Privacy Policy for Legacy Koi
Last updated: [04/05/2026]
Legacy Koi is committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you visit our website, place an order, or contact us.
1. Who We Are
Legacy Koi is a UK-based business supplying koi carp, pond equipment, and related products. For the purposes of data protection law, Legacy Koi is the data controller of your personal data.
2. What Information We Collect
We may collect and process the following types of personal data:
Information you provide directly
Name
Billing and delivery address
Email address
Telephone number
Payment details (processed securely via third-party providers)
Order history and preferences
Information collected automaticallyI
IP address
Browser type and device information
Website usage data (via cookies)
3. How We Use Your Information
We use your data to:
Process and deliver your orders
Communicate with you regarding your purchases
Provide customer support
Improve our website and services
Comply with legal obligations
Send marketing communications (only if you opt in)
4. Legal Basis for Processing
We process your personal data under the following lawful bases:
Contractual necessity – to fulfil your ordersLegal obligation – for accounting and regulatory requirements
Legitimate interests – to improve services and prevent fraud
Consent – for marketing communications (where applicable)
5. Sharing Your Information
We only share your data where necessary, including with:
Courier and delivery companies (e.g. FedEx, APC, Royal Mail)
Payment processors
IT and website service providers
Legal or regulatory authorities when required
We do not sell your personal data to third parties.
6. Data Retention
We retain your personal data only for as long as necessary to:
Fulfil the purposes outlined in this policy
Comply with legal and tax obligations
Typically, order records are kept for up to 6 years in line with UK tax regulations.
7. Your Data Protection Rights
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018,
you have the right to:
Access your personal data
Request correction of inaccurate data
Request deletion of your data
Restrict or object to processing
Data portability
Withdraw consent (for marketing)
To exercise any of these rights, please contact us using the details below.