Who we are
Our website is www.gratnells.com. This site is owned and managed by Gratnells Ltd HQ, Highfield Court, Church Lane, Madingley, Cambridge CB23 8AG.
What personal data we collect and why we collect it
- While you visit our site, we’ll track:
- Products you’ve viewed: we’ll use this to, for example, show you products you’ve recently viewed
- Location, IP address and browser type: we’ll use this for purposes like estimating taxes and shipping
- Shipping address: we’ll ask you to enter this so we can, for instance, estimate shipping before you place an order, and send you the order!
We’ll also use cookies to keep track of cart contents while you’re browsing our site.
When you purchase from us, we’ll ask you to provide information including your name, billing address, shipping address, email address, phone number, credit card/payment details and optional account information like username and password. We’ll use this information for purposes, such as, to:
- Send you information about your account and order
- Respond to your requests, including refunds and complaints
- Process payments and prevent fraud
- Set up your account for our store
- Comply with any legal obligations we have, such as calculating taxes
- Improve our store offerings
- Send you marketing messages, if you choose to receive them
If you create an account, we will store your name, address, email and phone number, which will be used to populate the checkout for future orders.
We generally store information about you for as long as we need the information for the purposes for which we collect and use it, and we are not legally required to continue to keep it. For example, we will store order information for up to 10 years for tax and accounting purposes. This includes your name, email address and billing and shipping addresses.
We will also store comments or reviews, if you choose to leave them.
Who on our team has access
Members of our team have access to the information you provide us. For example, both Administrators and Order Managers can access:
Order information like what was purchased, when it was purchased and where it should be sent, and
Customer information like your name, email address, and billing and shipping information.
Our team members have access to this information to help fulfill orders, process refunds and support you.
Payment
We accept payments through PayPal and Stripe. When processing payments, some of your data will be passed to PayPal or Stripe, including information required to process or support the payment, such as the purchase total and billing information.
You can find out more about Stripe’s Privacy Policy here: https://stripe.com/gb/privacy , and Paypal’s Privacy Policy here: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full
Comments
When visitors leave comments on the site we collect the data shown in the comments form, and also the visitor’s IP address and browser user agent string to help spam detection.
Contact forms
We keep contact form submissions for a certain period for customer service purposes, but we do not use the information submitted through them for marketing purposes unless specifically stated.
Cookies
If you leave a comment on our site you may opt-in to saving your name, email address and website in cookies. These are for your convenience so that you do not have to fill in your details again when you leave another comment. These cookies will last for one year.
If you have an account and you log in to this site, we will set a temporary cookie to determine if your browser accepts cookies. This cookie contains no personal data and is discarded when you close your browser.
When you log in, we will also set up several cookies to save your login information and your screen display choices. Login cookies last for two days, and screen options cookies last for a year. If you select “Remember Me”, your login will persist for two weeks. If you log out of your account, the login cookies will be removed
Embedded content from other websites
Content on this site may include embedded content (e.g. videos, images, articles, etc.). Embedded content from other websites behaves in the exact same way as if the visitor has visited the other website.
These websites may collect data about you, use cookies, embed additional third-party tracking, and monitor your interaction with that embedded content, including tracking your interaction with the embedded content if you have an account and are logged in to that website.
What rights you have over your data
If you have an account on this site, or have left comments, you can request to receive an exported file of the personal data we hold about you, including any data you have provided to us. You can also request that we erase any personal data we hold about you. This does not include any data we are obliged to keep for administrative, legal, or security purposes. If you require any further information please contact us by email.
Additional information for Gratnells Learnometer customers
How does Professor Stephen Heppell’s research team protect my personal and environmental data collected from the device?
We take your privacy very seriously, and work to ensure our data is secure. Your data is aggregated for research and comparison purposes when requested for research purposes but your personal data or identity are never shared outside the research team.
How does Gratnells Learnometer protect my personal and environmental data collected from the device?
We take privacy very seriously, and work to ensure our data is secure. Gratnells Learnometer is powered by AWAIR and uses Awair’s Platform which is TRUSTe certified and vetted through third-party security audits. It employs 128-bit AES encryption and is capable of supporting numerous encryption key exchange rules. You can also read more detail about Awair’s Privacy Policy here.
Last updated: 4th March 2026
This Privacy Policy explains how Gratnells Ltd collects, uses, stores, and shares your personal data when you use our website and services. We are committed to protecting your privacy and being transparent about what we do with your information.
1. Who We Are
Gratnells Ltd (“we”, “us”, “our”) is the data controller responsible for your personal data.
Registered address: Highfield Court, Church Lane, Madingley, Cambridge CB23 8AG, United Kingdom
Data protection contact: [email protected]
Telephone: +351 265 096 923
Data Protection Lead: Financial Director, [email protected]
ICO registration number: ZB528600
Our website address is www.gratnells.com. We also operate the following regional sites:
2. What Personal Data We Collect, Why, and Our Legal Basis
Under UK GDPR, we must have a lawful basis for processing your personal data. The table below sets out the data we collect, why, and the legal basis we rely on.
2.1 When You Browse Our Website
| Data collected | Purpose | Basis |
|---|---|---|
| IP address, browser type, device information | Website security, fraud prevention, estimating taxes and shipping costs | Legitimate interests (site security and operational necessity) |
| Products you have viewed | Showing you recently viewed products and personalising your experience | Legitimate interests (improving your experience) |
| Pages visited, search queries, click behaviour | Website analytics to understand how our site is used and to improve it | Consent (via cookie banner) |
| Location (derived from IP address) | Determining product availability and cost. | Legitimate interests (operational necessity) |
2.2 When You Place an Order
| Data collected | Purpose | Basis |
|---|---|---|
| Name, billing address, shipping address, email, phone number | Fulfilling your order, sending order confirmations and shipping updates | Performance of a contract |
| Payment card/payment details | Processing your payment (passed directly to our payment processor – we do not store card details) | Performance of a contract |
| Order history and transaction records | Tax and accounting obligations, handling refunds and disputes | Legal obligation (HMRC requirements) |
2.3 When You Create an Account
| Data collected | Purpose | Basis |
|---|---|---|
| Name, email, address, phone number, username, password | Maintaining your account and pre-filling checkout for future orders | Performance of a contract |
| Account activity and preferences | Providing a personalised experience | Legitimate interests (customer service) |
2.4 When You Subscribe to Marketing
| Data collected | Purpose | Basis |
|---|---|---|
| Name, email address | Sending you newsletters, product updates, and promotional messages | Consent |
| Sector | Industry sector for ensuring only relevant communications are provided. | Consent |
| Email engagement data (opens, clicks) | Understanding the effectiveness of our communications | Consent / Legitimate interests |
You can withdraw your marketing consent at any time by clicking the “unsubscribe” link in any marketing email or by contacting us at [email protected].
2.5 When You Submit a Form or Leave a Comment
| Data collected | Purpose | Basis |
|---|---|---|
| Contact form submissions (name, email, message, and any other fields you complete) | Responding to your enquiry | Legitimate interests (customer service) |
| IP address and browser user agent (on comments) | Spam detection and prevention | Legitimate interests (site security) |
3. Cookies and Similar Technologies
We use cookies and similar technologies on our website. Cookies are small text files placed on your device that help us provide and improve our services.
How We Manage Your Cookie Preferences
We use CookieYes to manage cookie consent. When you first visit our site, you will be shown a cookie banner where you can accept or reject non-essential cookies. You can change your preferences at any time by clicking the “Cookie Preferences” link in the website footer.
Non-essential cookies are not set until you give your consent.
3.1 Strictly Necessary Cookies
These cookies are essential for the website to function and cannot be switched off. They do not require your consent.
| Cookie | Provider | Duration | Purpose |
|---|---|---|---|
woocommerce_cart_hash | WooCommerce | Session | Detects changes to cart contents |
woocommerce_items_in_cart | WooCommerce | Session | Tracks whether items are in the cart |
wp_woocommerce_session_* | WooCommerce | 2 days | Stores your unique session and cart data |
woocommerce_recently_viewed | WooCommerce | Session | Stores recently viewed product IDs |
store_notice[id] | WooCommerce | Session | Remembers dismissed store notices |
wordpress_logged_in_* | WordPress | Session / 14 days | Identifies logged-in users |
wordpress_sec | WordPress | Session | Security authentication token |
wordpress_test_cookie | WordPress | Session | Tests whether your browser accepts cookies |
wp-settings-* | WordPress | 1 year | Saves your admin interface preferences |
cookieyes-consent | CookieYes | 1 year | Stores your cookie consent preferences |
__cf_bm | Cloudflare | 30 minutes | Bot management and security |
_cfuvid | Cloudflare | Session | Rate limiting |
cf_clearance | Cloudflare | 30 minutes | Records that a security challenge was passed |
__stripe_mid | Stripe | 1 year | Fraud prevention |
__stripe_sid | Stripe | 30 minutes | Fraud prevention |
wfwaf-authcookie-* | Wordfence | 12 Hours | Authenticates a logged-in user to bypass Web Application Firewall security checks. |
wp_lang | WordPress | Session | Stores your language preference (e.g., en_GB). |
PHPSESSID | WordPress | Session | Maintains the visitor’s session state across page requests. |
_GRECAPTCHA | Google (via HubSpot) | 6 months | Set by HubSpot’s reCAPTCHA protection on form interaction. |
3.2 Analytics Cookies (Require Your Consent)
These cookies help us understand how visitors use our website by collecting anonymous statistical information.
| Cookie | Provider | Duration | Purpose |
|---|---|---|---|
_ga | Google Analytics | 400 days | Distinguishes unique users |
_ga_* | Google Analytics (GA4) | 2 years | Maintains session state |
_gat | Google Analytics | 1 minute | Throttles the request rate |
Google Analytics is loaded via Google Tag Manager and is only active on our production website. Analytics cookies are not set unless you consent via the cookie banner.
For more information, see Google’s Privacy Policy.
3.3 Marketing Cookies (Require Your Consent)
These cookies are used to deliver marketing content and track its effectiveness.
| Cookie | Provider | Duration | Purpose |
|---|---|---|---|
_fbp | Meta | 3 months | Meta Pixel advertising first-party cookie. Used by Facebook to track visits across websites to deliver a series of advertisement products such as real time bidding from third party advertisers. |
__hstc | HubSpot | 6 months | Tracks visitor identity across sessions |
hubspotutk | HubSpot | 6 months | Tracks visitor identity for form submissions |
__hssc | HubSpot | 30 minutes | Tracks session activity |
__hssrc | HubSpot | Session | Detects whether a new session has started |
sbjs_* | SourceBuster JS | Session | Tracks the user’s current session and traffic source. |
_fbc | Meta | 90 days | Meta click-ID cookie. Set only when traffic arrives via an fbclid URL parameter. |
3.4 Login Cookies
When you log in, we set cookies to save your login information and screen display preferences. Login cookies last for two days, and screen options cookies last for one year. If you select “Remember Me”, your login will persist for two weeks. Logging out removes the login cookies.
Note: The cookies listed above are based on our current site configuration. We recommend conducting a periodic live cookie audit to ensure this list remains accurate.
4. Third-Party Services
We share personal data with the following third-party service providers. We have Data Processing Agreements (DPAs) in place with each processor where required.
4.1 Payment Processors
We accept payments through the following providers. Payment card details are transmitted directly to the payment processor using industry-standard encryption and are not stored on our servers.
| Provider | Purpose | Privacy policy |
|---|---|---|
| Stripe | Card payment processing | stripe.com/gb/privacy |
| PayPal | PayPal payment processing | paypal.com/uk/privacy |
| Google Pay (via PayPal) | Contactless / digital wallet payments | payments.google.com/privacy |
| Apple Pay (via PayPal) | Contactless / digital wallet payments | apple.com/legal/privacy |
When processing payments, we share information required to process or support the payment, such as the purchase total, billing information, and shipping address.
4.2 Analytics
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Google Tag Manager | Manages the loading of analytics scripts | Page URL, page title | google.com/policies/privacy |
| Google Analytics (GA4) | Website usage analytics | Browsing behaviour, device info, IP address (anonymised) | google.com/policies/privacy |
Analytics data is only collected with your consent (see Section 3).
4.3 Marketing and Email
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| HubSpot | CRM, email marketing, newsletter sign-up forms, abandoned cart communications | Name, email, browsing behaviour, purchase history | legal.hubspot.com/privacy-policy |
| Mailchimp (Intuit) | Email marketing and newsletter distribution | Name, email, purchase history | intuit.com/privacy |
| Meta Pixel | Conversion tracking, targeted advertising, and remarketing across Meta platforms (Facebook/Instagram) | IP address, browsing behaviour, device information, purchase/conversion events | facebook.com/privacy/policy |
| Bing Ads (Microsoft) | Conversion tracking, targeted advertising, and remarketing on the Microsoft Search Network | IP address, browsing behaviour, device information, purchase/conversion events | privacy.microsoft.com/en-gb/privacystatement |
You can opt out of marketing communications at any time (see Section 2.4).
4.4 Security and Performance
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Cloudflare | Content delivery network (CDN), DDoS protection, bot management, image optimisation | IP address, request headers, browser information | cloudflare.com/privacypolicy |
| Cloudflare Turnstile | CAPTCHA on the login page (privacy-preserving alternative to traditional CAPTCHA) | IP address, browser interaction data | cloudflare.com/privacypolicy |
| Google reCAPTCHA (via HubSpot) | Spam prevention on HubSpot forms across the site | IP address, browser interaction data | policies.google.com/privacy |
| Patchstack | Website security monitoring and vulnerability scanning | Site activity logs | patchstack.com/privacy-policy |
4.5 Site Search
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Doofinder | On-site product search and search results | Search queries, browsing behaviour | doofinder.com/privacy |
4.6 Forms
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| Gravity Forms | Contact forms, enquiry forms | Form submission data (name, email, message, and any other fields you complete) | gravityforms.com/privacy |
4.7 E-Commerce Platform
| Provider | Purpose | Data shared | Privacy policy |
|---|---|---|---|
| WooCommerce (Automattic) | E-commerce platform powering our online store | Order data, customer data, account information | automattic.com/privacy |
5. International Data Transfers
Some of our third-party service providers are based outside the United Kingdom. When your personal data is transferred to countries that do not have an adequacy decision from the UK government, we ensure appropriate safeguards are in place, including:
- The UK International Data Transfer Agreement (IDTA), or
- Standard Contractual Clauses approved by the ICO, or
- Certification under the UK Extension to the EU-US Data Privacy Framework
The following processors transfer data outside the UK:
| Processor | Data destination | Safeguard |
|---|---|---|
| Google (Analytics, Tag Manager, reCAPTCHA) | USA | UK Extension to EU-US Data Privacy Framework |
| HubSpot | USA (EU1 data region) | Standard Contractual Clauses / IDTA |
| Mailchimp (Intuit) | USA | Standard Contractual Clauses / IDTA |
| Meta Platforms, Inc. | USA / Ireland (EU) | UK Extension to EU-US Data Privacy Framework / UK adequacy decision for EU/EEA |
| Microsoft Corporation (Bing Ads) | USA / Ireland (EU) | UK Extension to EU-US Data Privacy Framework / UK adequacy decision for EU/EEA |
| Stripe | USA | UK Extension to EU-US Data Privacy Framework |
| PayPal | USA / Luxembourg | EU adequacy decision (Luxembourg) / IDTA (USA) |
| Cloudflare | USA and global edge network | Standard Contractual Clauses / IDTA |
| Doofinder | Spain (EU) | UK adequacy decision for EU/EEA |
You may request a copy of the safeguards we rely on by contacting us at [email protected].
6. Data Retention
We only keep your personal data for as long as necessary for the purposes set out in this policy, or as required by law. The table below sets out our retention periods.
| Data category | Retention period | Reason |
|---|---|---|
| Order records (invoices, transaction data, name, email, billing and shipping addresses) | 10 years from the date of the order | HMRC tax and accounting obligations |
| Customer accounts | Duration of the account | Service provision (performance of contract) |
| Marketing consent records | Duration of consent + 3 years after withdrawal | Accountability and compliance |
| Cookie consent logs | 3 years | PECR compliance |
| Website analytics data | 14 months (Google Analytics default) | Website improvement |
We do not use information submitted through contact forms for marketing purposes unless specifically stated at the point of collection.
7. Who Has Access to Your Data
Members of our team have access to the information you provide. For example, Administrators and Order Managers can access:
- Order information: what was purchased, when it was purchased, and where it should be sent
- Customer information: your name, email address, billing and shipping information
Our team members access this information to fulfil orders, process refunds, and provide customer support.
Access to personal data is restricted on a need-to-know basis and is subject to our internal data protection policies.
8. Embedded Content
Pages on this site may include embedded content from other websites (e.g. YouTube videos, images, articles). Embedded content from other websites behaves in the same way as if you had visited that website directly.
These third-party websites may collect data about you, use cookies, embed additional tracking, and monitor your interaction with the embedded content, including tracking your interaction if you have an account and are logged in to that website.
9. Your Rights
Under UK GDPR, you have the following rights over your personal data:
- Right of access: request a copy of the personal data we hold about you (Subject Access Request)
- Right to rectification: request that we correct any inaccurate or incomplete data
- Right to erasure: request that we delete your personal data (where we have no legal obligation to retain it)
- Right to restrict processing: request that we limit how we use your data
- Right to data portability: request your data in a structured, commonly used, machine-readable format
- Right to object: object to processing based on our legitimate interests
- Right to withdraw consent: where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal
Right to Object to Direct Marketing
You have the right to object to the processing of your personal data for direct marketing purposes at any time. To do so, click the “unsubscribe” link in any marketing email, or contact us at [email protected].
How to Exercise Your Rights
To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving your request. If your request is complex, we may extend this by a further two months, but we will let you know within the first month.
If you have an account on this site, you can also request an export of your personal data or request erasure through your account dashboard.
10. Complaints
Complain to Us
If you are unhappy with how we handle your personal data, please contact us at [email protected]. We will acknowledge your complaint within 30 days and investigate it in line with our internal procedures.
Complain to the ICO
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s supervisory authority for data protection:
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
11. Data Security and Breach Notification
We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it, including encryption, access controls, and regular security monitoring.
Payment card information is never stored on our servers; it is transmitted directly to our payment processors using industry-standard TLS encryption.
We have procedures in place to detect, report, and investigate personal data breaches. In the event of a breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay and report the breach to the Information Commissioner’s Office within 72 hours.
12. Changes to This Policy
We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page indicates when the policy was last revised.
13. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us:
- Email: [email protected]
- Telephone: +351 265 096 923
- Post: Gratnells Ltd, Highfield Court, Church Lane, Madingley, Cambridge CB23 8AG, United Kingdom