Cookies & Privacy Policy

1. Who we are

This website is operated by Maxlight Limited, which is the data controller responsible for the personal data described in this policy.

Company number

07888472

Registered office

333a Western Avenue, Acton, United Kingdom, W3 0BE

Privacy contact

laura@maxlight.co.uk

This policy explains:

• How we use cookies and similar technologies.
• How we collect and use personal data through the website.
• The rights and choices available to you.

The policy applies to:

• https://maxlight.com

2. Your cookie choices

We do not treat your continued use of this website, scrolling, closing the cookie notice or any other inactivity as consent to Analytics.

Technologies that are strictly necessary may operate automatically where they are essential to:

• Provide a website function or service you have requested;
• Remember your cookie and privacy choices;
• Maintain the security of the website;
• Prevent or detect fraud, abuse or technical faults;
• Transmit communications and deliver the website to your device.

Google Analytics 4 and related analytics technologies remain disabled unless you actively select Accept Analytics or enable Analytics through the cookie-preferences panel.

You may:

• Accept Analytics;
• Reject Analytics; or
• Review, withdraw or change your preferences at any time.

Use the Cookie preferences control in the website footer to reopen the preferences panel.

If you withdraw your consent to Analytics, we will stop Google Analytics from collecting further information from your device, update your recorded consent choice and remove the Google Analytics cookies that the website is technically able to remove. Analytics will remain disabled unless you choose to consent again.

Withdrawing your consent does not affect the lawfulness of any processing carried out before you withdrew it. Requests concerning personal information already collected through Analytics will be handled as described in the Your data protection rights section of this policy.

You can also block or delete cookies and similar website data through your browser settings. However, blocking technologies that are strictly necessary may prevent parts of the website from working properly.

3. What cookies are

Cookies are small data files that a website places on your computer, phone, tablet or other device when you visit it.

Cookies may be:

• Session cookies, which expire when the browser session ends; or
• Persistent cookies, which remain until their expiry date or until you delete them.

Cookies may also be:

• First-party cookies, which are set by Maxlight through this website; or
• Third-party cookies, which are set by another organization whose service is used on the website.

The rules described in this policy also apply to other technologies that store information on, or access information from, your device. These may include browser storage, tracking pixels, scripts, tags and similar technologies.

4. Cookies and analytics technologies used

The Maxlight preference cookie does not enable Analytics. It records the visitor's choice so that the website can apply it consistently.

Google Analytics cookies are not placed, read or updated unless the visitor has actively consented to Analytics.

5. Google Analytics 4

With your consent, we use Google Analytics 4, provided by Google, to understand how visitors use the website and to improve its content, navigation and performance.

Google Analytics may collect or generate information such as:

• Pages visited, page titles and navigation between pages;
• Date and time of visits, session duration and engagement;
• Referring websites, search information and campaign details;
• Browser type, device category and operating system;
• Approximate geographic information, such as country, region or city;
• Interactions with website content and features;
• A randomly generated identifier used to distinguish visitors and sessions.

Google Analytics may use an IP address temporarily to derive approximate geographic information and to provide and protect the service. Google states that it does not log or store individual IP addresses belonging to visitors in the United Kingdom. Maxlight does not receive visitors' individual IP addresses through its Google Analytics reports.

Google Analytics is disabled before consent. This implementation is not currently configured for Google Ads, remarketing or personalised advertising. If that changes, this policy and the consent controls must be updated before the change is enabled.

We do not intentionally send names, email addresses or other directly identifying information to Google Analytics.

If we materially change how Google Analytics is configured or begin using it for advertising, remarketing or additional tracking purposes, we will update this policy and the website's consent controls before enabling those changes.

6. Embedded content and external websites

The website may contain links to websites and social media services operated by other organisations. When you select an external link, you leave the Maxlight website. The organisation operating the external website will process information in accordance with its own privacy and cookie notices.

We do not control the content, security or privacy practices of external websites. We recommend reviewing the privacy information provided by the relevant website before submitting personal information or accepting its cookies.

Where the website includes embedded content, such as videos, maps or social media content, the third-party provider may receive technical information when that content is loaded. This may include:

• Your IP address;
• Browser and device information;
• The page from which the content was accessed;
• The date and time of the request; and
• Information about your interaction with the embedded content.

If you are signed in to an account held with the third-party provider, that provider may associate your interaction with your account.

Non-essential embedded content will not load until you consent through the website's cookie controls or actively choose to load the content using a clearly labelled control. Withdrawing consent will prevent the content and its associated technologies from loading again, although it will not remove information already received by the third-party provider.

The providers of any embedded services, their purposes and the technologies they use are identified in the relevant sections of this policy or in the cookie table.

7. Information you provide to us

When you contact Maxlight, submit a website form, request a brochure or other document, or make a project enquiry, we may collect:

• Your first name and last name;
• Your email address and telephone number;
• The name of your company, practice or organisation;
• The customer type and nature of your enquiry;
• Project details you provide such as site location, dimensions, budget, expected timeline and message;
• Files, filenames or secure references to files that you choose to upload;
• Correspondence and other communications relating to your enquiry;
• The page, referral source and campaign associated with your submission; and
• Records of any consent and communication preference you actively provide.

Please provide only the information reasonably necessary for us to understand and respond to your enquiry. Unless we specifically request it, please do not send sensitive personal information, passwords, payment-card details or confidential information that is not required for the project enquiry.

If you provide personal information about another person, you should make sure that you are authorised to provide it and, where appropriate, direct that person to this policy.

8. How we use personal information

We may use personal information where necessary to:

• Respond to enquiries and provide requested information;
• Understand and assess a proposed project or service request;
• Take steps at your request before entering into a contract;
• Arrange calls, meetings, showroom visits or consultations;
• Maintain records of enquiries, correspondence and active customer and prospective-customer relationships;
• Provide requested documents such as brochures or technical resources;
• Protect the website, prevent and investigate fraud, misuse, unauthorised access and security incidents;
• Diagnose technical faults and maintain website performance;
• Comply with applicable legal, regulatory, accounting or reporting obligations; and
• Establish, exercise or defend legal rights and claims.

Where you have consented to Analytics, we may also use Google Analytics 4 information to understand website use and improve its content, navigation and performance, as described in the Google Analytics 4 section.

We will not use personal information collected through an enquiry to send unrelated promotional marketing unless we have an appropriate lawful basis and have provided any choices required by law.

9. Lawful bases

The lawful basis we rely on depends on why we are using your personal information.

Consent

We rely on your consent where you actively choose to:

• Enable Google Analytics 4; or
• Receive any optional communications that specifically require your consent.

You may withdraw your consent at any time. You can withdraw Analytics consent through the Cookie preferences control in the website footer. For other consent choices, you can contact us using the details in this policy.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn. It must also be as easy to withdraw consent as it was to provide it.

Steps before entering into a contract and performing a contract

We may process personal information where this is necessary to:

• Assess a project or service request made by you;
• Prepare a proposal or quotation at your request;
• Discuss and arrange services you are considering; or
• Perform a contract that we have entered into with you.

Where you contact us on behalf of a company, practice, client or other organisation and the relevant contract would be with that organisation rather than with you personally, we may instead rely on our legitimate interests.

Legitimate interests

We may process personal information where necessary for our legitimate interests in:

• Responding to business and project enquiries;
• Providing information and documents that have been requested;
• Maintaining appropriate records of enquiries, projects, customers and correspondence;
• Managing professional relationships with customers, prospective customers, suppliers and advisers;
• Operating, maintaining and protecting the website;
• Preventing and investigating fraud, abuse and security incidents;
• Diagnosing technical problems;
• Managing and improving our internal business processes; and
• Establishing, exercising or defending legal rights and claims.

We rely on legitimate interests only where we have considered that the processing is necessary and that our interests are not overridden by your rights, interests or freedoms. This requires Maxlight to consider necessity, reasonable expectations and the effect of the processing on the individual.

Legal obligations

We may process personal information where necessary to comply with applicable legal, regulatory, tax, accounting, reporting or court-related obligations.

10. Sharing information

We may share personal information with trusted service providers that process it on our behalf where this is necessary to operate the website, respond to enquiries or manage our business. These may include providers supporting:

• Website hosting, infrastructure and technical support;
• Google Analytics 4, where you have consented to Analytics;
• Website security, fraud prevention and fault diagnosis;
• Business communications and email delivery;
• Customer and enquiry management;
• Cloud storage, document management and secure file delivery; and
• Other administrative and operational services used by Maxlight.

Service providers acting as processors are required to process personal information only for the agreed services and in accordance with our documented instructions, subject to appropriate contractual, confidentiality and security requirements.

We may also share personal information with professional advisers, including solicitors, accountants, auditors and insurers, where reasonably necessary for them to provide professional services to Maxlight. These organisations may act as independent controllers and process information in accordance with their own legal and professional obligations.

We may disclose personal information to courts, regulators, government bodies, law-enforcement authorities or other competent authorities where:

• We are legally required to do so;
• Disclosure is necessary to comply with a court order or lawful request;
• Disclosure is necessary to establish, exercise or defend legal rights; or
• Disclosure is lawfully permitted and reasonably necessary to prevent, detect or investigate fraud, security incidents or other unlawful activity.

We require recipients to receive only the personal information reasonably necessary for the relevant purpose.

11. International processing

Some of our service providers may process personal information in, or make it accessible from, countries outside the United Kingdom.

Where this constitutes a restricted international transfer, we take steps to ensure that the transfer is lawfully protected. Depending on the provider and destination, we may rely on:

• UK adequacy regulations;
• The United Kingdom International Data Transfer Agreement;
• The United Kingdom Addendum to the European Commission's Standard Contractual Clauses;
• Binding corporate rules; or
• Another transfer mechanism permitted by applicable data protection law.

Where required, we assess whether the safeguards provide an appropriate level of protection for the personal information being transferred.

You may contact us using the privacy contact details in this policy to request further information about the safeguards used for international transfers or, where available, a copy of the relevant safeguards. Certain commercially sensitive information may be redacted.

12. Retention

We retain personal information only for as long as it is reasonably necessary for the purpose for which it was collected, including responding to enquiries, delivering projects, maintaining appropriate business records, complying with legal and accounting obligations, resolving disputes and establishing or defending legal claims.

In deciding how long to retain information, we consider:

• The nature and sensitivity of the information;
• The purpose for which it was collected;
• Whether an enquiry developed into a project or customer relationship;
• The duration of the relevant customer or professional relationship;
• Applicable legal, tax and accounting requirements;
• Relevant limitation periods;
• Whether information is required in connection with a dispute or legal claim; and
• The risks associated with retaining or deleting the information.

We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, warranty or reporting requirements.

• Enquiries and Quotes: If you make an enquiry or request a quote but do not purchase a product from us, we will securely delete or anonymize your personal data 24 months after our last communication with you.
• Product Purchases & Warranties: If you successfully purchase a product from Maxlight Ltd, we will retain your customer account information, contact details, and transaction history for a period of 12 years from the date of purchase. This extended period directly supports our 10-year product warranty and ensures we have the necessary documentation to handle long-term product servicing, safety alerts, and any legal claims under contract law.
• Company tax records are generally required to be kept for 6 years from the end of the company financial year to which they relate, with longer retention applying in some circumstances.
• Website Security and Technical Runtime Logs: We retain website security and technical runtime logs only for the period made available through our hosting provider. Our current configuration, runtime logs are generally available for 1 day. Logs may be retained for longer where necessary to investigate a security incident, resolve a technical issue, comply with a legal obligation or establish, exercise or defend a legal claim.
• Consent and Privacy-Preference Records: We store your Analytics choice locally on your device using the Maxlight preference cookie for 180 days. We do not currently maintain a separate central database containing identifiable consent records. If the preference cookie expires, is deleted or cannot be accessed, you may be asked to make your choice again.
• Google Analytics Information: Where you consent to Google Analytics 4, detailed user-level and event-level information is retained for 14 months. This period allows us to compare website activity across annual reporting periods without retaining detailed Analytics information indefinitely. Aggregated information may remain available in standard Google Analytics reports for longer. Once these periods expire, your data will be permanently and securely deleted from our systems.

We may retain information for longer where required by law, where a dispute or investigation is ongoing, or where it is reasonably necessary to establish, exercise or defend legal rights.

When information is no longer required, we delete it, anonymise it or securely dispose of it.

Cookie and similar-technology durations are described in section 4.

13. Security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised or unlawful access, use, alteration, disclosure or destruction, and against accidental loss, damage or unavailability.

Our security measures are selected according to the nature of the information, how it is used and the risks associated with the processing. We also require service providers processing personal information on our behalf to maintain appropriate security measures.

We review our security arrangements periodically and update them where reasonably necessary.

Although we take steps to protect personal information, no method of transmission over the internet or method of electronic storage can be guaranteed to be completely secure.

If you believe that personal information submitted to Maxlight may have been compromised, please contact us using the privacy contact details in this policy.

14. Your rights and complaints

Under UK data protection law, you may have the right to:

• Request confirmation that we process your personal information and receive a copy of it;
• Ask us to correct inaccurate personal information or complete information that is incomplete;
• Ask us to delete your personal information in certain circumstances;
• Ask us to restrict the use of your personal information in certain circumstances;
• Object to processing based on our legitimate interests;
• Withdraw your consent where processing is based on consent;
• Receive certain personal information in a structured, commonly used and machine-readable format, or ask us to transfer it to another organisation where the right to data portability applies; and
• Complain about how we collect or use your personal information.

These rights are subject to conditions, limitations and exemptions under data protection law. For example, the right to deletion is not absolute, and we may need to retain information to comply with a legal obligation or establish, exercise or defend legal claims.

To exercise a right, please contact us using the following details:

Please describe your request clearly and provide enough information for us to identify the relevant records. We may ask for reasonable evidence of your identity or authority to act on behalf of another person.

You will not normally be required to pay a fee. We will respond without undue delay and normally within one calendar month. Where permitted by law, we may extend this period by up to two further months if the request is complex or you have made several requests. We will tell you if an extension is required.

Data protection complaints

You may submit a data protection complaint using the privacy contact details above if you believe that we have not handled your personal information in accordance with data protection law.

We will:

• Acknowledge receipt of your complaint within 30 days;
• Take appropriate steps to investigate it;
• Keep you informed where appropriate; and
• Explain the outcome without unjustifiable or excessive delay.

These complaint-handling duties are now required of organisations processing personal information in the UK.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:

You may contact the ICO whether or not you have complained to us first, although we would appreciate the opportunity to address your concern directly.

15. Contact us

For questions about this policy, your personal information or your cookie preferences, contact:

16. Updates

We keep this policy under regular review and may update it when our website, services, technologies, service providers, processing activities or legal obligations change.

The latest version will be published on this page and identified by the Last updated date at the top of the policy.

Where a change materially affects how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals before the new processing begins.

Where processing depends on consent and the change is not covered by the consent previously provided, we will request fresh consent before enabling the changed processing.