Privacy Policy
Updated and effective: 10 October 2026 | Next review: 10 October 2027
Falcon Stars Group Ltd, trading as Falcon Stars Healthcare, is the controller responsible for personal information used in operating falconstars.co.uk, handling enquiries and supplying products. This notice explains our use of personal information under the UK GDPR and the Data Protection Act 2018, as amended.
For privacy questions, rights requests or complaints, contact info@falconstars.co.uk or write to the Managing Director at Regus, Central Boulevard, Blythe Valley Business Park, Solihull, B90 8AG, United Kingdom. Telephone: +44 777 555 2222. Our registered office is 22 Kilsby Grove, Solihull, B91 3XZ, United Kingdom. For product, order and return enquiries, use sales@falconstars.co.uk.
You provide information through our website, checkout, email, telephone and correspondence. This can include your name, organisation, business role, email address, telephone number, billing and delivery addresses, product requirements, order details, delivery instructions and correspondence about returns, complaints or product safety.
Our shop records order and transaction references, payment status, refunds and delivery tracking information. Payment providers process payment details and may provide limited payment-method information and fraud-check results. Delivery providers supply tracking and delivery updates. If a colleague places an order or enquiry for you, we receive the contact and delivery details they provide.
Website services may collect IP addresses, browser and device information, pages visited, referral information, consent choices and security logs. Google measurement services may associate visits and enquiries with advertising interactions, subject to the choices described below.
Please do not send patient records, health information or other sensitive personal information in ordinary enquiries, order notes or product photographs. If a safety matter requires sensitive information, contact us first so we can establish a suitable lawful basis and secure handling arrangements.
Enquiries and quotations: we use contact details and requirements to respond and prepare quotations. Where you are personally the prospective customer, this is to take steps at your request before entering a contract. For contacts acting for an organisation, we rely on our legitimate interests in responding to professional enquiries and managing business relationships.
Orders, payments, deliveries and returns: we use the information needed to perform our contract with an individual customer. For an organisation's representatives and delivery contacts, we rely on legitimate interests in fulfilling and administering that organisation's orders.
Accounting and regulatory records: we use necessary information to meet applicable tax, accounting, product-safety and other legal obligations. Complaints, safety follow-up and claims may also involve our legitimate interests in resolving problems, maintaining traceability and establishing or defending legal claims.
Security and fraud prevention: our legitimate interests are protecting customers, our website and our business from misuse, fraud and unauthorised access. We consider the necessity of the processing and its impact on individuals.
Optional analytics and advertising cookies: we rely on consent for optional tracking where required. Any marketing requiring consent must be separately agreed; placing an order does not by itself mean consenting to promotional messages. Essential order and service messages are part of administering your enquiry or purchase.
Our online shop uses WooCommerce and WooPayments, which works with Stripe. When you use an enabled payment method, relevant contact, billing, order, transaction and device information is processed by these services to handle payment, authentication, refunds, disputes, fraud prevention and legal requirements.
Full card details and security codes are handled by the payment provider rather than stored in our ordinary shop order records. Do not email card details to us. Payment providers, banks and any wallet provider you choose may also use information for their own legal, security and service purposes, as explained in their privacy notices. See automattic.com/privacy/ and stripe.com/gb/privacy.
Royal Mail Click & Drop is connected to our shop for order fulfilment. Relevant order information, recipient names, delivery addresses and, where needed, email addresses, telephone numbers and parcel details are shared to arrange postage, labels, tracking, delivery notifications and returns. Royal Mail also processes information for its own delivery and legal purposes: royalmail.com/privacy-notice.
Other service providers include 123 Reg / GoDaddy for hosting and website services, Microsoft for business email, and Google for Analytics, Ads measurement and maps. Authorised personnel and IT support may access information needed for their work. Relevant professional advisers, insurers, payment-dispute parties, regulators or authorities may receive information where necessary and lawful.
Where a product complaint or safety investigation requires a manufacturer or other supply-chain participant to assist, our policy is to use product references and non-identifying details wherever possible and disclose personal information only where necessary and lawful. We do not sell personal information. Processors acting on our instructions must be subject to appropriate data-protection terms; organisations acting as independent controllers apply their own notices.
Our hosting, email, payment and Google providers may process information outside the UK, including in the United States, the European Economic Area and other countries where their operations and service providers are located.
The applicable providers' data-protection terms describe their transfer arrangements. Depending on the destination and service, these may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework for eligible certified recipients, or contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, with any required transfer assessment. These mechanisms are not interchangeable and depend on the particular transfer. Contact info@falconstars.co.uk to request details or a copy of safeguards relevant to your information.
Provider information is available at www.123-reg.co.uk/terms/data-processing-addendum/, privacy.microsoft.com, automattic.com/privacy/, stripe.com/gb/privacy and policies.google.com/privacy/frameworks.
Our retention policy is to keep personal information only for the purpose for which it is needed and to review exceptions before deletion or anonymisation. Non-order enquiries are normally retained for 24 months after the last meaningful contact. Active quotations and tenders are kept while genuinely active and reviewed when closed.
Necessary completed-order, refund, invoice and accounting records are normally retained for six years after the end of the relevant financial year, or longer where a specific legal obligation applies. Unpaid, failed or abandoned order information is reviewed according to whether it is needed to resolve a payment problem, customer enquiry, dispute or suspected fraud; it should not be retained indefinitely merely because it exists.
Product traceability, safety complaints, recalls, investigations and legal claims can require longer retention. The period depends on the applicable product rules, our role, the life of the matter and relevant limitation periods. Only information necessary for that purpose should be retained.
Technical logs, backups and cookie or analytics records follow the relevant service purpose and retention settings. Cookie durations are described in our Cookie Policy. Records awaiting routine backup expiry are not intended for ordinary business use. Retention reviews must include information held in email and delivery systems, not just the shop.
We use Complianz to manage cookie choices, Google Analytics to understand website use and Google Ads measurement to assess advertising and enquiry conversions. Necessary technologies support the website, basket, checkout, security and consent preferences. Optional statistics and marketing storage is controlled through the consent banner.
You can choose Accept, Deny or View Preferences and reopen your choices through the Cookies control on the website. Withdrawing consent does not affect the lawfulness of processing before withdrawal. You can browse, enquire and use essential shop functions without agreeing to optional marketing cookies.
Our Google measurement tag loads only after both statistics and marketing consent have been accepted. Declining either category prevents that tag from loading. Withdrawing either permission after acceptance refreshes the page to stop further measurement through that tag. Embedded Google Maps requires the relevant consent. For details, see falconstars.co.uk/cookie-policy-uk/ and policies.google.com/privacy. External websites and payment or wallet services have their own notices.
Our policy is to restrict access to people who need it, use appropriate technical and organisational safeguards, and investigate suspected security incidents. No online system or transmission can be guaranteed completely secure. Please tell us promptly if you suspect personal information has been exposed or sent to the wrong person.
We need relevant contact information to answer an enquiry and billing, delivery and payment information to process an order. If required details are not supplied, we may be unable to respond, take payment or deliver. Optional information and optional cookie consent are not conditions of purchase.
Subject to applicable conditions, you can request access to your personal information, correction, erasure, restriction of processing and data portability. You may withdraw consent at any time for processing based on consent.
Your right to object: you can object to processing based on legitimate interests for reasons relating to your circumstances. You can object to the use of your information for direct marketing at any time. Contact info@falconstars.co.uk; you do not need to use a particular form.
We normally respond to rights requests without undue delay and within one calendar month. We may request proportionate information to verify identity where necessary. If a lawful extension or other exception applies, we will explain it; complex or numerous requests may allow up to two additional months. Requests are normally free. We will explain any lawful refusal or fee and your right to complain.
We do not make solely automated decisions about enquiries that have legal or similarly significant effects. Payment providers may use automated authentication and fraud screening which can affect whether a payment is accepted. Their notices explain their processing and rights; contact us if you need help with a declined order payment.
You can raise a data-protection complaint by email, telephone or post using the details in section 1. Please describe the issue and the outcome you are seeking; avoid including unnecessary sensitive information. The Managing Director is the contact for reviewing privacy concerns.
We will acknowledge a privacy complaint within 30 days, make appropriate enquiries without undue delay, keep you informed and communicate the outcome and any steps to address the issue. You can also complain to the Information Commissioner's Office (ICO), the UK data-protection regulator, at ico.org.uk/make-a-complaint/ or on 0303 123 1113.
This revision is effective from 10 October 2026 and replaces the 2 October 2026 notice. It reflects our distributor and online-shop arrangements, including payments and delivery services. We will review it when processing changes and at least annually, with the next scheduled review on 10 October 2027. Material new uses will be explained before they begin where required.