Privacy Policy

Wizz's Wraps ("we," "our," or "us") operates the website www.wizzswraps.co.uk and provides automotive customization services. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our services.

This policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

Data Controller: Wizz's Wraps, Unit 1, Glendale Street, Stoke-on-Trent, ST6 2EN, United Kingdom

Contact: Email: [email protected] | Phone: 01782 525908

Under UK GDPR, we process your personal data on the following legal bases:

• Consent: When you provide explicit consent for marketing communications, cookies, and analytics
• Contractual Necessity: To fulfill quote requests, bookings, and service delivery
• Legal Obligation: To comply with accounting, tax, and other legal requirements
• Legitimate Interests: To improve our services, detect fraud, and maintain website security (where not overridden by your rights)

We use the information we collect for the following purposes:

• To provide and maintain our services
• To process quote requests and bookings
• To communicate with you about your inquiries and services
• To display our Instagram gallery on our website
• To improve our website and customer experience
• To send promotional communications (with your consent)
• To comply with legal obligations and resolve disputes
• To detect and prevent fraud or security issues

We may share your information in the following circumstances:

• Service Providers: With trusted third-party providers who assist in operating our website and services (e.g., hosting, analytics, payment processing)
• Facebook/Instagram: When you authorize our app, data may be shared with Meta platforms in accordance with their terms
• Legal Requirements: When required by law, court order, or to protect our rights and safety
• Business Transfers: In connection with a merger, sale, or acquisition of our business

We do NOT sell your personal information to third parties.

We use cookies and similar tracking technologies in accordance with UK PECR (Privacy and Electronic Communications Regulations). Cookies are small text files stored on your device.

We run online advertising campaigns on Google, Meta (Facebook/Instagram), YouTube, and TikTok to promote our services. This section explains how we use advertising technologies and your rights regarding targeted advertising.

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Right to be Informed: Understand how your data is collected and used (this policy)
• Right of Access: Request a copy of the personal data we hold about you (Subject Access Request)
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure (Right to be Forgotten): Request deletion of your personal data in certain circumstances (see our Data Deletion page)
• Right to Restrict Processing: Request temporary suspension of data processing in specific situations
• Right to Data Portability: Receive your data in a structured, machine-readable format and transfer it to another organization
• Right to Object: Object to processing based on legitimate interests, direct marketing, or for research/statistical purposes
• Rights Related to Automated Decision-Making: Not be subject to solely automated decisions with significant effects (we do not use automated decision-making)
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent (e.g., marketing, cookies)

To exercise any of these rights, please contact us at [email protected] or 01782 525908. We will respond within one month of receiving your request.

Note: Some rights may not apply in all circumstances. We may need to verify your identity before fulfilling certain requests.

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the UK's supervisory authority:

We encourage you to contact us first so we can address your concerns directly before escalating to the ICO.

We implement appropriate technical and organizational security measures to protect your personal information from unauthorized access, disclosure, alteration, or destruction. These measures include:

• Secure SSL/TLS encryption for data transmission
• Restricted access to personal data on a need-to-know basis
• Regular security audits and updates
• Secure data storage with reputable hosting providers

However, no method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

Some of our service providers and advertising partners are located outside the United Kingdom, which may involve transferring your personal data internationally. When we transfer data outside the UK, we ensure appropriate safeguards are in place:

• Google (USA): Certified under the UK-US Data Bridge Framework and adheres to UK GDPR standards
• Meta/Facebook (USA): Uses Standard Contractual Clauses (SCCs) approved by the ICO
• TikTok (Singapore/USA): Implements appropriate data protection measures and SCCs
• Resend Email Service (USA): GDPR-compliant with appropriate safeguards

You have the right to obtain information about the safeguards we use for international transfers. Please contact us for more details.

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law.

Retention Periods:

• Quote Requests: 3 years from last contact (for potential follow-up and service history)
• Customer Service Records: 6 years (in line with UK accounting and tax requirements)
• Financial Records: 6 years (HMRC requirement for business records)
• Marketing Communications: Until you unsubscribe or withdraw consent
• Cookie Consent Records: 12 months, then refreshed
• Website Analytics: 26 months (Google Analytics default)
• CCTV Footage (if applicable): 30 days unless required for legal purposes
• Social Media Data: Refreshed periodically from our public business accounts

After the retention period expires, we will securely delete or anonymize your personal data. You can request earlier deletion by exercising your right to erasure (subject to legal obligations).

Our website may contain links to third-party websites, including social media platforms (Instagram, Facebook). We are not responsible for the privacy practices or content of these external sites. We encourage you to review their privacy policies before providing any personal information.

Our services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected data from a child, please contact us immediately, and we will take steps to delete such information.

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes by posting the new policy on this page with an updated "Last Updated" date. Your continued use of our services after such changes constitutes your acceptance of the updated policy.