Last updated: August 2026

1. Who we are

IronStep is a trading brand of Astflick Group Ltd.

For the purposes of UK data protection law, Astflick Group Ltd is the data controller responsible for personal information processed through IronStep.

Astflick Holdings Ltd owns certain intellectual property associated with the IronStep brand. This does not change the identity of Astflick Group Ltd as the controller of customer personal data processed through IronStep unless you are specifically told otherwise.

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation and Data Protection Act 2018.

2. Personal information we collect

Identity and contact information

• Name
• Billing address
• Delivery address
• Email address
• Telephone number

Order and transaction information

• Products ordered
• Order history
• Returns, refunds and customer-service history
• Payment and transaction references

Payment-card information is generally processed by our payment providers rather than stored directly by IronStep, subject to the operation of the payment service used.

Technical and website information

• IP address
• Browser and device information
• Pages viewed and website interactions
• Cookie and similar technology identifiers
• Approximate location derived from technical information where applicable

Business customer information

Where you deal with IronStep on behalf of a business or organisation, we may also process:

• Company or organisation name
• Job title or role
• Business email address and telephone number
• VAT and company information
• Purchase-order and account information
• Credit-account information
• Information required for credit assessment, guarantees or debt recovery where applicable

3. How we collect your information

We may collect personal information directly from you when you:

• Place an order
• Create or use a customer or business account
• Contact IronStep
• Submit a website form
• Request a quotation
• Return a product or make a complaint
• Subscribe to marketing communications

We may also receive information automatically through cookies, analytics technologies, payment systems, fraud-prevention services, delivery partners and other service providers used to operate the website and fulfil orders.

4. Why we use your information

We may process personal information for the following purposes:

• Processing, fulfilling and delivering orders
• Taking and administering payments
• Providing customer support
• Managing returns, refunds and exchanges
• Managing business and credit accounts
• Responding to enquiries and quotations
• Preventing fraud, misuse and security threats
• Operating and improving the IronStep website
• Maintaining accounting, tax and business records
• Establishing, exercising or defending legal claims
• Sending permitted marketing communications

5. Lawful bases for processing

The lawful basis we rely upon depends on the particular processing activity.

Where we rely on legitimate interests, we consider whether our interests are balanced against your rights and freedoms.

6. Marketing communications

We may send you marketing communications where you have consented or where applicable law otherwise permits us to do so.

You can unsubscribe at any time by using the unsubscribe link in a marketing email or by contacting hello@ironstep.co.uk.

Unsubscribing from marketing does not prevent us from sending transactional or service communications relating to an order, account, return or enquiry.

7. Who we share information with

We may share personal information with service providers and professional advisers where reasonably necessary to operate IronStep.

This may include:

• Payment processors and payment-service providers
• Shopify and website/hosting providers
• Courier, postal and fulfilment partners
• IT, security, analytics and support providers
• Accountants and auditors
• Legal advisers
• Credit insurers and credit-reference services where applicable
• Debt-recovery providers for overdue business debts
• Government, regulatory and law-enforcement bodies where required

We require service providers to process personal information appropriately and only for authorised purposes.

8. Astflick group companies

Personal information may be shared between Astflick Group Ltd and Astflick Holdings Ltd where reasonably necessary for legitimate administrative, intellectual-property, compliance or corporate purposes.

This does not permit unrestricted use of personal information and all such processing remains subject to applicable data protection law.

9. International transfers

Some technology, payment, ecommerce or other service providers may process personal information outside the United Kingdom.

Where UK data protection law requires safeguards for an international transfer, we seek to rely on an appropriate lawful transfer mechanism, which may include an adequacy regulation, approved contractual protections or another legally recognised safeguard.

10. Data retention

We retain personal information for no longer than reasonably necessary for the purposes for which it was collected, including legal, accounting and dispute-resolution requirements.

Typical retention considerations include:

• Order and accounting records may be retained for up to 6 years or another period required by law
• Business-account records may be retained for the lifetime of the account and an appropriate period afterwards
• Customer-service and dispute records may be retained where necessary to establish or defend legal rights
• Marketing information may be retained until you unsubscribe, withdraw consent where applicable, or it is no longer reasonably required

11. Cookies and similar technologies

IronStep uses cookies and similar technologies to operate the website, remember preferences, understand website usage, measure performance and, where permitted, support advertising and marketing.

Where required, non-essential cookies are used in accordance with your cookie preferences.

You can manage available cookie choices through the cookie controls presented on the IronStep website and through your browser settings.

Further information about individual cookies and tracking technologies may be provided through our cookie settings or cookie policy.

12. Data security

We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or misuse.

Measures may include access controls, secure ecommerce infrastructure, encrypted connections and the use of established payment and technology providers.

No electronic system can be guaranteed to be completely secure.

13. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights including:

• The right to be informed about how your information is used
• The right of access to your personal information
• The right to request correction of inaccurate information
• The right to request erasure in applicable circumstances
• The right to request restriction of processing
• The right to object to certain processing
• The right to data portability in applicable circumstances
• Rights relating to certain automated decisions where applicable

These rights are not absolute and exemptions may apply.

To make a request, contact hello@ironstep.co.uk.

We may need to confirm your identity before responding to a request.

14. Automated decision-making and fraud checks

Payment providers, fraud-prevention providers or credit-related services may use automated systems when assessing transactions or business-account applications.

Where IronStep itself undertakes processing that gives rise to specific legal rights concerning automated decision-making, we will provide additional information where required.

15. Third-party websites

The IronStep website may contain links to third-party websites or services.

We are not responsible for the privacy practices of third parties. You should review their privacy information before providing them with personal information.

16. Children's information

IronStep is not intended to knowingly collect personal information from children for independent purchasing purposes.

If you believe a child has provided us with personal information inappropriately, please contact us.

17. Complaints

If you have concerns about the way IronStep has handled your personal information, please contact us first so that we have an opportunity to investigate.

You also have the right to raise a complaint with the UK Information Commissioner's Office where applicable.

18. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our operations, website, service providers or legal obligations.

The current version will be published on IronStep with an updated revision date.