Privacy Policy
Information about how personal data is processed through macrigi.com and related services.
Who manages your data
What information may be processed
Depending on the services requested, Macrigi may process identification and contact details, account and profile data, business information, billing and delivery details, order data, commercial enquiries and support information, together with technical information required for site security and operation. Payment data is handled by the relevant payment providers within their respective payment flows.
Why we process personal data
We process personal data only where an appropriate lawful basis applies to the relevant purpose. Performance of a contract, or steps taken before entering into a contract, may apply to accounts, orders, payments, plans, commercial enquiries and relationships with buyers, producers, sellers and business partners. Legal obligations may require tax, accounting, administrative processing or processing required by a competent authority.
Legitimate interests may be relied upon, where appropriate and after balancing the interests involved, for security, prevention of abuse and fraud, protection of rights, dispute management and operational continuity. Consent is used where required for optional communications and non-essential browser technologies. Where processing is based on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal.
Initial language selection
Macrigi Languages & Markets may use only the country code provided by Cloudflare (for example GB or IT) to suggest the most suitable initial language. The country code is read server-side for this purpose and is not stored by Macrigi as geolocation data.
GPS, coordinates, city or precise location are not used for this function. If you have already chosen a language manually, your choice takes precedence over the suggestion based on country and browser language preferences.
Services recorded within the Macrigi environment
The following summary is aligned with the verified Macrigi Consent Core service catalogue and completed runtime checks. A service appearing in the catalogue describes its role in the system; it does not, by itself, mean that the service sets cookies or tracking technologies in the browser.
Necessary website and marketplace functions
Email and communications
Security, payments, delivery and tax
Infrastructure and technical monitoring
Optional functions and services not yet runtime-certified
Who personal data may be shared with
Personal data may be processed by service providers and technical partners where necessary to deliver Macrigi services, including, depending on the actual flow used, FA3 Limited / HTTPiD for hosting and infrastructure, OVH for domains and DNS services where applicable, and the OpenAI API for assisted translation of catalogue content, as well as payments, delivery and fulfilment, transactional email, security, authentication and platform components.
Within the marketplace, certain information relating to orders, enquiries or transactions may be made available to the seller, producer, buyer or another party involved in the specific transaction, only to the extent necessary to complete it. The privacy role of each provider depends on the specific service and is not assigned automatically.
Orders, payments and delivery
Necessary personal data may be used for registration and accounts, basket and order management, wholesale pricing and functions, payments, tax compliance and delivery. WooCommerce remains the commerce engine; payment services and related information are handled by the relevant providers within the flows in which they are used.
How long we keep personal data
Personal data is kept for as long as necessary for the purpose for which it was collected and, afterwards, for any period required by law or necessary to protect rights and contractual obligations. Account data is normally kept for the duration of the relationship and for any subsequent period needed to meet legal obligations or manage disputes.
Data relating to orders, invoicing, payments and commissions may be kept in accordance with applicable tax, accounting and administrative obligations; the Macrigi documentation baseline provides for six years from the end of the relevant financial year where that period applies. Chats and support tickets may be kept for up to 24 months unless security needs, legal obligations or disputes require otherwise. Data processed on the basis of consent is kept until consent is withdrawn or the relevant purpose ends, subject to any further applicable obligations.
Where necessary, Macrigi also retains technical records of consent preferences, subsequent changes or withdrawals, and the information needed to demonstrate the choice made. Historical archives from previous consent-management systems are kept separately and with restricted access for accountability, protection and compliance purposes.
Providers and processing outside the United Kingdom
Some technical providers within the Macrigi ecosystem may operate or process personal data outside the United Kingdom or the European Economic Area. Where an international transfer of personal data actually applies, Macrigi uses or requires safeguards recognised by applicable law, such as adequacy decisions, standard contractual clauses or other legally recognised transfer mechanisms.
The presence of an international provider is not, by itself, treated as evidence that a transfer takes place: the assessment depends on the service, its actual configuration and the provider's privacy role in the relevant processing.
Access, rectification, erasure and complaints
Where provided by applicable law, you may request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw that consent at any time.
To exercise your rights, use the contact details provided in this Privacy Policy. You also have the right to lodge a complaint with the competent supervisory authority. In the United Kingdom, the relevant authority is the Information Commissioner's Office (ICO); for individuals in the European Economic Area, the data protection authority of the relevant country may also be competent.
Cookies, preferences and email marketing
Macrigi keeps browser consent for cookies and optional technologies separate from email/marketing consent. Choices relating to cookies and browser technologies are managed through Macrigi Consent Core; email/marketing consent is managed within Macrigi Mail.
Open the Cookie PolicyPolicy version
Content reconciled with the service catalogue and the verified Macrigi Consent Core runtime. Last updated: 23 October 2026.