Privacy Policy
Last updated: February 2026
1. Introduction
Motive Brighton ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and share your personal information when you use our website and services.
We are the data controller for the personal information we process, unless otherwise stated. This policy applies to information we collect through our website, email communications, and customer support channels.
2. Data Controller
Company: Motive Brighton
Email: [email protected]
Address: 2 George Street, Brighton East Sussex BN2 1RH
For data protection enquiries or to exercise your rights, please contact us using the details above.
3. Information We Collect
3.1 Information You Provide
- Account Information: Email address (required), name, phone number (optional)
- Order Information: Shipping address, billing address, order history
- Contact Form Submissions: Name, email, subject, message
- Profile Updates: Changes to your name, phone, addresses
3.2 Information Collected Automatically
- Authentication Data: OAuth provider (Google, Apple, Microsoft, Facebook), authentication tokens
- IP Address: Temporarily collected for rate limiting and abuse prevention (retained for 1 hour)
- Session Data: Session tokens for maintaining your login state
- Shopping Cart Data: Items in your cart, associated with a session ID
3.3 Information We Do NOT Collect
- Payment card details (processed securely by SumUp)
- Passwords (we use OAuth authentication only)
- Browsing behavior or analytics tracking
- Marketing preferences or newsletter tracking
4. How We Use Your Information
We process your personal data for the following purposes:
- Order Processing: To fulfill your orders, process payments, and send order confirmations
- Customer Service: To respond to your enquiries and provide support
- Account Management: To create and maintain your account, including authentication
- Legal Compliance: To retain order records for 7 years as required by UK accounting law
- Security: To prevent fraud, abuse, and ensure platform security through rate limiting
- Service Improvement: To monitor system performance (no personal data)
5. Legal Basis for Processing (UK GDPR)
We process your personal data under the following legal bases:
- Contract Performance: Processing orders, account management, and customer support
- Legal Obligation: Retaining order records for 7 years (UK Companies Act 2006)
- Legitimate Interests: Fraud prevention, security, and service improvement
- Consent: Where you have explicitly opted in (e.g., contact form submissions)
6. Sharing Your Information
We share your personal data only with the following third parties:
6.1 Payment Processing
SumUp: Payment amounts are sent to SumUp for processing. We do NOT send your email, name, or address to SumUp. Their privacy policy: sumup.com/privacy
6.2 Authentication Providers
When you sign in with OAuth, we receive your email and name from:
- Google: Privacy Policy
- Apple: Privacy Policy
- Microsoft: Privacy Policy
- Facebook: Privacy Policy
6.3 We Do NOT Share Data With
- Marketing or advertising platforms
- Analytics services (no Google Analytics, etc.)
- Social media platforms (except for OAuth sign-in)
- Third-party sellers or affiliates
7. Data Retention
| Data Type | Retention Period | Reason |
|---|---|---|
| Active user accounts | Until deletion requested | Account ownership |
| Order data | 7 years (anonymized after deletion request) | UK accounting law (Companies Act 2006) |
| Abandoned shopping carts | 30 days | Session management |
| Unpaid orders | 90 days | Payment processing window |
| IP addresses (rate limiting) | 1 hour | Abuse prevention |
| Contact form emails | Admin discretion | Customer support |
Important: When you request account deletion, your personal information is anonymized in our order records. Orders are retained for 7 years with all personal identifiers replaced with "[DELETED]" and a random UUID, in compliance with UK tax law.
8. Your Rights (UK GDPR)
You have the following rights regarding your personal data:
8.1 Right to Access (Article 15)
View and download your personal information via your account settings page.
8.2 Right to Rectification (Article 16)
Update your name, phone, and addresses in your account settings.
8.3 Right to Erasure / Right to Be Forgotten (Article 17)
Request account deletion via your account settings. You will have a 7-day grace period to cancel the request. After admin approval:
- Your account is anonymized (name becomes "[DELETED]", email becomes a random UUID)
- All personal information is removed from orders (required for 7-year retention by UK law)
- Shipping/billing addresses are deleted
- Phone numbers are removed
8.4 Right to Data Portability (Article 20)
Contact us to receive a copy of your data in a structured, machine-readable format (JSON/CSV).
8.5 Right to Object (Article 21)
Object to processing based on legitimate interests by contacting us.
8.6 Right to Restrict Processing (Article 18)
Request restriction of processing in certain circumstances.
8.7 Right to Withdraw Consent
Where processing is based on consent, you can withdraw it at any time.
To exercise your rights: Email us at [email protected] or use the account settings page. We will respond within 30 days.
9. Data Security
We implement industry-standard security measures to protect your personal data, including encryption for data in transit and at rest, secure OAuth authentication, CSRF protection, rate limiting, and PCI-DSS compliant payment processing. We never store payment card details or passwords.
10. Cookies
We use the following cookies:
10.1 Essential Cookies
- Session Cookie: Managed by NextAuth.js to maintain your login state (7-day expiry)
- Cart Session Cookie: Links your shopping cart to your session (session expiry)
10.2 We Do NOT Use
- Advertising cookies
- Analytics cookies (no Google Analytics)
- Social media tracking cookies
- Third-party marketing cookies
Essential cookies are necessary for the website to function and cannot be disabled. By using our site, you consent to these essential cookies.
11. International Data Transfers
Your data is primarily stored in the EU region. Some service providers may process data in the US under standard contractual clauses or adequacy decisions.
12. Children's Privacy
Our services are not intended for individuals under 18 years of age. We require age verification for CBD product purchases. We do not knowingly collect personal information from children.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of our services after changes constitutes acceptance of the updated policy.
14. Contact Us & Complaints
For privacy-related enquiries, to exercise your rights, or to make a complaint:
Email: [email protected]
Address: 2 George Street, Brighton East Sussex BN2 1RH
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):
ICO Website: ico.org.uk/make-a-complaint
ICO Helpline: 0303 123 1113
Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Microsoft Azure AD / OAuth Integration
When you sign in with Microsoft, we receive only your email address and name from your Microsoft account. We do not access your Microsoft calendar, files, or other Microsoft services. Your Microsoft account credentials are never shared with us.
For Microsoft's privacy practices, see: privacy.microsoft.com