InnovAntennas - Privacy Policy

INNOVANTENNAS LIMITED PRIVACY POLICY

Version 1.2 — 28 July 2026

This Privacy Policy explains how InnovAntennas Limited collects, uses, and protects your personal data when you visit our website, purchase our products, or interact with us online. It explains your rights under the UK GDPR, the Data Protection Act 2018, and the EU GDPR.

This policy should be read alongside our Cookie Policy and our Design File Licence Agreement (Terms and Conditions).

InnovAntennas Limited is the data controller for the personal data described in this policy.

1. WHO WE ARE

1.1 InnovAntennas Limited (Company No. 07486266 is a company registered in England and Wales. Our registered office is at Matrix House, Lionel Road, Canvey Island SS8 9DE.

1.2 We are registered with the UK Information Commissioner's Office (ICO). Our ICO registration number is ZC004730.

1.3 We are the data controller for personal data collected through our website (https://www.innovantennas.com ). This means we decide how and why your personal data is processed.

1.4 We do not have a Data Protection Officer (DPO) as we are not required to appoint one under UK GDPR. If you have any questions about this Privacy Policy or your personal data, please contact us using the details in Section 14.

2. WHAT PERSONAL DATA WE COLLECT

2.1 We collect the following categories of personal data:

(a) ACCOUNT AND CONTACT DATA: your name, email address, and any other information you provide when creating an account or contacting us.

(b) ORDER DATA: your purchase history, order details, and the design files you have downloaded. Each download is linked to your account and embedded with a purchaser identifier for anti-piracy purposes (see Section 5.5).

(c) PAYMENT DATA: we do not store your full card details. Payment is processed by our third-party payment provider(s) (see Section 8). We may retain the last four digits of your card number and the transaction reference for order tracking and fraud prevention.

(d) TECHNICAL DATA: your IP address (which we treat as personal data in accordance with UK GDPR), browser type, device information, and browsing activity on our website (collected via cookies and similar technologies — see our Cookie Policy for details).

(e) MARKETING DATA: your email address and any preferences you have expressed regarding marketing communications.

(f) CORRESPONDENCE DATA: the content of any messages, emails, or other communications you send to us.

2.2 We do not collect special category personal data (such as health, ethnicity, religious beliefs, or sexual orientation) and we have no need for such data. If you provide any such data inadvertently, we will delete it.

3. HOW WE COLLECT YOUR PERSONAL DATA

3.1 We collect personal data in the following ways:

(a) WHEN YOU CREATE AN ACCOUNT OR MAKE A PURCHASE: you provide your name, email address, and billing details.

(b) WHEN YOU USE OUR WEBSITE: we automatically collect technical data (IP address, browser type, pages visited) through cookies and server logs.

(d) WHEN YOU SIGN UP FOR MARKETING: you provide your email address and consent to receive marketing communications.

4. HOW WE USE YOUR PERSONAL DATA AND THE LEGAL BASIS

4.1 We process your personal data for the following purposes, on the following legal bases:

PURPOSE: Providing the products and services you have purchased (processing orders, delivering download links, maintaining your account) LEGAL BASIS: Contract (Article 6(1)(b) UK GDPR) — the processing is necessary to perform the contract between you and InnovAntennas Limited for the purchase and download of Design Files.

PURPOSE: Communicating with you about your orders, account, or customer support enquiries LEGAL BASIS: Contract (Article 6(1)(b) UK GDPR) — necessary to perform our contractual obligations and provide customer service.

PURPOSE: Sending you marketing communications (newsletters, product announcements, special offers) by email LEGAL BASIS: Consent (Article 6(1)(a) UK GDPR) — we will only send you marketing emails if you have explicitly consented. You can withdraw your consent at any time (see Section 10).

PURPOSE: Analysing website usage and improving our website (analytics, performance monitoring) LEGAL BASIS: Consent (Article 6(1)(a) UK GDPR) for third-party analytics cookies. For first-party, low-risk statistical analysis used solely for our own internal website improvement, we may rely on the exception under PECR as amended by the Data (Use and Access) Act 2025 (see our Cookie Policy).

PURPOSE: Preventing fraud, abuse, and unauthorised sharing of our Design Files (including watermarking, tracking, and enforcement of our Licence Agreement) LEGAL BASIS: Legitimate interests (Article 6(1)(f) UK GDPR) — we have a legitimate interest in protecting our intellectual property and preventing unauthorised distribution of our design files. We have conducted a legitimate interests assessment (LIA) and concluded that the processing is proportionate and does not override your privacy rights. A summary of our LIA is available on request by contacting us at justin@innovantennas.com. You have the right to object to this processing (see Section 10.2).

PURPOSE: Maintaining financial and tax records LEGAL BASIS: Legal obligation (Article 6(1)(c) UK GDPR) — we are required by UK tax and company law to retain certain financial records.

4.2 We do not use your personal data for automated decision-making or profiling that has a legal or similarly significant effect on you.

5. HOW WE USE YOUR PERSONAL DATA SPECIFICALLY

5.1 ORDER FULFILMENT: We use your name, email, and order details to process your purchase, deliver your download link, and maintain a record of your licence.

5.2 ACCOUNT MANAGEMENT: If you create an account, we use your email and password (stored as a hashed value, never in plain text) to authenticate you and manage your session.

5.3 CUSTOMER SUPPORT: We use the content of your communications to respond to your enquiries and provide support.

5.4 WEBSITE IMPROVEMENT: We use aggregated, anonymised analytics data to understand how our website is used and to improve its performance and usability.

5.5 ANTI-PIRACY AND FILE WATERMARKING: Each Design File you download is embedded with a purchaser identifier (typically your order number and/or email reference). This allows us to trace any unauthorised sharing back to the source. This processing is necessary to protect our intellectual property rights under our Design File Licence Agreement. The watermarking does not collect any additional personal data from your device — it simply links the file to your order record.

6. IS PROVIDING YOUR DATA REQUIRED?

6.1 Providing your personal data is necessary for us to fulfil your order and provide our services.

6.2 Specifically:

(a) Name and email address — required under our contract with you. If you do not provide these, we cannot process your order or deliver your download.

(b) Payment details — required to complete your purchase. These are processed by our payment provider; we do not store full card details.

(c) Technical data — collected automatically when you use our website. You can control this via your cookie settings (see our Cookie Policy), but disabling strictly necessary cookies may prevent you from completing purchases.

(d) Marketing data — optional. Providing your email for marketing is purely voluntary. You will not lose access to products you have purchased if you do not consent to marketing.

7. DATA RETENTION — HOW LONG WE KEEP YOUR DATA

7.1 We retain personal data only for as long as necessary for the purposes set out in Section 4, or as required by law:

(a) ACCOUNT DATA: retained for the lifetime of your account. You may request deletion of your account at any time (see Section 10).

(b) ORDER DATA: retained for 7 years from the date of purchase, to comply with UK tax and accounting record-keeping requirements.

(c) PAYMENT DATA: we retain transaction references for 7 years (tax/accounting). Full card details are never stored by us — they are processed by our payment provider.

(d) MARKETING DATA: retained until you withdraw consent or unsubscribe. If you unsubscribe, we delete your email address from our marketing list within 30 days.

(e) TECHNICAL DATA (server logs): retained for 90 days for security and troubleshooting purposes. This includes IP addresses, which we treat as personal data.

(f) CORRESPONDENCE DATA: retained for 3 years from the date of the last correspondence, unless an ongoing dispute requires longer retention.

(g) WATERMARKING DATA: the purchaser identifier embedded in each Design File is permanent — it is part of the file you download. The corresponding order record is retained as per (b) above.

7.2 When the retention period expires, we securely delete or anonymise your personal data.

8. WHO WE SHARE YOUR DATA WITH

8.1 We do not sell your personal data to third parties, nor do we use your personal data for targeted advertising based on your browsing behaviour on our website. We share personal data only with the following categories of recipients:

(a) PAYMENT PROCESSORS: [CONFIRM ACTUAL PROVIDER — e.g., PayPal, Stripe] process your payment transactions. They process your payment data on our behalf or as independent controllers for their own payment services. We recommend you review their privacy policy for details of how they handle your payment data.

(b) HOSTING PROVIDER: our website is hosted on a server that may be located outside the UK/EU. See Section 9 for international transfer information.

(c) EMAIL SERVICE PROVIDERS: if we use a third-party service to send marketing emails or order confirmations, they receive your email address and email content.

(d) ANALYTICS PROVIDERS: if Google Analytics or similar tools are enabled (subject to your cookie consent), they receive aggregated, pseudonymous usage data.

(e) LEGAL AND REGULATORY AUTHORITIES: we may disclose personal data if required by law, court order, or regulatory authority (e.g., HMRC, ICO, law enforcement).

(f) SUCCESSORS OR ASSIGNS: in the event of a merger, acquisition, or sale of assets, personal data may be transferred to the successor entity. We will notify you before any such transfer.

8.2 We have written data processing agreements in place with our processors, as required by Article 28 of the UK GDPR.

8.3 We do not share your personal data with social media platforms for advertising purposes unless you have given cookie consent for advertising cookies.

9. INTERNATIONAL DATA TRANSFERS

9.1 Some of our service providers (e.g., hosting, payment processors, email providers) may process your personal data outside the UK or EU, particularly in the United States.

9.2 Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place:

(a) For transfers from the UK: the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

(b) For transfers from the EU: the EU Standard Contractual Clauses (SCCs) as adopted by the European Commission, or on the basis of an adequacy decision where applicable.

(c) For transfers to the United States: where the recipient is certified under the EU-US Data Privacy Framework (DPF) or its UK Extension, we rely on that certification. If the recipient is not certified under the framework, we rely on the UK IDTA or EU SCCs as applicable.

9.3 You can request a copy of the relevant safeguards by contacting us (see Section 14).

10. YOUR DATA PROTECTION RIGHTS

10.1 Under the UK GDPR and EU GDPR, you have the following rights:

(a) RIGHT OF ACCESS: you can request a copy of the personal data we hold about you.

(b) RIGHT TO RECTIFICATION: you can ask us to correct inaccurate or incomplete personal data.

(c) RIGHT TO ERASURE ("right to be forgotten"): you can ask us to delete your personal data in certain circumstances (e.g., when the data is no longer necessary, or you withdraw consent). Note: we may need to retain certain data (e.g., order records for tax purposes) as required by law.

(d) RIGHT TO RESTRICT PROCESSING: you can ask us to limit how we use your data in certain circumstances.

(e) RIGHT TO DATA PORTABILITY: you can request a machine-readable copy of the personal data you provided to us, and transmit it to another service provider.

(f) RIGHT TO OBJECT: you can object to our processing of your personal data where we rely on legitimate interests (Article 6(1)(f)). We will stop the processing unless we have compelling legitimate grounds that override your interests.

(g) RIGHT TO WITHDRAW CONSENT: where we process your data on the basis of consent (e.g., marketing emails, analytics cookies), you can withdraw your consent at any time. To withdraw consent for marketing emails, use the unsubscribe link in any marketing email or contact us. To withdraw consent for cookies, use the "Cookie settings" link in the footer of our website (see our Cookie Policy). This does not affect the lawfulness of any processing we did before you withdrew.

10.2 YOUR RIGHT TO OBJECT (highlighted separately as required by UK GDPR):

You have the right to object to our processing of your personal data where we rely on legitimate interests (specifically, our anti-piracy and file watermarking activities under Section 5.5). If you object, we will cease that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims.

10.3 HOW TO EXERCISE YOUR RIGHTS:

To exercise any of these rights, please contact us at HERE. We will respond within one month of receiving your request. In some cases, we may extend this by two months if the request is complex — we will inform you within one month if this happens.

10.4 We do not charge for fulfilling requests unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.

11. RIGHT TO COMPLAIN

11.1 You have the right to lodge a complaint with the supervisory authority if you believe our processing of your personal data infringes data protection law.

11.2 In the UK, the supervisory authority is the Information Commissioner's Office (ICO):

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Tel: 0303 123 1113 Website: https://ico.org.uk

11.3 If you are in the EU, you can complain to the data protection authority in the Member State where you live, work, or where the alleged infringement took place.

11.4 We encourage you to contact us first so we can try to resolve any concerns directly.

12. SECURITY

12.1 We take appropriate technical and organisational measures to protect your personal data, including:

(a) SSL/TLS encryption for all data transmitted between your browser and our server (HTTPS);

(b) Password hashing — your account password is never stored in plain text;

(d) Access controls — only authorised personnel have access to personal data;

(e) Regular security reviews.

12.2 No method of transmission or storage is 100% secure. We cannot guarantee absolute security but we take all reasonable steps to protect your data.

12.3 If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours, and we will notify you without undue delay if the breach is likely to result in a high risk.

13. CHILDREN'S DATA

13.1 Our website and products are not directed at children under 13. We do not knowingly collect personal data from children under 13.

13.2 If you believe a child has provided personal data to us, please contact us and we will take steps to delete that data.

14. CONTACT US

14.1 If you have any questions about this Privacy Policy, your personal data, or wish to exercise any of your rights, please contact us:

InnovAntennas Limited ICO Registration Number: ZC004730 Contact HERE

Website: https://www.innovantennas.com

14.2 You also have the right to complain to the ICO (see Section 11).

15. CHANGES TO THIS POLICY

15.1 We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law.

15.2 We will update the version number and date at the top of this policy whenever we make changes.

15.3 Material changes will be communicated by email to account holders and/or by a prominent notice on our website.

16. SEVERANCE

16.1 If any provision of this Privacy Policy is held to be invalid, illegal, or unenforceable, that provision shall be deemed modified to the minimum extent necessary to make it valid and enforceable, or if it cannot be so modified, it shall be deemed deleted. The remaining provisions shall remain in full force and effect.

Privacy Policy.