PRIVACY POLICY

Last Updated: August 25, 2026

Indigo Mesa Online (“we,” “us,” or “our”) operates the website indigo-mesa.online (the “Site”). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site. Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the Site.

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). 

1. Who We Are

Data Controller: Indigo Mesa Online

Address: 47 MacDonald St, Birmingham B5 6TG, United Kingdom

Email: [email protected]

Telephone: +441216666016

For the purposes of the UK GDPR, we are the data controller responsible for the personal data we collect and process. Our registered address is as stated above. 

2. What Personal Data We Collect

We may collect the following categories of personal data:

Data You Provide to Us:

  • Contact Information: Name, email address, telephone number, and any other information you choose to provide when contacting us via email, phone, or through contact forms on our Site.

  • Transaction Data: If you purchase goods or services, we may collect billing address, delivery address, payment information, and order details.

  • Account Information: Username, password, and preferences if you create an account on our Site.

Data Collected Automatically:

  • Technical Data: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this Site.

  • Usage Data: Information about how you use our Site, products, and services, including pages visited, time spent on pages, clickstream data, and referral URLs.

  • Cookies and Tracking Technologies: We use cookies and similar tracking technologies to enhance your experience, analyse traffic, and personalise content. For more information, please see our Cookie Policy. 

Data from Third Parties:
We may receive personal data about you from third-party service providers, such as analytics providers (e.g., Google Analytics), payment processors, and advertising networks.

3. How We Use Your Personal Data

We process your personal data for the following purposes:

Purpose Lawful Basis
To provide and maintain our Site and services Contractual necessity (Article 6(1)(b))
To process and fulfil orders, including delivery and returns Contractual necessity (Article 6(1)(b))
To communicate with you, respond to enquiries, and provide customer support Legitimate interests (Article 6(1)(f))
To send you marketing communications (where you have consented) Consent (Article 6(1)(a))
To improve our Site, products, and services Legitimate interests (Article 6(1)(f))
To comply with legal obligations, including tax, accounting, and regulatory requirements Legal obligation (Article 6(1)(c))
To protect against fraud, unauthorised transactions, and other liabilities Legitimate interests (Article 6(1)(f))

Where we rely on legitimate interests, those interests are: (a) providing and improving our services; (b) ensuring the security and proper functioning of our Site; and (c) marketing and promoting our business. You have the right to object to processing based on legitimate interests. 

4. Cookies and Tracking

We use cookies and similar tracking technologies on our Site. Under PECR, we require your consent for all non-essential cookies. Essential cookies necessary for the functioning of the Site may be set without prior consent.

  • Essential Cookies: Required for basic Site functionality (e.g., session management, shopping cart).

  • Analytics Cookies: Help us understand how visitors interact with our Site (e.g., Google Analytics).

  • Marketing Cookies: Used to deliver relevant advertisements and track campaign performance.

You can manage your cookie preferences through our cookie consent tool, which is available when you first visit our Site. You can also adjust your browser settings to refuse cookies, though this may affect your experience. 

5. Sharing Your Personal Data

We may share your personal data with the following categories of recipients:

  • Service Providers: Third-party vendors who provide services on our behalf, including:

    • IT hosting and cloud providers

    • Payment processors (e.g., Stripe, PayPal)

    • Analytics providers (e.g., Google Analytics)

    • Email marketing platforms

    • Customer support platforms

  • Delivery and Fulfilment Partners: Courier and logistics companies for order delivery.

  • Professional Advisers: Accountants, lawyers, and auditors where necessary.

  • Regulatory Authorities: If required by law or to protect our rights, safety, or property.

All third-party service providers are required to process your data in accordance with our instructions and applicable data protection laws. We have Data Processing Agreements in place with all relevant processors. 

6. International Data Transfers

Your personal data may be transferred to, and processed in, countries outside the United Kingdom. This may include the European Economic Area (EEA) and the United States. Where we transfer your data internationally, we ensure appropriate safeguards are in place, such as:

  • Transfers to countries with adequacy regulations issued by the UK Government.

  • Standard contractual clauses approved by the UK Information Commissioner’s Office (ICO), including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

You can request a copy of these safeguards by contacting us. 

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for legal, accounting, or reporting requirements.

Retention periods:

  • Contact and enquiry data: Up to 2 years after your last interaction.

  • Transaction data: 6 years to comply with tax and accounting obligations (HMRC requirements).

  • Marketing data: Until you unsubscribe or withdraw consent.

  • Account data: For as long as your account remains active, plus a reasonable period thereafter.

When data is no longer required, it will be securely deleted or anonymised. 

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

  • Encryption of data in transit (SSL/TLS)

  • Access controls and restricted permissions

  • Regular security assessments and staff training

  • Secure storage systems and firewalls

While we strive to protect your data, no transmission over the internet is completely secure. We cannot guarantee absolute security, but we take all reasonable steps to safeguard your information. 

9. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

  • Right to be Informed: You have the right to know how we collect and use your data (this Privacy Policy fulfils that requirement).

  • Right of Access: You can request a copy of the personal data we hold about you (Subject Access Request). We will respond within one month and provide the information free of charge, unless requests are manifestly unfounded or excessive.

  • Right to Rectification: You can request correction of inaccurate or incomplete data.

  • Right to Erasure (“Right to be Forgotten”): You can request deletion of your data in certain circumstances.

  • Right to Restrict Processing: You can request that we restrict the processing of your data.

  • Right to Data Portability: You can request a copy of your data in a structured, machine-readable format and have it transferred to another controller.

  • Right to Object: You can object to processing based on legitimate interests, including direct marketing.

  • Right to Withdraw Consent: Where we rely on your consent, you can withdraw it at any time.

  • Rights relating to Automated Decision-Making: We do not engage in automated decision-making or profiling that has legal or significant effects. 

To exercise any of these rights, please contact us at [email protected] or write to us at the address above. You do not have to pay a fee for these requests.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Please contact us first, so we can address your concerns directly.

Information Commissioner’s Office:

  • Website: www.ico.org.uk

  • Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

  • Telephone: 0303 123 1113

10. Third-Party Links

Our Site may contain links to third-party websites, plug-ins, and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit. 

11. Children’s Data

Our Site is not intended for children under 16 years of age. We do not knowingly collect personal data from children. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately, and we will take steps to delete such information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the updated policy on our Site with a revised “Last Updated” date. Where required, we will seek your consent to significant changes.

Please review this Privacy Policy periodically to stay informed about how we protect your data.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Indigo Mesa Online
47 MacDonald St, Birmingham B5 6TG, United Kingdom
Email: [email protected]
Telephone: +441216666016

We will respond to all enquiries as promptly as possible.