The Mining Shop UK Privacy Policy

The Mining Shop UK Limited is the controller responsible for the personal data described in this policy. We are registered in England and Wales under company number 14666497 and VAT number GB482035600. Our registered office is Enterprise House, 202 to 206 Linthorpe Road, Middlesbrough, England, TS1 3QW. Our shop and repair centre is at 38 Church Street, Hartlepool, TS24 7DG, United Kingdom.

This policy applies to www.theminingshop.co.uk, our online store, customer enquiries, hardware sales, repairs, warranties, hosting and related services, and visits to our premises. For privacy questions, rights requests or data protection complaints, email [email protected], call 01429 408034, or use our Complaints Procedure.

We have not appointed a statutory data protection officer. Privacy matters are handled by our administration team at the contact details above.

Our Data Protection and UK GDPR Governance Policy explains the accountability, oversight and operational control framework that supports this privacy notice.

We collect only the personal data reasonably needed for the way you interact with us:

• Identity and contact data: name, job title, business name, account username, email address, phone number, billing and delivery addresses.
• Order and transaction data: products and services, order history, invoices, payment status, bank references, cryptocurrency wallet addresses and transaction identifiers, refunds and chargeback information. Card and supported alternative-payment details are entered into Stripe's secure payment interface; we do not receive or store full card numbers.
• Customer-service, repair and warranty data: enquiries, correspondence, call notes, device serial numbers, fault descriptions, diagnostic logs, photographs, videos and claim history.
• Hosting and technical-service data: customer and billing details, device identifiers and operational telemetry such as hashrate, temperature, uptime and service logs.
• Verification and fraud-prevention data: business registration details, proof of address, proof of identity, source-of-funds information and sanctions-screening results where reasonably required for higher-risk transactions, fraud prevention, a payment-provider requirement or a legal obligation.
• Marketing and preference data: marketing choices, consent records, product interests and communication preferences.
• Website, device and analytics data: IP address, device and browser information, approximate location, identifiers, referral source, pages and products viewed, searches, cart and checkout interactions, purchases and consent state. Optional analytics and advertising data is collected only after the consent required by law.
• Premises data: CCTV images and visit information recorded at our Hartlepool premises for safety, security and loss prevention.

Where the data comes from

Most data comes directly from you when you browse, create an account, order, pay, contact us, submit equipment or visit our premises. We also receive limited data from payment providers, fraud-prevention services, couriers, hosting partners, analytics and advertising platforms, and public business or sanctions registers where verification is appropriate.

Our services are intended for adults and business customers. We do not knowingly collect personal data from children. If you believe a child has provided data, please contact us so we can investigate and delete it where the law permits.

We do not intentionally request special-category personal data. Please do not send it unless we specifically explain why it is necessary and the legal condition we rely on.

Whether information is required

Where we ask for information, the form or transaction context explains whether it is required. Identity, delivery, billing, tax, payment, sanctions, export, warranty or contract information may be necessary to enter into or perform a contract, comply with a legal obligation, or complete risk checks. If required information is not provided, we may be unable to quote, accept or fulfil an order, process a payment or refund, provide support, meet a legal duty or investigate a complaint. Optional marketing and non-essential analytics choices are not a condition of purchase.

A link to this notice is provided at or before each material collection point, including checkout, account, contact, repair, hosting, newsletter, recruitment and complaint forms; the footer link alone is not relied on.

UK data protection law requires a purpose and lawful basis for each use. The table summarises our principal processing:

Where we rely on legitimate interests, we balance the business need against your rights and reasonable expectations. You may object at any time. Where we rely on consent, you may withdraw it without affecting earlier lawful processing.

Automated checks

Stripe, Cloudflare and other security providers may use automated signals to detect fraud, bots or suspicious transactions. A payment or request may be delayed or declined as a result. We do not intentionally make solely automated decisions with legal or similarly significant effects without a permitted basis and appropriate safeguards. Contact us if you want us to review a decision that materially affects you.

We do not sell personal data.

We disclose personal data only where necessary for the purposes above. A provider may act as our processor, or as an independent controller for parts of its service, depending on the activity.

Google Search Console and Bing Webmaster Tools provide site indexing and search-performance information; they do not require a separate visitor-facing tracking tag on this website. Product-feed and Business Profile connections primarily exchange business, catalogue and store information, while conversion features are covered above.

Some providers and operational partners process personal data outside the United Kingdom, including in the European Economic Area, United States, UAE and parts of Asia. This can occur when we use international cloud, analytics, advertising, payment, communications, logistics or hosting services.

For a restricted transfer, we use a lawful transfer mechanism appropriate to the circumstances, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework where applicable, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Where required, we assess whether additional contractual, technical or organisational measures are needed so the level of protection is not materially lower after transfer. You may contact us for more information about the safeguards used for a particular transfer.

We keep personal data only for as long as needed for the purpose collected, including legal, accounting, security and dispute requirements. Our usual periods are:

When a period ends, we securely delete or irreversibly anonymise the data unless a legal hold or continuing obligation requires it.

Depending on the circumstances, UK data protection law gives you rights to:

• Be informed about how we use your personal data and obtain access to it.
• Correct inaccurate data and complete incomplete data.
• Ask us to erase data or restrict its use where the legal conditions apply.
• Object to processing based on legitimate interests and object at any time to direct marketing.
• Receive certain data you provided in a portable format where processing is automated and based on consent or contract.
• Withdraw consent at any time without affecting processing already carried out lawfully.
• Ask for human intervention, express your view and challenge a qualifying significant automated decision where applicable.

To exercise a right, email [email protected]. We may need proportionate information to confirm your identity. We normally respond within one month; the law allows an extension for a complex request or multiple requests, and we will explain if that applies. A right may be limited by an exemption or another person's rights, but we will explain our decision.

Data protection complaints

You may complain by email or through our Complaints Procedure. We will acknowledge a data protection complaint within 30 days, investigate it appropriately, keep you informed and communicate the outcome without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk (opens in a new tab) or call 0303 123 1113. You may contact the ICO at any time, although it will normally expect you to raise the issue with us first.

We use proportionate technical and organisational measures designed to protect personal data. These include HTTPS encryption in transit, access controls and least-privilege administration, strong account security, payment processing through Stripe's hosted or tokenised components, Cloudflare security and bot controls, maintained backups and recovery procedures, monitoring, staff awareness, secure premises and CCTV, supplier checks, and procedures for incidents and rights requests.

No internet service can guarantee absolute security. You are responsible for protecting your account credentials and should contact us promptly if you suspect unauthorised access. We never notify customers of changed bank details solely by email; independently verify any payment instruction that appears unusual.

We maintain a process to identify, contain, investigate, document and remedy personal data breaches. Where a breach is likely to risk people's rights and freedoms, we will notify the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware. Where the risk is high, we will also inform affected people without undue delay unless a lawful exception applies.

Report suspected privacy or security incidents to [email protected]. Please do not include unnecessary passwords, full payment-card numbers or sensitive identity documents in an initial email.

We use necessary technologies for security, shopping, checkout, payment and consent management. Complianz presents and records your privacy choices. Optional Google Analytics 4 and advertising technologies are held until the consent required by law is given. You can accept, refuse or later change optional categories through the persistent Privacy settings control.

Google Analytics 4 helps us understand aggregated site and ecommerce activity such as page views, product views, searches, cart actions, checkout steps and purchases. Google Ads conversion measurement helps us assess advertising. Where enhanced conversions is enabled and permitted, customer data such as email, phone, name or address may be normalised and securely hashed before Google receives it for conversion matching. Hashing reduces direct exposure but remains processing of personal data.

Google for WooCommerce connects product and store information to Merchant Center and can support Ads conversion measurement. Google Site Kit manages the website's Google integration. Search Console and Bing Webmaster Tools measure indexing and search performance without adding a separate visitor-tracking tag. Stripe, Cloudflare and necessary WooCommerce services can still process limited data required for payments, security and the requested service even when optional analytics is refused.

Our Cookie Policy identifies purposes, providers, typical cookie durations and controls. Browser controls may also block or delete cookies, but blocking necessary storage can affect login, basket, checkout, payment or consent functions.

What data do you collect when I place an order?

We use identity, contact, delivery, product, payment-status and fraud-prevention information to take payment, fulfil the order, provide support and keep required records. Full card numbers are handled by Stripe rather than stored by us.

Do you sell my personal data?

No. We disclose data only for the purposes and to the recipients described in this policy, including payments, delivery, hosting, security, analytics where permitted, professional advice and legal compliance.

What does Google enhanced conversions receive?

When enabled and permitted, selected first-party contact information such as email, phone, name or address can be normalised and securely hashed before it is sent to Google to match a purchase with an advertising interaction. You can refuse optional advertising cookies or change your Privacy settings.

Why might you request identity or source-of-funds documents?

For a higher-risk transaction we may need to verify the customer or payment, prevent fraud, meet a payment-provider requirement, perform proportionate sanctions checks or comply with a specific legal obligation. We will request only what is reasonably necessary and explain the reason where appropriate.

Is a cryptocurrency payment private?

Cryptocurrency wallet addresses, transaction identifiers and amounts are recorded on public blockchains by their nature. We cannot erase a public blockchain record. The relationship between a transaction and your customer order is retained in our internal records as described above.

How do I obtain, correct or delete my data?

Email [email protected]. Erasure is not absolute: tax, accounting, fraud, warranty, dispute or other legal requirements may require us to retain some records.

How do I make a data protection complaint?

Use our Complaints Procedure or email the administration team. We will acknowledge a data protection complaint within 30 days and respond without undue delay after appropriate investigation. You may also complain to the ICO.

Summary: these answers are a quick guide. The detailed sections above govern if there is any difference.

We review this policy when our services, providers or legal obligations change. The date at the top identifies the current version. If a change materially affects how we use personal data, we will provide a prominent notice or contact affected people where appropriate. If we intend to use existing data for a materially new and incompatible purpose, we will provide the information and obtain any consent required before that processing begins.

Previous versions may be requested from [email protected].