Privacy Policy

Last updated: 26 March 2026

This Privacy Policy explains how Sefam Medical Ltd collects, uses, stores and shares your personal data when you visit www.sefam.co.uk, place an order, contact us, or otherwise use our website and services. It also explains your rights under UK data protection law. Under the UK GDPR, individuals have the right to be informed about how their personal data is collected and used.

1. Who We Are

Sefam Medical Ltd is the data controller for the personal data collected through this website.

Sefam Medical Ltd
Unit 6, Blackthorn Way
Five Mile Business Park
Lincoln
LN4 1BF

Company number: 13500192
VAT Registration Number: 385882538

Email: customerserviceuk@sefam-medical.com
Telephone: 01522 701500

For the purposes of UK data protection law, Sefam Medical Ltd is responsible for deciding how and why your personal data is processed.

2. The Personal Data We Collect

We may collect and process the following categories of personal data:

• your name
• billing address and delivery address
• email address
• telephone number
• order details, including products purchased and transaction information
• information you provide when contacting us by email, phone or through the website
• information relating to VAT relief self-declaration and eligibility
• technical information such as IP address, browser type, device information and website usage data
• cookie and similar tracking data, where applicable

Under UK GDPR, personal data includes information relating to an identified or identifiable person, and online identifiers such as IP addresses can also fall within that scope.

We collect personal data directly from you when you place an order, complete forms, subscribe to communications, contact us, or interact with our website. We also collect certain technical and usage information automatically through cookies and similar technologies where permitted.

3. How We Use Your Personal Data

We use your personal data to:

• process and deliver your orders
• take payment and manage refunds
• communicate with you about your order
• provide customer service and respond to enquiries
• maintain business records and comply with legal and tax obligations
• verify eligibility for VAT relief where applicable
• prevent fraud and protect our website, business and customers
• improve our website, products and services
• send marketing communications where permitted by law
• send post-purchase review invitations relating to your order
• manage and administer our business generally

UK GDPR requires organisations to identify the purposes for which they use personal data and to have a valid lawful basis for each use. Personal data should also be limited to what is necessary and not kept for longer than needed.

4. Our Lawful Bases for Processing

We rely on one or more of the following lawful bases when processing your personal data:

Contract – where processing is necessary to take steps at your request before entering into a contract, or to perform our contract with you, such as processing and delivering your order.

Legal obligation – where we need to process your data to comply with the law, for example accounting, tax, fraud prevention, and consumer law obligations.

Legitimate interests – where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include customer service, website administration, fraud prevention, business record keeping, service improvement, and sending review invitations after a purchase. Legitimate interests is one of the recognised lawful bases under the UK GDPR.

Consent – where consent is required, for example for certain cookies or certain electronic marketing communications. If PECR requires consent for cookies or direct marketing, consent is also the appropriate lawful basis under UK GDPR for that activity.

5. Orders, Payments and VAT Relief

When you place an order, we use your personal data to process payment, arrange dispatch and delivery, communicate with you about your purchase, and handle returns, refunds or support queries. This processing is usually necessary for the performance of our contract with you and, in some cases, to comply with legal obligations.

Where you make a VAT relief self-declaration, we process the information you provide for the purpose of administering the sale correctly and meeting our legal and regulatory obligations. We may also retain related information as part of our accounting and compliance records for as long as reasonably necessary. UK data protection law requires organisations to justify retention and not keep personal data longer than necessary.

We do not store full payment card details on our own systems where payments are handled by third-party payment providers. Payment information is processed by the relevant payment provider in accordance with its own privacy and security practices.

6. Customer Service Communications

If you contact us, we may keep a record of your correspondence and any information you provide so that we can respond to your enquiry, provide support, and improve our customer service processes. This is generally necessary for our legitimate interests and, where your enquiry relates to an order, may also be necessary for the performance of our contract with you.

7. Reviews and Trustpilot

After you complete a purchase, we may invite you to review your experience with us. We may do this directly or through a third-party review provider such as Trustpilot. To send or facilitate these review invitations, we may share limited personal data such as your name, email address and order reference or order details connected to your purchase.

We use this information to collect genuine customer feedback, improve our products and services, and help other customers make informed decisions. We rely on our legitimate interests for this processing. UK GDPR recognises legitimate interests as a lawful basis where the processing is necessary and balanced against the individual’s rights.

Review invitations are intended to relate to a recent transaction and customer experience. They are separate from promotional marketing emails. Where we send you marketing by electronic means, we will do so only where permitted by law and, where required, on the basis of consent. The ICO states that if PECR requires consent for direct marketing, consent is also the appropriate lawful basis under UK GDPR.

If you do not want your data used for review invitations, you can contact us using the details in this Privacy Policy and we will consider your request in line with applicable law. Individuals also have the right to object to certain processing, including processing based on legitimate interests.

8. Marketing Communications

We may send you marketing communications where you have consented, where you have requested them, or where we are otherwise permitted to do so under applicable law. You can opt out of marketing emails at any time by using the unsubscribe link in the email or by contacting us. The ICO’s guidance explains that consent or legitimate interests may apply depending on the type of direct marketing, but where PECR requires consent, that consent is the appropriate lawful basis.

9. Cookies and Similar Technologies

Our website may use cookies and similar technologies to enable core site functions, improve performance, understand how visitors use the website, remember preferences, and support analytics or other services. Some cookies are strictly necessary for the operation of the website, while others require your consent.

Where cookies are not strictly necessary, we will seek your consent before placing them on your device. If you refuse certain cookies, some parts of the website may not function properly. Under ICO guidance, where PECR requires consent to use cookies, consent is also the appropriate lawful basis under UK GDPR for the related processing.

You can usually manage cookie preferences through our cookie banner or your browser settings. If you operate a separate Cookie Policy or cookie banner on the site, it should match what is stated here.

10. Sharing Your Personal Data

We may share your personal data where necessary with:

• payment providers
• delivery and courier companies
• website, hosting and IT service providers
• analytics and technology providers
• customer service and communications providers
• review service providers such as Trustpilot
• professional advisers such as accountants, insurers or legal advisers
• regulators, law enforcement bodies or courts where required
• potential buyers or successors in connection with a business sale, merger or restructure

Where we use third parties to process personal data on our behalf, they act as service providers/processors and must handle the data in accordance with contractual and legal requirements. The ICO notes that organisations must have clear arrangements in place when data is shared or processed by others.

We do not sell your personal data in the ordinary meaning of the word “sell.”

11. International Transfers

Some of our service providers may store or process personal data outside the UK. Where this happens, we will take steps to ensure that your personal data remains protected and that any restricted transfer is carried out in accordance with UK data protection law. This may include relying on adequacy regulations or appropriate safeguards such as approved contractual mechanisms. The ICO states that the UK GDPR contains rules for transfers of personal information to organisations outside the UK.

12. Data Retention

We will keep your personal data only for as long as reasonably necessary for the purposes for which it was collected, including for legal, accounting, tax, customer service, dispute resolution and compliance purposes. Different types of data may be kept for different periods depending on why we hold them. The UK GDPR storage limitation principle requires that personal data be kept no longer than necessary.

For example, we may retain order and transaction records for as long as needed to meet legal, tax and accounting requirements, and we may retain customer service correspondence for as long as necessary to deal with follow-up issues or defend legal claims. When we no longer need personal data, we will delete it securely or anonymise it where appropriate.

13. Data Security

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. However, no method of transmission over the internet or method of electronic storage is completely secure, so we cannot guarantee absolute security. UK GDPR requires organisations to process personal data securely using appropriate measures.

14. Your Rights

Under UK data protection law, you may have the right to:

• be informed about how your personal data is used
• request access to your personal data
• request correction of inaccurate or incomplete data
• request erasure of your personal data in certain circumstances
• request restriction of processing in certain circumstances
• object to processing in certain circumstances, including some processing based on legitimate interests
• request data portability in certain circumstances
• withdraw consent where we rely on consent
• lodge a complaint with the Information Commissioner’s Office (ICO)

The ICO’s guidance confirms these rights, including the rights of access, rectification, erasure, restriction and objection.

If you wish to exercise any of your rights, please contact us using the details below. In many cases, organisations are expected to respond to rights requests within one calendar month.

15. Complaints

If you have concerns about how we use your personal data, please contact us first and we will try to resolve the issue. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection matters. The ICO is responsible for upholding information rights in the public interest.

16. Third-Party Websites

Our website may contain links to third-party websites. If you follow a link to another website, that website will have its own privacy policy and practices. We are not responsible for the privacy practices or content of third-party websites.

17. Children’s Privacy

This website is intended for adults. We do not knowingly collect personal data directly from children through our website. If you believe that a child has provided us with personal data, please contact us so that we can investigate and take appropriate action. UK data protection law provides additional protections for children’s personal data.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, services or legal obligations. Any updates will be posted on this page together with a revised “Last updated” date. The right to be informed means organisations should keep privacy information accurate and up to date.

19. Contact Us

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us:

Email: customerserviceuk@sefam-medical.com
Telephone: 01522 701500

Post:
Sefam Medical Ltd
Unit 6, Blackthorn Way
Five Mile Business Park
Lincoln
LN4 1BF

---