01 What this policy covers
This policy applies to dio.lighting, the product website of the DIO brand. The site sells nothing: there are no customer accounts, no orders and no payments. The personal data it handles is what you send through the enquiry form, the technical data any website receives when a page is requested, and the cookies described in the cookie policy.
The site is published from the European Union and addressed to trade visitors anywhere. This policy follows the EU General Data Protection Regulation (GDPR), which protects every visitor whose data we process regardless of where they are, and it is applied in the same way to visitors from outside the EU, including those covered by the UK GDPR.
02 Who is responsible
DIO is a brand. The controller of the personal data described here is the company that operates the brand and this site. Its registered details — legal name, company code, VAT number and registered address — are provided on request: write to hello@dio.lighting or ask through the contact form and they will be sent to you, together with the name of the person responsible for data protection.
Any question about this policy and any request concerning your data can be sent to the same address; put "privacy" in the subject so it reaches the right person.
03 What we collect
We collect only what the site needs to answer you and to stay secure.
| Where it comes from | What it is | When |
|---|---|---|
| The enquiry form | Name, email address, message, the topic you pick; company and phone number if you give them; the product code when you arrive from a product page; the two consents ticked with the message, and the time it was sent. | Only when you send the form. |
| Our reply and the exchange that follows | The emails between you and us about your enquiry. | After you send the form. |
| Spam protection (Google reCAPTCHA) | Your IP address, browser and device characteristics and how you interact with the page, evaluated by Google to tell a person from a script. We receive only a score, never the underlying data. | On pages with a form. |
| Server and security logs | IP address, the page requested, date and time, browser type, and the outcome of the request. Cloudflare, which sits in front of the server, keeps equivalent logs for security and performance. | Every request, like any website. |
| Cookies | A session identifier, a security token, and a record of your cookie choices. Listed one by one in the cookie policy. | See the cookie policy. |
We do not collect special categories of data, do not knowingly collect data about children, and do not buy data about you from anyone.
04 Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering your enquiry: availability, lead times, specifications, trade terms | Steps at your request before a contract, art. 6(1)(b), and your consent given with the form, art. 6(1)(a). |
| Keeping the site secure and available: spam protection, server logs, Cloudflare | Our legitimate interest in running a secure website, art. 6(1)(f). |
| Keeping a record of the consents you gave | Our legal obligation to demonstrate consent, art. 6(1)(c) with art. 7(1). |
| Complying with a lawful request from an authority | Legal obligation, art. 6(1)(c). |
We do not use your data for marketing, do not profile you, make no automated decisions about you, and do not sell or rent your data. No analytics or advertising tool is running on this site. If one is added, it will run only after you consent in the cookie banner, and this policy and the cookie policy will be updated first.
05 How long we keep it
| Data | Kept for |
|---|---|
| Enquiries and the correspondence that follows | Up to 24 months after the last exchange, so a follow-up can be answered with its context. Where an enquiry leads to a business relationship, the documents of that relationship are kept by the company under accounting law. |
| Record of your consents | As long as the enquiry they belong to. |
| Server and security logs | Rotated automatically; no longer than 30 days unless a log is needed to investigate an attack. |
| Cookies | Their individual lifetimes are in the cookie policy; the record of your choices lasts 12 months. |
06 Who else processes it
Your data is processed on our behalf by providers bound by data-processing agreements. None of them may use it for their own purposes.
| Processor | What for | Where |
|---|---|---|
| Hosting provider | Runs the server this site and its logs live on. | European Union. |
| Cloudflare, Inc. | Content delivery, caching and protection against attacks; sees every request in transit. | Global network; EU data centres for EU visitors. Transfers covered by the EU–US Data Privacy Framework and standard contractual clauses. |
| Google Ireland Ltd (reCAPTCHA) | Spam protection on forms. | Ireland, with possible processing in the United States under the EU–US Data Privacy Framework. |
| Email provider | Delivers your enquiry to us and our reply to you. | European Union. |
Beyond these, your data is disclosed only to a public authority that is lawfully entitled to it, or to a professional adviser bound by confidentiality where a legal claim requires it.
07 Transfers outside the EEA
Two of the processors above are headquartered in the United States. Where data leaves the European Economic Area, the transfer rests on the European Commission's adequacy decision for the EU–US Data Privacy Framework, on standard contractual clauses (art. 46(2)(c) GDPR), or on both. Copies of the safeguards can be requested at hello@dio.lighting.
08 How it is protected
The site is served over TLS only. Access to enquiries is limited to the people who answer them. The server is kept updated, protected by Cloudflare, and backed up; backups are encrypted and kept in the European Union. If a breach were ever to put your rights at risk, we would notify you and the supervisory authority as the GDPR requires.
09 Cookies
The site sets a handful of necessary cookies and nothing else without your consent. The cookie policy lists every cookie, its purpose and its lifetime, and explains how to change your choice. You can reopen the settings at any time with the button below.
10 Your rights
Under the GDPR you have the right to:
- know whether we hold data about you and receive a copy (access, art. 15);
- have inaccurate data corrected (rectification, art. 16);
- have your data deleted where there is no longer a reason to keep it (erasure, art. 17);
- restrict processing while a dispute is settled (art. 18);
- receive the data you gave us in a machine-readable form (portability, art. 20);
- object to processing based on our legitimate interest (art. 21);
- withdraw a consent at any time, without affecting what was done before (art. 7(3)).
Write to hello@dio.lighting or use the contact form for any of these. We answer within one month; if a request is complex we may take up to two more, and will tell you why. We may ask you to confirm your identity before releasing data.
If you believe your data has been handled unlawfully, you may complain to a data protection authority: the one of the EU or EEA country where you live or work (the European Data Protection Board lists them all), the Information Commissioner's Office in the United Kingdom, or the authority of the country you live in elsewhere. We would rather hear from you first, and will do our best to resolve the matter.
11 Changes to this policy
When this policy changes, the new version is published on this page with a new date. A change that affects how your data is used, such as adding an analytics tool, is made only after the cookie policy has been updated and, where consent is needed, after you have been asked for it.
12 Contact
hello@dio.lighting, or the contact form. The controller's registered details are provided on request, as described in section 2.