Information you provide
- Name
- Billing and delivery address
- Email address and telephone number
- Order details and purchase history
- Account registration details, where applicable
- Emails, enquiries and support requests
PRIVACY, EXPLAINED CLEARLY
Your data.
Your rights.
This policy explains what personal information Chameleon Scrubs collects, why we use it, how we protect it and the choices available to you.
WHO WE ARE
Your data controller
Chameleon Scrubs is a trading name of Astflick Group Limited, registered in England and Wales under company number 05950580. Chameleon Scrubs is the data controller responsible for the personal data described in this policy.
01 — INFORMATION WE COLLECT
Only what we need to serve you
We may collect information you give us, information created when you order, and limited technical information generated when you use our website.
Collected automatically
- IP address
- Browser type and version
- Device information
- Pages visited and website interactions
- Cookies and similar technologies
Business information
For NHS bodies, hospitals, universities and other organisations, we may also process:
- Job title and organisation name
- Purchase order references
- Professional delivery contact details
This information relates to professional roles rather than people acting in a private capacity.
02 — HOW WE USE YOUR DATA
Used for a clear purpose
We use personal information to:
- Process and fulfil orders
- Manage payments, delivery and returns
- Communicate with you about an order
- Respond to enquiries and customer service requests
- Meet legal and regulatory obligations
- Improve our website, products and services
- Prevent fraud and protect our business
We do not use your data for automated decision-making or profiling.
OUR LAWFUL BASES
Contract
To fulfil orders, take payment and deliver goods.
Legal obligation
For accounting, tax and regulatory compliance.
Legitimate interests
To operate and improve our business, prevent fraud and communicate with customers.
Consent
Where you have explicitly opted in, including certain marketing communications.
You may withdraw your consent at any time.
HOW YOUR INFORMATION IS MANAGED
Shared carefully. Stored responsibly.
Marketing
We only send marketing where you have opted in or where a lawful legitimate interest applies under relevant regulations.
You can opt out at any time by using the unsubscribe link or contacting us.
Trusted service providers
Where necessary, we may share data with:
- Payment providers
- Courier and delivery companies
- IT and website providers
- Accountants, legal advisers and other professional advisers
They must handle data securely and lawfully. We do not sell your personal data.
International transfers
When personal data is transferred outside the UK, we use appropriate safeguards such as adequacy regulations, standard contractual clauses or secure data-handling agreements.
Retention
We keep personal data only for as long as necessary for order fulfilment, legal and accounting requirements, and resolving disputes. The exact period depends on the data and the relevant legal requirements.
DATA SECURITY
Protection is built into how we work
We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse and alteration.
No online system can be guaranteed to be completely secure, but we continually take proportionate steps to reduce risk.
03 — YOUR DATA PROTECTION RIGHTS
You stay in control
Depending on the circumstances, data protection law may give you the following rights. Contact us if you would like to make a request.
Make a data request01Access your personal data
02Correct inaccurate information
03Request deletion where applicable
04Restrict processing
05Object to processing
06Request data portability
07Withdraw consent at any time
COOKIES
Website preferences
Our website uses cookies to support functionality and improve your experience. You can control or disable cookies through your browser settings, although parts of the site may then work differently.
THIRD-PARTY LINKS
Other websites
Our website may link to third-party websites. We are not responsible for their privacy practices or content, so please read their own privacy information before providing personal data.
CONCERNS OR COMPLAINTS
Talk to us first
If you are concerned about how we handle your personal data, please contact us so we can investigate and try to resolve the issue.
Information Commissioner’s Office
You also have the right to lodge a complaint with the UK’s independent data protection regulator.
Visit the ICO website ?04 — NHS & PUBLIC-SECTOR CONTRACTS
Additional data protection commitments
This section explains how we handle personal data when fulfilling contracts for NHS Trusts and other public-sector bodies.
READY
Our normal business activity
Chameleon Scrubs acts as a Data Controller for personal data used for order fulfilment, account management, invoicing, delivery and customer communications.
Documented client instructions
Where we process personal data strictly on the documented instructions of an NHS Trust or public-sector body, we act as a Data Processor for those limited purposes only.
Compliance with data protection law
Chameleon Scrubs shall:
- Process personal data lawfully, fairly and transparently.
- Collect data for specified, explicit and legitimate purposes.
- Limit processing to what is necessary for contract performance.
- Use appropriate technical and organisational security measures.
- Ensure staff handling personal data are subject to confidentiality obligations.
Categories of personal data
Data processed under NHS or public-sector contracts may include:
- Names and professional contact details of staff.
- Job titles and department information.
- Delivery addresses and site contact details.
- Purchase order references and contract identifiers.
Chameleon Scrubs does not process special-category data, including health data, on behalf of NHS bodies.
Data sharing and sub-processors
We may use couriers, IT providers and payment processors where necessary to perform a contract. All sub-processors must be contractually bound to process data securely and use it only for the instructed purpose.
A list of sub-processors can be provided on reasonable request.
International transfers and retention
When personal data is transferred outside the UK, safeguards are used in accordance with UK GDPR, including adequacy regulations or standard contractual clauses.
Contract data is retained only as long as necessary to fulfil obligations and meet legal, accounting and audit requirements. It is securely deleted or anonymised when no longer required.
Data-subject rights
Chameleon Scrubs will provide reasonable assistance to NHS bodies responding to data-subject rights requests where applicable and within the scope of our processing role.
Data-breach management
Chameleon Scrubs maintains procedures to identify, report and manage personal data breaches.
If a breach affects data processed for an NHS or public-sector body, we will notify the relevant organisation without undue delay and provide reasonable cooperation with any required notifications.
Audits and assurance
On reasonable written notice, Chameleon Scrubs will provide information needed to demonstrate compliance, subject to confidentiality, security and proportionality considerations.
Liability and governing law
Nothing in this section shall:
- Require Chameleon Scrubs to accept unlimited liability.
- Extend liability beyond that permitted by applicable law.
- Override any agreed contractual limitation of liability.
This data protection section is governed by the laws of England and Wales.
CHANGES TO THIS POLICY
We will keep this page updated
We may update this Privacy Policy from time to time. Changes will be posted on this page and take effect when published.
STILL HAVE A QUESTION?
Let’s make it clear
Contact the Chameleon Scrubs team if you have a question about this policy, your information or a data-protection request.
