Who controls your data
Commercial Compliance Assurance Ltd is the controller of the personal data described in this notice. We are based in Yorkshire and work across the United Kingdom. For privacy questions or to exercise your rights, contact us at info@cca.uk.
What we collect
When you submit an enquiry, CCA receives your name, business email address, service selections and any information you choose to include about your site. Organisation, phone number and message are optional. Please do not include health information or other special-category personal data in an enquiry.
If the document shop is enabled, we will process the email address supplied for your receipt and download, the document purchased, order status and the identifiers needed to fulfil the order. CCA does not receive or store card numbers, card security codes or card expiry dates.
Our hosting and security providers may also process limited technical information, such as IP address, device information and security logs, when they deliver and protect the website.
How the quote form works
When you select “Send secure enquiry”, the website submits the form to CCA’s protected server and records it in CCA’s restricted admin workspace. Only authorised CCA personnel can view and triage the enquiry. If you prefer, you can contact us directly at info@cca.uk.
Document shop and payments
The public document shop currently displays availability only; checkout is disabled until CCA connects its own Stripe account and configures products and prices. When checkout is enabled, Stripe will process the payment on its hosted checkout page. CCA’s server creates a pending order and only enables an instant download after it receives and verifies Stripe’s payment confirmation. The download link is protected by a random, order-specific access token. To deter unauthorised redistribution, eligible PDF documents are visibly watermarked with the purchaser email address and order reference at download time; CCA also records the time and number of protected download grants.
Why we use your data
We use enquiry details to understand the request, respond to you, prepare a quote, and manage a potential or existing business relationship. Our lawful basis is our legitimate interests in responding to business enquiries and operating our professional services. Where processing is necessary to take steps at your request before a contract, or to perform a contract, we may also rely on that basis.
When the document shop is enabled, we use order information to take payment, provide the document you bought, manage refunds or queries, and keep records required for accounting or legal purposes. We use limited technical data to operate and secure the website. We do not use enquiry or purchase data to send marketing emails unless we separately obtain any consent required by law.
Who receives your data
Access is limited to CCA personnel who need the information to handle an enquiry, a purchase or a related support request. We may use providers for website hosting, managed database services, content delivery, security, business email and IT support. Once payment is enabled, Stripe will process checkout and payment data as described in its own privacy information. These providers process data only as needed to provide their services to us. We may also disclose information where required by law or to protect legal rights.
International transfers
Some technical suppliers may process data outside the United Kingdom. Where that happens, we will use a lawful transfer mechanism and appropriate safeguards required by UK data protection law. You can ask us for further information by emailing info@cca.uk.
How long we keep data
We keep unsuccessful or inactive quote enquiries for up to 12 months after our last meaningful contact, unless a longer period is needed to establish, exercise or defend legal claims. If an enquiry becomes a client relationship, we keep the relevant records for the contract period and afterwards only for the retention periods required by law or reasonably necessary for accounting and legal purposes. If document sales are enabled, CCA will retain transaction records for the applicable accounting and legal retention period. Security logs are retained only for the period needed to operate and protect the service.
Security and access
The CCA admin workspace requires a password and uses a signed, HttpOnly, Secure session cookie. That cookie is used only to keep an authorised administrator signed in, expires after 12 hours and is not used for advertising, analytics or tracking. Digital document files are not exposed through public static links; the server sends them only after a paid order and matching download token have been validated.
Your rights
Depending on the circumstances, you can ask for access to your personal data, correction, deletion, restriction, portability, or object to processing based on legitimate interests. To make a request, email info@cca.uk. You can also complain to the Information Commissioner’s Office.
Cookies and similar technologies
CCA does not currently use advertising cookies, analytics cookies, tracking pixels or other non-essential storage technologies. We use browser local storage only to remember your optional-cookie choice: accept or reject, the notice version and the time of that choice. This preference record does not contain a marketing identifier or enquiry information, is not shared with third parties, and expires after six months. It is used only to honour your choice.
Optional analytics, advertising and other non-essential technologies remain off unless you give a clear opt-in through the cookie banner. You can accept, reject or change your choice at any time using the “Cookie settings” control on this page or in the site footer. The administrator session cookie and essential hosting security technologies are used only where necessary to provide the restricted admin service or website you request.
Changes to this notice
We may update this notice when the website, document shop or our data processing changes. The latest version will always be available on this page, with its update date shown above.