Effective Date: 22 August 2026

Last Updated: 22 August 2026

Welcome to the Privacy Policy of The Coral Exchange Ltd ("we", "us", or "our"). We respect your privacy and are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy informs you about how we collect, use, store, and look after your personal data when you visit our website or interact with our services, and tells you about your privacy rights and how the law protects you.

The Coral Exchange Ltd is the data controller responsible for your personal data.

• Full Legal Company Name: The Coral Exchange Ltd
• Company Registration Number: 17178375 (Registered in England & Wales)
• Registered Address: 1 Bennetts Close, Bletsoe, Bedford, England, MK44 1QX
• Contact Email: info@tce.earth

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Personal data means any information about an individual from which that person can be identified. We may collect, use, store, and transfer different kinds of personal data about you, categorized as follows:

• Identity Data: First name, last name, username or similar identifier, title.
• Contact Data: Billing address, delivery address, email address, and telephone numbers.
• Financial Data: Payment card details and bank account information (processed securely via encrypted third-party payment providers).
• Transaction Data: Details about payments to and from you, as well as details of products or services purchased from us.
• Technical Data: IP address, login data, browser type and version, time zone setting, operating system, and platform.
• Usage Data: Information about how you interact with and use our website, products, and services.
• Marketing Data: Your preferences in receiving marketing communications from us and your communication choices.

We use different methods to collect data from and about you, including:

• Direct Interactions: You provide your Identity, Contact, and Financial Data by filling in forms, creating an account, making purchases, or corresponding with us by post, phone, or email.
• Automated Technologies: As you interact with our website, we automatically collect Technical Data about your device, browsing actions, and patterns via cookies and similar technologies.
• Third Parties: We may receive personal data about you from third parties, such as analytics providers (e.g., Google Analytics), payment gateways (e.g., Stripe, PayPal), and delivery service partners.

We will only process your personal data when permitted by law. Below are the specific purposes for which we use your data and the lawful bases relied upon:

• Customer Registration: We use Identity and Contact Data to register you as a new customer. Lawful Basis: Performance of a contract with you.
• Order Processing & Delivery: We use Identity, Contact, Financial, and Transaction Data to process payments, manage fees, and deliver goods or services. Lawful Basis: Performance of a contract with you; Necessary for our legitimate interests.
• Relationship Management: We use Identity, Contact, and Marketing Data to notify you of updates to our terms or privacy policy and provide customer support. Lawful Basis: Compliance with a legal obligation; Performance of a contract.
• Business Administration & Site Protection: We use Identity, Contact, and Technical Data to troubleshoot issues, conduct data analysis, and maintain server security. Lawful Basis: Necessary for our legitimate interests (running our business and securing our network).
• Marketing Communications: We use Identity, Contact, and Marketing Data to deliver relevant updates and promotional offers (where opted in). Lawful Basis: Consent; Legitimate interest (for existing customers).

We may share your personal data with trusted third parties for business operations, including:

• Third-party service providers acting as processors (IT hosting platforms, payment gateways, couriers, and delivery companies).
• Professional advisers, including lawyers, auditors, bankers, and insurers.
• HM Revenue & Customs (HMRC), regulatory authorities, and public law enforcement bodies.

All third parties are legally obligated to respect the security of your personal data and treat it in accordance with data protection legislation.

Whenever we transfer your personal data outside the UK, we ensure a similar degree of protection is afforded by applying at least one of the following safeguards:

• Transferring to countries approved by the UK government as providing an adequate level of data protection.
• Utilising standard contractual clauses approved for use in the UK which grant personal data equivalent protection.

We have implemented technical and organizational security measures to protect your personal data against accidental loss, unauthorized access, alteration, or disclosure. Access is restricted to authorized personnel and partners on a strict need-to-know basis.

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including satisfying legal, accounting, or statutory reporting obligations (such as keeping tax and transaction records for 6 years following year-end under UK tax law).

Under UK data protection laws, you possess the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data where there is no legal reason for us to retain it.
• Right to Object: Object to processing where we rely on legitimate interests or use data for direct marketing.
• Right to Restriction: Request suspension of data processing under specific conditions.
• Right to Data Portability: Request transfer of your data to yourself or a third party in a structured format.
• Right to Withdraw Consent: Withdraw consent at any time where processing relies on consent.

Our website may contain links to third-party websites or services. We do not control third-party privacy policies. For complete details on tracking technologies used on our site, please view our separate Cookie Policy.