Privacy Policy

1. Data controller

The data controller for Breadboard.it is Arcneon Limited, a company registered in England and Wales (company number 07227927).

Registered address: Unit A, 82 James Carter Road, Mildenhall, England, IP28 7DE

For privacy queries, contact us at privacy@breadboard.it.

2. What data we collect

We collect the minimum data needed to operate the store:

• Account data — email address, authentication information, and account metadata required to operate your account (managed by AWS Cognito). This includes operational metadata such as account creation time, last sign-in, and authentication events (e.g. sign-ins and password resets). If you sign in via a third-party provider such as Google, we receive your email address only.
• Order data — what you ordered, order status, and payment reference. We do not store your payment card details or shipping address in our database.
• Correspondence — if you contact us (for example by email), we receive your email address and the contents of your message.
• Cart data — the items in your basket, linked to a random, opaque cart identifier (see Cookies & similar technologies below). Before you sign in, this cart is not linked to you or to any identifying information.
• Chip requests — if you request a component, we store the part number and any notes you provide, linked to your account.
• Quote requests — custom board specifications you submit.
• Analytics data (only with your consent) — if, and only if, you opt in, we collect aggregated usage statistics via Google Analytics that do not directly identify you (see Cookies & similar technologies and Third-party services below). Before you consent, no analytics cookies are set and no client identifier is stored on your device; a limited cookieless ping is transmitted to Google containing the page URL, referrer, and basic browser metadata so Google can model aggregate reporting. Your consent choices are stored in a first-party cookie on your device; we read them solely to honour your preferences and do not tie them to your identity.
• Marketing / conversion data (only with your consent) — if, and only if, you opt in to marketing, we use Google Ads conversion tracking to measure whether a visit that arrived from one of our adverts resulted in a purchase. Before you consent, no advertising cookies are set and no click identifier (gclid) is stored on your device; the Google Ads tag transmits only a cookieless ping to Google (page URL, referrer, basic browser metadata) that Google uses to model aggregate conversion statistics.

3. What data we do NOT collect

• Shipping addresses — collected by Stripe during checkout and made available to us solely for fulfilling your order (including handing the delivery address to the carrier). We do not store shipping addresses in our own database.
• Payment card details — handled entirely by Stripe. We only receive a payment reference and status.
• Advertising cookies without consent — we do not set advertising or conversion-tracking cookies unless you opt in to marketing. We never sell your personal data, and we do not allow advertisers to track you across unrelated sites for their own purposes.
• Analytics or marketing without consent — no analytics or advertising cookies are set, and no client identifier or gclid is stored on your device, unless you have given prior opt-in consent. Where Google Consent Mode is used, Google tags may load and transmit a limited cookieless ping to Google (containing the page URL, referrer, and basic browser metadata such as language, timezone, screen size, and user agent) that Google uses to model aggregate reporting. No personal identifiers are transmitted, no cookies are read or written, and no data is stored on your device.

4. Legal basis for processing

We process your personal data under the following lawful bases (UK GDPR Article 6):

• Contract — to fulfil your orders, process payments, send dispatch notifications, maintain your basket, and provide our services.
• Legal obligation — to comply with accounting, tax, and record-keeping requirements (e.g. HMRC).
• Legitimate interests — to operate and secure our website, prevent fraud and abuse, and maintain the essential functions of the site (including your shopping cart), provided these interests are not overridden by your rights and freedoms.
• Consent — for optional analytics (Google Analytics) and marketing (Google Ads conversion tracking), and any other non-essential cookies. You may give or withdraw this consent at any time (see Cookies & similar technologies), and withdrawal is as easy as giving it. We store a record of your consent locally in your browser so we remember your choices on your device.

5. How we use your data

• To process and fulfil your orders
• To send order confirmation and dispatch emails
• To maintain your shopping basket between visits
• To respond to custom board quotes
• To track which components have been requested
• To secure the site and prevent fraud
• To monitor errors and site performance so we can diagnose and fix reliability issues (via Grafana Cloud Faro — cookie-free)
• With your analytics consent only: to understand aggregate site usage and improve the site via Google Analytics
• With your marketing consent only: to measure whether our Google Ads lead to purchases (conversion tracking), so we can gauge the effectiveness of our advertising

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not use your data for automated decision-making or profiling.

6. Cookies & similar technologies

We take a consent-first approach to cookies and similar technologies. On your first visit we show a cookie banner. Non-essential cookies — both analytics and marketing — are off by default. We set them only after you actively accept them, and never before. You can accept or decline each category separately, and change or withdraw your choice at any time via the "Cookie settings" link in the site footer.

We use Google Consent Mode. Our Google tags respect your choices: before you consent they do not read or write cookies and they do not store any identifier on your device. They do send a limited cookieless ping to Google containing the page URL, the referrer, and basic browser metadata (language, timezone, screen size, user agent), which Google uses to model aggregate statistics. No client identifier, no click identifier (gclid), and no advertising identifier is transmitted or persisted before consent. Full measurement — including cookies, click identifiers, and user data — begins only once you opt in, and stops when you withdraw.

We use three categories of cookie.

Strictly necessary (always on, no consent required)

These are required for the site to function and are exempt from consent under the Privacy and Electronic Communications Regulations (PECR). You cannot turn them off.

Analytics (optional — cookies off until you opt in)

If you do not consent to analytics, no _ga cookies are set and no client identifier is stored on your device. Under Google Consent Mode our Google Analytics tag still loads on every page, but before consent it does not read or write cookies; it transmits only a cookieless ping (page URL, referrer, and basic browser metadata) that Google uses to model aggregate statistics. Withdrawing consent stops cookie-based collection and removes any first-party analytics cookies previously set.

GA4's default configuration is largely first-party (_ga, _ga_*), but Google may set additional cookies on their own domains (such as google.com) depending on your Google account state. These are subject to Google's own retention and are not visible to us or deletable from your browser via our cookie banner. See Google's Cookies used by Google disclosure for the current list.

Marketing / advertising (optional — cookies off until you opt in)

If you do not consent to marketing, no advertising cookies are set and no gclid/conversion identifier is stored on your device. Under Google Consent Mode the Google Ads tag still loads on every page, but before consent it does not read or write cookies and does not transmit any user data; it sends only a cookieless ping (page URL, referrer, and basic browser metadata) that Google uses to model aggregate conversion statistics. Withdrawing consent stops cookie-based conversion tracking and removes any first-party advertising cookies previously set.

In addition to the first-party cookies listed above, Google may set third-party cookies on their own domains (such as doubleclick.net and google.com) as a consequence of the Google Ads tag running. These are subject to Google's own retention and are not visible to us or deletable from your browser via our cookie banner. See Google's Cookies used by Google disclosure for the current list. Under Google Consent Mode with ad_storage: denied, Google states that these third-party advertising cookies are not set.

7. Third-party services

We use the following third-party services that may process your data:

• Stripe — payment processing and shipping address collection. Stripe acts as an independent controller for payment processing where applicable. See Stripe's privacy policy at https://stripe.com/privacy.
• AWS (Amazon Web Services) — hosting, authentication, email delivery, and database, acting as our data processor. Data is stored in the EU (eu-west-1, Ireland).
• Grafana Cloud (Grafana Labs) — frontend error monitoring and web-vitals performance metrics (Real User Monitoring). No cookies. No localStorage. A short-lived random session identifier is stored in your browser's sessionStorage for the lifetime of your current browser tab, so we can group errors and vitals from a single browsing session for triage. It is not persisted across visits, does not touch cookies or localStorage, is not correlated with any other identifier we or Grafana hold, and cannot be used to identify you or track you across sessions or devices — closing the tab discards it. Requests are proxied through our own domain (/api/telemetry) so no third-party network calls are made from your browser. Grafana receives your IP address at the network layer, which it may use to estimate your approximate geographic region for error triage and performance measurement. Processed under our legitimate interests in operating a reliable site. Grafana Labs acts as our data processor. See Grafana's privacy policy at https://grafana.com/legal/privacy-policy/.
• Shipping providers — such as Royal Mail and other delivery providers, to deliver your order. We share the recipient's name and delivery address with the carrier for this purpose only.
• Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — aggregated usage measurement. The Google Analytics tag loads on every page under Google Consent Mode. Before you consent, no cookies or client identifier are read or written on your device; the tag transmits only a cookieless ping (page URL, referrer, basic browser metadata) that Google uses to model aggregate reporting. If you consent to analytics, full measurement runs (cookies set, session/client identifier stored) and does not directly identify you; IP anonymisation is enabled and Google Analytics is configured for measurement only, with Google Signals and ads-personalisation features off. This data is treated as pseudonymised rather than fully anonymous. See Google's privacy policy at https://policies.google.com/privacy.
• Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) — conversion tracking that tells us whether visits from our adverts result in a purchase. The Google Ads tag loads on every page under Google Consent Mode. Before you consent, no cookies are read or written, no gclid is stored, and no user data is transmitted; the tag sends only a cookieless ping (page URL, referrer, basic browser metadata) that Google uses to model aggregate conversion statistics. If you consent to marketing, the tag persists the gclid, sets first-party advertising cookies (see §6), and may additionally set third-party cookies on Google's own domains (such as doubleclick.net and google.com) as part of standard conversion tracking. Third-party cookies on Google's domains are subject to Google's own retention and disclosure — we cannot inspect or delete them from your browser via our cookie banner. Google acts as a controller for its own advertising services. See Google's privacy policy at https://policies.google.com/privacy and their cookies disclosure at https://policies.google.com/technologies/cookies.

8. International transfers

Our primary infrastructure is hosted in the EU (AWS eu-west-1, Ireland). Some of our service providers (such as Stripe, Grafana Labs, and — where you have consented — Google) may process data outside the UK/EEA, including in the United States. Where this occurs, we rely on appropriate safeguards such as the UK International Data Transfer Addendum, EU Standard Contractual Clauses, or an approved adequacy mechanism (e.g. the UK Extension to the EU–US Data Privacy Framework).

9. Data security

We use appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), access controls, and secure cloud infrastructure. Payment data is handled entirely by Stripe, a PCI DSS Level 1 certified provider.

10. Data retention

Account and order data is retained for as long as your account is active and for a reasonable period afterwards. We retain accounting records for at least six years where required by law. Anonymous cart data is deleted automatically after a period of inactivity (carts age out on a 180-day server-side window, and the bb_cart cookie is removed at checkout). Your consent record (bb_consent) is stored in your browser's localStorage on your device: up to 365 days if you accepted any optional category, 30 days if you rejected all optional storage. It is re-requested when this policy materially changes. Analytics data, where collected with consent, is retained for up to 24 months.

You may request deletion of your account and associated data at any time by contacting us. We may retain certain data where required to comply with legal obligations (for example, financial records).

11. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Withdraw consent for optional cookies/analytics at any time
• Data portability — receive your data in a structured format

To exercise any of these rights, contact privacy@breadboard.it. We may ask you to verify your identity before fulfilling certain requests, to protect your personal data. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk.

12. Contacting us

When you contact us — for example by emailing privacy@breadboard.it — we receive your email address and the contents of your message. We use this solely to respond to and administer your query, and we retain such correspondence only for as long as needed for that purpose or to comply with our legal obligations.

13. Children

We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Significant changes will be highlighted on the website.