Privacy Policy

Last updated: 16 September 2026

1. Who We Are

AIO Tech Solutions Ltd ("we", "our", "us") is a private limited company registered in England and Wales (company number 15874977). Our registered office is 144 Collingwood Way, Westhoughton, Bolton, BL5 3TT.

We are the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer; please send any privacy questions to kiki@aiotechsolutions.co.uk or call +44 7542 147915.

2. What We Collect and Why

Buying from us

Data: name, email, phone, billing and delivery addresses, order details, order notes, payment status and the payment method type (card, PayPal, Klarna or Pay on Delivery). We do not receive or store full card numbers.
Why: to take and deliver your order, send order emails, handle cancellations, returns, refunds and warranty claims, and prevent fraud.
Lawful basis: performance of a contract; legal obligation (tax and accounting records); legitimate interests (preventing fraud and misuse).

Your browser also remembers your basket and, to save you retyping, the checkout details you entered, in your own browser's local storage. This stays on your device; you can clear it at any time in your browser settings.

Customer accounts (optional)

Data: name, email, phone, your password (stored only as a secure one-way hash, which we can't read), a saved address if you add one, when you activated the account and last logged in, and your orders placed while logged in or with the same email address.
Why: to let you log in, see your orders, fill in checkout for you, keep your account secure (activation and password reset emails, security notices) and prevent misuse.
Lawful basis: performance of a contract (providing the account you asked for); legitimate interests (account security and fraud prevention).
You never need an account to shop: guest checkout is always available. You can close your account at any time from My Account.

Repair bookings

Data: contact details, device make and model, the fault you describe, quotes, repair notes and, for postal repairs, your address.
Why: to diagnose, quote for and carry out the repair, return the device and handle warranty claims. We may come across personal data stored on your device while testing it; we only access what is needed to check the repair and do not copy or keep it.
Lawful basis: performance of a contract (or steps you ask us to take before one); legal obligation; legitimate interests.
Review request: a few days after your repair is completed we may send you one message (by email, or in the chat you booked through) asking for an honest review. Everyone is asked the same way, only once a year, and nothing is offered in return. Lawful basis: legitimate interests; you can ask us not to.
Reviews in our adverts: we only quote a review in our adverts if you have agreed to it, word for word, and you can ask us to stop at any time.

Contact and wholesale enquiries

Data: name, email, phone, company name (wholesale) and your message.
Why: to reply to you and, for wholesale, to prepare a quote.
Lawful basis: legitimate interests in responding to enquiries; steps before a contract where you ask for a quote.

Newsletter and marketing

Data: your email address and a record of when and where you gave consent.
Why: to send marketing emails about products, offers and news.
Lawful basis: your consent, which you give by ticking the consent box. You can withdraw it at any time.
When you sign up we email you a link to confirm; you're only added once you click it, and we record when you confirmed.

Browsing our website

Essential data: your IP address, browser details and pages requested are processed by our web server and security tools so the site works and stays secure (including rate limiting and blocking abuse). Lawful basis: legitimate interests.
Security check: some forms and checkout use Cloudflare Turnstile to check that you are not an automated bot. It processes technical information about your browser and device. Lawful basis: legitimate interests in preventing spam and fraud.
Product view analytics (optional): only if you accept analytics cookies, we set a cookie (aio_visitor) that records which products you view on our site. If you later place an order or send an enquiry, we may link these views to your name and email so we understand what customers are interested in. Lawful basis: consent. Without consent we only count views anonymously.
Other analytics and advertising tools (such as Google Analytics or the Meta Pixel), if we use them, only run after you accept the relevant cookies. Lawful basis: consent.

Measuring our Facebook and Instagram adverts (only with your consent)

When: only if you accept marketing cookies. If you don't, none of this happens.
What: when you view a product, add to basket, start checkout, place an order, book a repair or send a wholesale or contact enquiry, we tell Meta that it happened. This is sent both by the Meta Pixel in your browser and directly from our server (Meta's Conversions API), so it still works if the order is finished by PayPal or Klarna.
Data sent: the event (for example "Purchase"), order value and product IDs, the page address, your IP address and browser details, Meta's cookie IDs (_fbp, _fbc) and, for orders and enquiries, your email, phone number, name, town and postcode in hashed (scrambled, one-way) form so Meta can match the event to an account without us sending the details in readable form.
Where you came from: if you arrived from one of our adverts, we note which advert or campaign link brought you (for example utm_campaign and Meta's click ID) with your order, booking or enquiry, so we know which adverts bring in real customers.
Showing adverts again: Meta may add you to groups we set up of people who visited our website (for example, looked at repairs but didn't book, or viewed a product but didn't buy) or who engaged with our Facebook Page or Instagram, so our adverts can remind you. Meta builds these groups; we never see who is in them, and we do not upload customer email or phone lists to Meta. Website groups keep people for up to 180 days.
Why: to measure which adverts work, stop ones that don't, and show relevant adverts. Lawful basis: consent. You can withdraw it at any time in Cookie settings; this stops any further sharing.
How long: we delete the queued copies of these events after 30 days, and remove your IP address and browser details from them as soon as they have been sent. Meta keeps and uses the data under its own terms as described in Meta's Privacy Policy.

See our Cookie Policy for the cookies we use and how to change your choices.

Messaging us on WhatsApp, Facebook Messenger or Instagram

What: your messages, your name or profile name and user ID on that app, your phone number (WhatsApp), any details you give us (such as your device, the fault and a preferred day) and, if you tapped one of our adverts to start the chat, which advert it was.
Automated assistant: an automated assistant may answer first. It tells you it is automated, uses our price list and shop details, can book a free diagnosis appointment for you, and passes the chat to a member of staff if you ask for a person or it can't help. It uses Anthropic's AI service to write replies; your messages are sent to Anthropic only for that. Type STOP to turn automatic messages off.
Reminders: if you book, we may send you a reminder in the same chat the day before and on the day.
Advert measurement: if the chat started from one of our adverts and it leads to a booking or a sale, we tell Meta that it happened using the advert's click or chat ID (no cookies are involved), so we know which adverts bring customers.
Why: to answer your enquiry and arrange your repair. Lawful basis: steps you ask us to take before a contract, and our legitimate interest in answering enquiries and measuring our adverts. You can object at any time.
How long: chats are kept for 12 months after the last message, and enquiry records for 2 years. Bookings made in a chat are kept as repair records (see section 5). Meta (which runs WhatsApp, Messenger and Instagram) also processes your messages under its own terms.

WhatsApp offers

What: if you join our WhatsApp offers (by sending JOIN, or by agreeing in our shop), we keep your WhatsApp number, name, when and how you agreed, when you stopped, and which offers we sent and whether they were delivered.
Why: to send you occasional offers and news, at most once a week. Lawful basis: your consent. Reply STOP or tap "Stop offers" at any time; we then stop straight away.
How long: while you are subscribed. After you stop, we keep a minimal record (your number and the dates) so we respect your choice and can show when consent was given, unless you ask us to delete it.
Offers are sent through Meta's WhatsApp Business Platform, which processes them under its own terms.

3. Who We Share Data With

We do not sell your personal data. We share it only as needed with:

Stripe (Stripe Payments Europe Ltd and its group), which processes online payments, including PayPal and Klarna payments, and carries out fraud checks.
PayPal and Klarna, if you choose to pay with them. They act as independent controllers for their own services, including any identity, credit or fraud checks, under their own privacy notices.
Hostinger, which hosts our website, database and email.
Cloudflare, which provides the Turnstile security check.
Anthropic, an AI service our staff may use to help sort and draft replies to messages you send us (for example contact or repair enquiries), and which writes the automated assistant's replies in WhatsApp, Messenger and Instagram chats. Your message is sent only for that purpose and no decisions about you with legal or similarly significant effects are made automatically.
Google: Google Fonts (your browser requests fonts from Google, which receives your IP address); Google Maps on our contact page, only if you choose to load the map; and Google Analytics, only if we use it and you consent.
Meta (Meta Platforms Ireland Ltd): if you accept marketing cookies, advert measurement events from the Meta Pixel and from our server, as described above; and, for chats that started from our adverts, whether the chat led to a booking or sale. Under Meta's Business Tools Terms and its Controller Addendum, we and Meta are joint controllers for collecting and sending this data; Meta is responsible for how it uses the data afterwards.
Couriers and delivery partners, who receive your name, delivery address and contact details to deliver orders and repairs.
eBay: we sync stock levels with our eBay listings. No customer personal data from website orders is sent to eBay.
Professional advisers (such as accountants), HMRC, the police or other authorities where required by law or to establish, exercise or defend legal claims.

Our service providers act on our instructions under contracts that require them to protect your data.

4. International Transfers

Some providers (for example Stripe, Cloudflare, Anthropic, Google, Meta, PayPal and Klarna) may process data outside the UK, including in the European Economic Area and the United States. Where data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more information.

5. How Long We Keep Data

Orders, invoices and refunds: 6 years after the end of the financial year they relate to (tax and accounting law).
Repair records: 6 years after the repair, to deal with warranty and legal claims.
Contact and wholesale enquiries that do not lead to an order: 2 years.
WhatsApp, Messenger and Instagram chats: 12 months after the last message.
WhatsApp offers: while you are subscribed; afterwards a minimal record of your choice (see section 2).
Newsletter: until you unsubscribe. We then keep a minimal record (your email and consent/unsubscribe dates) so we respect your choice and can show when consent was given.
Product view analytics (aio_visitor): the cookie lasts up to 1 year; view records are kept for up to 1 year unless linked to an order, when they follow the order period above.
Customer accounts: while your account is open. If you close it, you can no longer log in, and we keep the account record (your details and saved addresses) marked as closed, so we can deal with questions about past orders and reopen it if you sign up again. Order records are kept for the order period above. If you'd like your closed account's personal details erased where we don't need to keep them, contact us and we'll do so. Unused activation or reset links expire within 48 hours.
Security and server logs: around 90 days.
Payment card details: never stored by us.

6. Your Rights

Under UK data protection law you have the right to:

Access the personal data we hold about you
Rectification of inaccurate or incomplete data
Erasure of your data in certain circumstances
Restriction of processing in certain circumstances
Data portability for data you gave us under contract or consent
Object to processing based on legitimate interests, and to direct marketing at any time
Withdraw consent at any time, without affecting processing already carried out

To use any of these rights, email kiki@aiotechsolutions.co.uk. We may need to confirm your identity. We normally respond within one month and there is usually no fee.

To have your data deleted, including messages you sent us on Facebook, Instagram, WhatsApp or TikTok, see Deleting Your Data.

7. Marketing

We only send marketing emails if you have opted in. You can unsubscribe at any time using the link in any marketing email, or by contacting us. Service messages about your orders or repairs are not marketing and are sent regardless.

8. Automated Decisions

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our payment providers (Stripe, PayPal and Klarna) use automated fraud checks, and Klarna uses automated checks to decide whether it can offer you its payment options; please see their privacy notices.

9. Children

Our website and services are not intended for children under 18. We do not knowingly collect personal data from children.

10. Security

We protect personal data with measures including encrypted connections (HTTPS), encrypted storage of sensitive keys, restricted and logged admin access, and secure payment processing by Stripe. No method is completely secure, but we work to keep your data safe and will notify you and the ICO where the law requires.

11. Complaints

Please contact us first if you have a concern. You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, helpline 0303 123 1113, ico.org.uk/make-a-complaint.

12. Changes to This Policy

We may update this policy from time to time. The latest version is always on this page with the date it was last updated.

13. Contact Us

Email: kiki@aiotechsolutions.co.uk
Phone: +44 7542 147915
Address: 144 Collingwood Way, Westhoughton, Bolton, BL5 3TT