Privacy Policy

Effective date: 4 September 2026

1. Introduction

KOKIO LTD (“Kokio”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, share and protect personal data when you:

visit our website;
contact us;
submit an enquiry;
subscribe to marketing communications;
request information about our services;
create or use an account where available;
become a client or prospective client; or
otherwise interact with Kokio.

We process personal data in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and, where relevant, the Privacy and Electronic Communications Regulations 2003 (PECR).

2. Who We Are

This website is operated by:

KOKIO LTD
Old Post Office
Back Ln
Allerthorpe
York
YO42 4RP
United Kingdom

Company number: 14339247
Registered in: England and Wales
Website: https://kokio.co.uk

For the purposes of UK data protection law, KOKIO LTD will normally act as the controller of personal data where we determine why and how that data is processed.

In some circumstances, particularly where we provide services on behalf of a client, Kokio may act as a processor under the client’s instructions. The ICO describes controllers as the organisations that exercise overall control over the purposes and means of processing.

3. Personal Data We May Collect

Depending on how you interact with Kokio, we may collect personal data including:

name and surname;
email address;
telephone number;
company or organisation name;
job title or business role;
postal or billing address;
information submitted through contact or enquiry forms;
information relating to a quotation, project or service request;
correspondence between you and Kokio;
payment and transactional information where relevant;
account and login information where applicable;
IP address;
browser and device information;
website activity and usage data;
cookie identifiers;
marketing preferences;
support enquiries;
information you voluntarily provide to us.

For certain services, we may also process information relevant to ecommerce, fulfilment, Amazon, customer-service or document-management activities where this is necessary to provide an agreed service.

4. How We Collect Personal Data

We may collect personal data directly from you when you:

complete a form on our website;
contact us by email, telephone or another communication method;
request a quotation;
enquire about a service;
subscribe to our newsletter;
create an account;
engage Kokio to provide services;
request support;
communicate with our team;
provide feedback.

We may also collect limited technical and usage information through cookies, analytics tools, security systems, server logs and similar technologies.

Where permitted by law, we may obtain business contact information from public business sources, professional platforms, business websites or other legitimate sources.

If we obtain personal data from another source, we will provide appropriate privacy information where required by UK GDPR. ICO guidance requires organisations to disclose categories and sources of personal data where it was not collected directly from the individual.

5. Why We Use Personal Data

We may process personal data for purposes including:

responding to enquiries;
communicating with prospective and existing clients;
preparing quotations and proposals;
providing contracted services;
managing client relationships;
delivering customer support;
operating ecommerce and fulfilment services where agreed;
providing Amazon or marketplace services;
delivering website, marketing, SEO or software services;
providing document-management services;
processing invoices and payments;
maintaining business records;
improving our website and services;
analysing website usage;
maintaining security;
preventing fraud or misuse;
complying with legal obligations;
establishing or defending legal claims;
sending marketing communications where permitted.

6. Lawful Bases for Processing

Under UK GDPR, we must have a lawful basis for processing personal data.

Depending on the activity, we may rely on:

Contract

We may process personal data where necessary to enter into or perform a contract with you.

This may include:

preparing a quotation;
providing a service;
managing an account;
providing support;
processing payments.

Legitimate interests

We may process personal data where this is necessary for our legitimate business interests, provided those interests are not overridden by your rights.

These interests may include:

responding to business enquiries;
managing business relationships;
improving our services;
maintaining website and system security;
analysing business performance;
protecting our legal interests.

Consent

We may rely on your consent for certain activities, including some marketing communications and optional tracking technologies.

You may withdraw consent at any time.

Legal obligation

We may process personal data where necessary to comply with legal or regulatory obligations.

7. Contact Forms and Service Enquiries

The Kokio UK website contains forms through which users may contact us regarding services such as ecommerce and fulfilment, customer service, Amazon management, advertising and document management.

When you submit a form, we may collect the information shown in that form, including your:

name;
email address;
telephone number;
company information;
service interests;
message;
relevant project or business information.

We use this information to respond to your enquiry, understand your requirements and discuss relevant services.

Submitting a general enquiry does not automatically subscribe you to marketing communications.

8. Account Information

The Kokio website may provide account or login functionality.

Where an account is created, we may process:

email address;
password or secure authentication credentials;
account preferences;
login information;
account activity.

Passwords should be stored using appropriate security measures and should not be accessible to Kokio staff in plain text.

Account information may be retained while the account remains active and for a reasonable period afterwards where necessary for security, legal or operational purposes.

9. Newsletter and Direct Marketing

Kokio may send marketing communications by email or other electronic means where permitted by law.

For individuals, PECR generally requires consent before unsolicited electronic marketing is sent unless the existing-customer “soft opt-in” conditions are met. Those conditions include collecting the contact details directly during a sale or negotiation for a sale, marketing similar products or services, and providing an opt-out at collection and in every subsequent message.

Where we rely on consent, it must be:

freely given;
specific;
informed;
unambiguous; and
demonstrated through a positive action.

Pre-ticked boxes should not be used. The ICO also says marketing consent should be separate from acceptance of general terms and conditions.

You may unsubscribe at any time using the unsubscribe link provided in our communications or by contacting us.

We may retain limited suppression information after you unsubscribe so that we can respect your request not to receive further marketing.

10. Business-to-Business Marketing

Some Kokio services are marketed to businesses.

PECR distinguishes between individual subscribers and corporate subscribers. Unsolicited electronic marketing may generally be sent to corporate subscribers without prior consent, but the sender must not conceal its identity and must provide a valid way to opt out. Sole traders and some partnerships are treated differently and may require consent or reliance on the soft opt-in.

Where marketing involves personal data, we will also comply with UK GDPR requirements.

11. Cookies and Similar Technologies

Our website may use cookies and similar technologies.

These may include:

essential cookies;
security cookies;
preference cookies;
analytics technologies;
advertising or marketing technologies;
tracking pixels;
scripts or tags.

PECR applies not only to ordinary cookies but also to other technologies that store or access information on a user’s device.

We will provide clear information about the purposes of cookies and similar technologies.

Where consent is required, optional technologies should only be used in accordance with your choices through our cookie-consent mechanism.

You should be able to:

accept optional cookies;
reject optional cookies;
manage preferences;
change your choices later.

The ICO requires clear and comprehensive information about cookies and their purposes.

Further information should be provided in our separate Cookie Policy.

12. Analytics

We may use analytics tools to understand how visitors interact with the website.

Information collected may include:

pages visited;
time spent on pages;
approximate location;
browser type;
device type;
referring website;
clicks and interactions;
IP or similar technical identifiers.

Where analytics technologies require consent under PECR, they will only operate according to the choices made through our cookie-consent tool.

13. Embedded Content and Third-Party Services

Our website may contain embedded content and functionality from third parties.

This may include:

videos;
social-media content;
maps;
forms;
analytics tools;
website plugins;
payment providers;
advertising platforms;
software services.

These third parties may process data according to their own privacy policies.

Where Kokio determines the purpose for which a third-party service processes data on our behalf, we will take reasonable steps to ensure appropriate contractual and data-protection arrangements are in place.

14. Who We May Share Personal Data With

We do not sell personal data.

We may share personal data where reasonably necessary with:

Kokio employees;
contractors;
website hosting providers;
IT and security providers;
email and communications platforms;
cloud-storage providers;
analytics providers;
payment providers;
accounting providers;
advertising platforms;
ecommerce and marketplace platforms;
warehousing and fulfilment partners;
logistics or courier providers where relevant;
customer-service systems;
professional advisers;
insurers;
regulators or law-enforcement authorities where required by law.

Where a provider acts as a processor on our behalf, appropriate contractual arrangements should govern the processing.

15. International Transfers

Some suppliers and technology providers used by Kokio may process personal data outside the United Kingdom.

A transfer outside the UK may be a restricted transfer under UK GDPR.

Where required, we will ensure that an international transfer is covered by an appropriate legal mechanism, which may include:

UK adequacy regulations;
an appropriate safeguard;
the UK International Data Transfer Agreement;
the UK International Data Transfer Addendum;
another approved safeguard; or
a permitted legal exception.

The ICO states that restricted transfers must be covered by adequacy, appropriate safeguards or a valid exception. Where safeguards such as the IDTA or Addendum are used, an appropriate transfer risk assessment may also be required.

16. How Long We Keep Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected and to meet legal, accounting, regulatory or contractual requirements.

Retention periods depend on the type of information.

For example, we may retain:

enquiry information for a reasonable period after the enquiry;
client information for the duration of the relationship and afterwards where necessary;
accounting records for legally required periods;
contract and project records where required to manage legal rights;
security logs for appropriate security periods;
marketing consent and suppression records where necessary to demonstrate compliance.

When information is no longer required, it will be deleted, anonymised or securely disposed of where appropriate.

17. Data Security

Kokio uses reasonable technical and organisational measures designed to protect personal data against:

unauthorised access;
accidental loss;
misuse;
alteration;
disclosure;
destruction.

These measures may include:

password controls;
access restrictions;
secure hosting;
software updates;
backups;
encryption where appropriate;
security monitoring;
role-based access;
supplier-security requirements.

No internet-based service can guarantee absolute security, but we take reasonable steps appropriate to the nature of the information processed.

18. Personal Data Breaches

Where we become aware of a personal data breach, we will investigate it and take appropriate action.

Where required by UK data protection law, we will notify the Information Commissioner’s Office and affected individuals within the applicable legal timescales.

19. Your Data Protection Rights

Depending on the circumstances, you may have rights including:

the right to be informed;
the right of access;
the right to rectification;
the right to erasure;
the right to restrict processing;
the right to object;
the right to data portability;
rights relating to automated decision-making;
the right to withdraw consent where consent is relied upon;
the right to complain to the Information Commissioner’s Office.

Not every right applies in every situation.

The ICO requires privacy notices to explain the rights available to individuals and the right to lodge a complaint with the supervisory authority.

20. Access, Correction and Deletion Requests

You may contact Kokio if you wish to:

request access to personal data we hold about you;
correct inaccurate information;
update your details;
request deletion where applicable;
restrict processing;
object to processing;
withdraw consent.

We may need to verify your identity before responding to a request.

We may also need to retain certain information where required by law or where another lawful reason applies.

21. Automated Decision-Making

Kokio does not generally make decisions about individuals that have legal or similarly significant effects based solely on automated processing.

If this changes, we will provide appropriate information and safeguards as required by UK GDPR.

22. Children’s Personal Data

The Kokio website and services are primarily aimed at businesses and adults.

We do not knowingly seek personal data from children through our business-services website.

If we become aware that we have collected children’s personal data without an appropriate legal basis, we will take reasonable steps to address the situation.

The current policy’s blanket reference to children under 13 is too narrow for a general UK business privacy notice. It is better to state accurately whether Kokio targets children at all.

23. Special Category Data

Kokio does not generally require special-category personal data through its public website.

Please do not provide sensitive personal information unless it is genuinely necessary.

If Kokio does need to process special-category data, we will ensure that an appropriate lawful basis and additional condition apply.

24. Data Obtained From Other Sources

Where permitted by law, Kokio may obtain business contact information from sources such as:

company websites;
professional networks;
business directories;
public registers;
referrals;
service providers.

Where UK GDPR requires us to provide privacy information after obtaining data from another source, we will do so within the applicable timeframe.

ICO guidance generally requires this information to be provided within a reasonable period and no later than one month, or earlier where the individual is contacted or the data is disclosed.