Legal

Privacy policy

This policy sets out what personal data Gazian Ltd holds about you, why we hold it, who else processes it on our instructions, and what you can ask us to do with it. It covers gazianwater.com and any order placed through it.

Last updated 31 July 2026

Who is responsible for your data

Gazian Ltd is the data controller for personal data collected through gazianwater.com. That means we decide what is collected and why, and we are answerable for it.

Email ashraf@hajimail.com with "Privacy" in the subject line for anything in this policy, including a request to see, correct or delete your data.

What we collect

We collect what an order, an account or a support request actually needs, and nothing beyond it.

Contact details: your name, your email address, and your phone number if you give one.
Delivery details: the address you ask us to ship to, the recipient's name, and a delivery phone number where the carrier needs one.
Order details: what you bought, what you paid, the campaign you selected at checkout, your order number, and how the order's status changed over time.
Payment reference: an identifier issued by Stripe for your payment. We never receive or store your card number, expiry date or security code.
Sign-in data: one-time codes sent to your email or phone, session tokens, and the public key of any passkey you register. A passkey's private key never leaves your device.
Delivery tracking: the tracking number, the carrier, and the scan events reported for your shipment.
Linked account: if you connect an order to an AmalQ account, the identifier of that account.
Technical data: your IP address and browser details in our server logs.

We do not collect special category data, and we do not build advertising profiles.

Why we use it, and our lawful basis

UK GDPR requires a lawful basis for every use of your data. Ours are set out below.

To take your order, deliver it, and handle returns: performance of a contract with you.
To send order confirmations, dispatch notices and delivery updates: performance of a contract with you.
To sign you in and keep your account secure: performance of a contract, and our legitimate interest in preventing account takeover.
To stop fraud and automated abuse of checkout and sign-in: our legitimate interest in protecting the business and other customers.
To keep sales, VAT and accounting records: compliance with a legal obligation.
To answer a message you send us: our legitimate interest in replying to you.

We do not currently send marketing email. If that changes we will ask for your consent first, and you will be able to withdraw it at any time without affecting your orders.

Who else processes your data

A small number of providers process data on our instructions. Each receives only what it needs to do its job, and none of them may use it for their own purposes.

Stripe: payment processing. Your card details go to Stripe directly; we receive only a payment reference and the result.
EasyPost: shipping labels and tracking. Receives the delivery name, address and phone number.
Twilio: sends the one-time code if you choose to sign in by SMS. Receives your phone number.
Our email provider: sends one-time codes, order confirmations and delivery updates. Receives your email address and the contents of that message.
hCaptcha: checks that a sign-in request comes from a person rather than a script.
AmalQ: the platform holding the campaign records your order is settled against, and the account you can choose to link.

We do not sell your personal data, and we do not pass it to anyone for their own marketing.

Where your data is held

Your order data sits in our own database, on servers hosted in Europe.

Some of the providers listed above operate outside the United Kingdom, including in the United States. Where data leaves the UK we rely on the mechanisms UK law allows: an adequacy decision covering the country in question, or standard contractual clauses with the UK Addendum where no adequacy decision applies.

How long we keep it

We keep data for as long as the purpose it was collected for lasts, and then for as long as the law requires.

Order, payment and delivery records: six years after the end of the tax year the order falls in, because UK tax law requires it.
One-time sign-in codes: minutes. They expire and are then deleted.
Session and refresh tokens: until they expire or you sign out, whichever comes first.
Passkeys: until you remove the passkey or close your account.
Support messages: two years after the conversation ends.
Server logs: twelve months.

When a retention period ends we delete the data, or strip it of anything that could identify you.

Cookies and browser storage

We run no advertising trackers, and the site sets no marketing cookies. Nothing here follows you to another website.

We do count visits, using analytics software we run on our own server rather than a third party's. It sets no cookies and stores nothing on your device, so there is no banner here and nothing for you to accept or decline. It records the page address, where the visit came from, and a rough country and device type. We also record that certain things happened, such as a trade enquiry sent or a sign-in attempted, but never what you typed into a form: no name, email, phone number, company or message ever reaches it.

We also record how the page is used: mouse movement, clicks, scrolling and how the layout responded. This is what produces the heatmaps and session replays we use to find broken and confusing screens. It is captured with masking switched on at the strictest setting, which replaces every input value and every piece of text before anything leaves your browser. A replay shows the shape of the page and where you moved, never a word of what was on it or what you typed. Recordings are capped at ten minutes.

Your browser stores your sign-in session so that you stay signed in between visits. That is necessary for the service you asked for, so it does not require consent. Clearing your browser storage signs you out. Your language is carried in the web address, and the language you last read the site in is remembered in a small cookie so that typing gazianwater.com takes you back to it. If we offer you the site in another language and you close that offer, we note that too, so we do not ask again. Both are settings, not tracking: they hold a language and nothing else, and they are never used to identify you.

Your rights

Under UK GDPR you can ask us to do any of the following.

See a copy of the personal data we hold about you.
Correct anything that is wrong or incomplete.
Delete data we no longer have a lawful reason to keep. Records we must retain for tax purposes are the usual exception.
Restrict how we use your data while a dispute about it is resolved.
Receive the data you gave us in a portable, machine-readable form.
Object to processing we carry out under our legitimate interests.
Withdraw a consent you previously gave, at any time.

Email ashraf@hajimail.com to exercise any of these. We will respond within one month. If you are not satisfied with our answer you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.

How we protect it

The site is served over HTTPS. Card details never reach our servers. Sign-in uses one-time codes or passkeys rather than a reusable password, and sessions expire.

No system is beyond reach. If a breach ever affects your rights we will tell you and the Information Commissioner's Office within the time the law allows.

Children

Gazian Water is sold to adults. We do not knowingly collect data from anyone under 16. If you believe a child has given us their details, email ashraf@hajimail.com and we will delete them.

Changes to this policy

We update this page when what we do changes, and the date at the top changes with it. Where a change materially affects you, we will email customers with an open order.

Ask us anything about this

One address handles every privacy question, and every other kind of question too.

ashraf@hajimail.com