Privacy Policy
This Privacy Policy explains how NAM EXIM LTD ("NAM EXIM", "we", "us" or "our") collects, uses and shares personal data through the website at https://namexim.net (the "Site"). It is issued in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and, where applicable, the EU GDPR.
1. Data controller
The data controller for personal data collected through the Site is:
NAM EXIM LTD (Company No. 07342938)
15 Sibley Park Road, Reading, RG6 5UB, United Kingdom
Email: [email protected]
2. Personal data we collect
- Order & account data - name, email, optional company name and country of residence supplied at checkout, plus the order metadata (product purchased, amount, currency, transaction reference).
- Payment data - your card details are entered directly into our payment provider (Stripe) and are not received or stored by us. We retain a transaction reference and the last-four digits of the card where supplied to us by the provider for fraud and accounting purposes.
- Communications - the content of any emails or support tickets you send us.
- Technical data - IP address, browser user-agent, pages visited and timestamps, captured in standard server logs and used for security monitoring and aggregate analytics. We do not use third-party advertising trackers.
3. Lawful bases for processing
- Performance of a contract (UK GDPR Art. 6(1)(b)) - to take payment, deliver the toolkit and provide post-sale support.
- Legal obligation (Art. 6(1)(c)) - to retain invoicing and accounting records for at least six years under UK tax law.
- Legitimate interests (Art. 6(1)(f)) - to detect fraud, secure the Site and improve our services, balanced against your privacy rights.
- Consent (Art. 6(1)(a)) - where you separately opt in to non-essential cookies (see our Cookie Policy).
4. How we share personal data
We share personal data only with the following categories of recipient and only as necessary:
- Stripe (payment processing) - stripe.com;
- Hosting and infrastructure providers hosting the Site and our database;
- Email providers used to deliver order confirmations, download links and support replies;
- Professional advisers such as accountants and lawyers under appropriate confidentiality obligations;
- Authorities where we are legally required to disclose data.
We do not sell or rent personal data to third parties for their independent marketing purposes.
5. International transfers
Some of the providers listed above may process personal data outside the UK or EEA. Where this is the case we rely on UK International Data Transfer Agreements, the EU Standard Contractual Clauses, or an applicable adequacy decision to provide an appropriate safeguard. Details are available on request.
6. Retention
- Order and invoicing data: at least 6 years from the end of the financial year in which the transaction was completed (HMRC/UK tax law).
- Customer support correspondence: up to 24 months after the matter is closed.
- Server logs: 90 days, then deleted or aggregated.
7. Your rights
Subject to the conditions in the UK GDPR, you have the right to:
- request access to your personal data;
- request rectification of inaccurate data;
- request erasure where one of the legal grounds applies;
- request restriction or object to processing based on legitimate interests;
- request portability of data you provided to us;
- withdraw consent at any time where processing is based on consent;
- lodge a complaint with the Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
To exercise these rights, write to [email protected]. We respond within one month of receiving a verifiable request.
8. Security
We use TLS encryption in transit, restricted database access, role-based admin access and audit logging. Card data is never stored on our servers.
9. Cookies
See our separate Cookie Policy for full details.
10. Changes to this Policy
We will update this page when our practices change. The "Last updated" date at the top of this page reflects the most recent revision.