brute-force login attacks and other malicious traffic. Wordfence operates a firewall and scanner on our own server, and its logging is therefore applied to all visitors.

Wordfence records, on our server:

Your IP address, user agent string, the URL requested, the referring URL and the timestamp of the request.
Login and registration attempts, including the username submitted and whether the attempt succeeded or failed. Passwords are never logged.
Details of any request that is blocked or rate-limited, and the rule that triggered the block.
File-integrity and malware scan results for our own files.

Where a request is identified as malicious, or where our licence, blocklist and threat-intelligence features require it, limited data — principally the offending IP address, the nature of the attack and associated request metadata — may be transmitted to Defiant, Inc. (the developer of Wordfence) to update its threat-intelligence feed and to validate our licence. Wordfence also checks submitted passwords against known-breached password data using a privacy-preserving method that does not transmit the password itself. Wordfence’s privacy policy is available at wordfence.com/privacy-policy.

Our legal basis is our legitimate interest in network and information security. Security logs are retained for 30 days and then discarded, except where a record must be preserved to investigate an incident or support a legal claim.

7.5 Hosting and infrastructure

The Site is hosted by {{HOSTING_PROVIDER}}, whose infrastructure stores our database, files and server logs. {{CDN_OR_NA}} may also process request data in order to deliver content and mitigate denial-of-service attacks.

7.6 Shipping and fulfilment

We share your name, delivery address, telephone number and email address with {{SHIPPING_CARRIERS}} so that they can deliver your order and provide tracking. For international shipments, the information required by customs authorities is also provided — see section 9 and clause 14 of our Terms and Conditions.

7.7 Analytics and advertising

Where you have consented, we use {{ANALYTICS_PROVIDERS}} to understand how the Site is used and to measure the performance of our marketing. These services set cookies or similar identifiers and may receive your IP address, device information and details of the pages and products you view. We do not transmit your name, email address, postal address or telephone number to these services.

7.8 Other processors

8. When We Disclose Information

We do not sell your personal information. We disclose it only:

to the service providers listed in section 7, under written terms restricting their use of it;
to our professional advisers — accountants, auditors, insurers and lawyers — where necessary;
to law enforcement, regulators, courts or other authorities where we are legally required to do so, or where disclosure is necessary to establish, exercise or defend legal claims;
to a buyer or successor entity in the event of a merger, acquisition or sale of assets, subject to this Policy continuing to apply;
with your consent, in any other case.

9. International Transfers

Some of our providers — including our SMTP provider, Google, Defiant, Inc. and certain payment and analytics providers — are located in, or transfer data to, countries outside the United Kingdom and European Economic Area, including the United States. Where we transfer personal data outside the UK/EEA, we rely on an adequacy decision where one applies, or on Standard Contractual Clauses (with the UK International Data Transfer Addendum where relevant), together with additional safeguards where appropriate. You may request further detail using the contact details in section 18.

10. How Long We Keep Your Information

Category	Retention period
Order, invoice and payment records	{{FINANCIAL_RETENTION}} from the end of the relevant financial year, to meet tax and accounting obligations
Account data	For as long as your account is active, then 24 months after your last order or last login
Eligibility and research-use declarations	Retained with the associated order record
Customer support correspondence	24 months
Marketing consent records and subscriber data	Until you unsubscribe, plus a suppression record kept indefinitely so we do not contact you again
Security and firewall logs	30 days
Analytics data	14 months

Where data no longer needs to be identifiable, we anonymise it rather than delete it.

11. Security

We maintain technical and organisational measures appropriate to the risk, including TLS encryption in transit across the whole Site, hashed password storage, a web application firewall and malware scanning, restricted administrative access with strong authentication, regular software updates, and encrypted, access-controlled backups. No system can be guaranteed completely secure; you are responsible for keeping your account password confidential and for notifying us promptly if you believe your account has been compromised.

12. Your Rights (UK and EU)

If the UK GDPR or EU GDPR applies to you, you have the right to:

request access to the personal data we hold about you, and a copy of it;
have inaccurate data corrected;
request erasure of your data, where we have no overriding legal obligation to retain it;
request that we restrict processing in certain circumstances;
receive data you gave us in a portable, machine-readable format, or have it transmitted to another controller;
object to processing carried out on the basis of legitimate interests, and to object to direct marketing at any time;
withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact haroon.webdev@gmail.com. We will respond within one month and may ask you to verify your identity first. There is no charge unless a request is manifestly unfounded or excessive.

You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner’s Office (ico.org.uk); in the EEA it is the authority in your country of residence.

13. Your Rights (United States)

Depending on your state of residence — including California, Colorado, Connecticut, Virginia, Utah, Texas and other states with comprehensive privacy laws — you may have the right to know what personal information we collect and how we use and disclose it, to obtain a copy of it, to correct inaccuracies, to request deletion, and to opt out of the sale or sharing of personal information and of targeted advertising.

We do not sell personal information for money. Where advertising cookies are used with your consent, this may be treated as “sharing” for cross-context behavioural advertising under the CPRA; you can opt out via the cookie settings link in the site footer or by transmitting a Global Privacy Control signal, which we honour. We do not knowingly sell or share the personal information of anyone under 16.

We will not discriminate against you for exercising any of these rights. To submit a request, email haroon.webdev@gmail.com. An authorised agent may submit a request on your behalf with written proof of authorisation.

14. Automated Decision-Making

We use automated risk scoring from reCAPTCHA and from our payment provider to screen for fraud and abuse. This may result in a form submission or an order being declined. These processes do not produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR, and a declined order can be reviewed manually on request by contacting us.

15. Children’s Privacy

The Site is not directed at children, and we do not knowingly collect personal information from anyone under {{MINIMUM_AGE}}. If you believe a child has provided us with personal information, contact us and we will delete it.

16. Third-Party Links

The Site may link to external websites, including supplier documentation, certificates of analysis hosted elsewhere, and research literature. We are not responsible for the privacy practices or content of those sites.

17. Changes to This Policy

We may update this Policy from time to time. The revised version takes effect when posted, and the “Last updated” date above will change. Where a change materially affects how we use your personal data, we will provide notice by email or a prominent notice on the Site before it takes effect.

18. Contact Us

{{COMPANY_LEGAL_NAME}}
{{REGISTERED_ADDRESS}}
Email: haroon.webdev@gmail.com
Phone: +92 304 620 2040