WaterRower (UK) Ltd (company number 02595975) ("WaterRower", "we", "us" or "our") is the controller of the personal data described in this Policy. We operate the UK WATERROWER | NOHRD website and sell WATERROWER and NOHRD products and services.

This Privacy & Security Policy explains how we collect, use, store and disclose personal data when you visit our website, purchase or enquire about a product, create an account, register a product, apply for customer finance, contact us, request customer or warranty support, visit one of our locations or subscribe to email marketing.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Personal data we collect

Personal data is information relating to an identified or identifiable individual.

We may collect and use the following categories of personal data:

Category Examples How we use it
Contact and account information	Name, email address, telephone number, billing address, delivery address, account details and login credentials	To manage accounts, communicate with you and provide customer service
Transaction information	Products purchased, order history, payment status, returns, refunds, deliveries and warranty information	To process orders, payments, VAT, deliveries, returns and warranties
Payment and finance information	Payment method, billing details, transaction information and information relating to a finance application	To process payments and refunds, provide payment or finance options and help prevent fraud
Internet and device information	IP address, browser, device type, pages visited, links selected, shopping activity, referring website and cookie identifiers	To operate and secure the website, analyse performance and measure advertising
Approximate location	General location derived from your IP address	To provide relevant website content, prevent fraud and measure website activity
Customer service information	Enquiries, correspondence, product serial numbers and photographs or videos you send to us	To provide customer service, technical support and warranty assistance
Professional information	Company name, job title and business contact details	To respond to commercial enquiries and manage business relationships
Preferences and inferences	Product interests and preferences inferred from website, enquiry or purchasing activity	To understand customer interests and, where permitted, personalise content or marketing

Payment card information is processed securely by our payment providers. WaterRower does not generally receive or store complete payment card numbers.

We do not generally seek to collect special category data, such as health information. If we need to collect special category data, we will identify an appropriate legal basis and condition for processing it. Please do not send special category data in customer service correspondence unless it is reasonably necessary for us to assist you.

2. How we collect personal data

We collect personal data:

• directly from you, including through our website, checkout, forms, email, telephone, website chat, showrooms and other in-person interactions;
• automatically through our website, cookies, pixels and similar technologies;
• from Shopify and applications connected to our store;
• from payment, customer-finance, fulfilment, delivery and tax providers;
• from advertising, analytics and customer service providers;
• from WaterRower-affiliated companies, distributors, retailers or service partners where necessary to complete an order or provide support; and
• from publicly available sources, professional networks or business contacts where relevant to a commercial relationship.

Where we request personal data, some fields may be required. If you do not provide information needed to enter into or perform a contract, we may be unable to process your order, deliver a product, provide finance options, manage your account or provide warranty assistance.

We hold personal data electronically and, in some cases, in physical records. Electronic data may be held in systems operated by us or by service providers on our behalf.

3. How we use personal data and our lawful bases

We only use personal data where we have a lawful basis. The lawful basis depends on the purpose and circumstances.

Purpose	Personal data commonly used	Lawful basis
Processing enquiries, orders, payments, deliveries, returns and refunds	Contact, account, transaction and payment information	Performance of a contract or steps requested before entering into a contract
Managing accounts, product registrations, warranties, servicing and customer support	Contact, account, transaction and customer service information	Performance of a contract; legitimate interests in providing support and managing customer relationships
Providing payment or customer-finance options	Contact, transaction, payment and finance information	Performance of a contract or steps requested before entering into a contract; legitimate interests in facilitating payment and preventing fraud
Accounting, VAT, product safety, recalls and other legal requirements	Contact, transaction, payment, delivery and warranty information	Compliance with legal obligations; legitimate interests in maintaining accurate records and protecting customers
Operating, maintaining and securing our website and systems	Account, device, internet, approximate location and transaction information	Legitimate interests in operating our business, ensuring network and information security, preventing misuse and protecting customers
Detecting and preventing fraud and managing disputes or legal claims	Contact, account, transaction, payment, device and customer service information	Legitimate interests in preventing fraud, protecting our business and customers, and establishing, exercising or defending legal claims; compliance with legal obligations where applicable
Website analytics, non-essential cookies and personalised advertising	Device, internet, approximate location, cookie identifiers, preferences and inferences	Consent where required by PECR and UK data protection law
Email marketing	Contact information, marketing preferences, transaction information and product interests	Consent, or legitimate interests where PECR permits us to use the existing-customer "soft opt-in"
Managing commercial relationships and responding to business enquiries	Contact and professional information, enquiries and correspondence	Legitimate interests in developing and managing our business relationships; steps requested before entering into a contract
Improving our products, services, website and customer experience	Transaction, website activity, preferences, enquiries and customer service information	Legitimate interests in understanding and improving our business; consent where information is obtained through technologies requiring consent

Our legitimate interests include operating and improving our business, fulfilling customer expectations, securing our systems, preventing fraud, managing commercial relationships, understanding the effectiveness of our services and marketing, and protecting our legal rights. Where we rely on legitimate interests, we consider whether our interests are overridden by your rights and freedoms.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before consent was withdrawn.

If we wish to use personal data for a materially different purpose, we will provide appropriate information and, where required, obtain consent or identify another lawful basis.

4. Cookies and advertising technologies

We use cookies, pixels and similar technologies to:

• provide essential website and checkout functions;
• remember website preferences;
• provide website chat;
• understand how visitors use our website;
• measure advertising performance; and
• display advertising that may be relevant to your interests.

Providers currently used in connection with these activities include Google Analytics, Google Ads, Meta, Klaviyo and Tidio.

Strictly necessary technologies are used because they are needed to provide the website or a service you request. Where consent is required, analytics, advertising and other non-essential technologies will not be used until you have made your choice.

You can accept, reject or manage non-essential technologies through Cookie Preferences on our website. You can change your selection at any time. You can also adjust your browser settings to block or delete cookies, although this may affect website functionality.

More detailed information about the technologies used, their purposes and duration should be provided through our cookie preference tool or Cookie Policy.

5. How we disclose personal data

WaterRower does not sell customer data for money and does not provide customer data to unrelated third parties for their own independent marketing.

We disclose personal data only where reasonably necessary to operate our website, complete a sale, provide customer service, manage our business or meet legal obligations. Recipients may include:

• Shopify and connected ecommerce providers for website hosting, checkout, accounts and order management;
• payment providers, customer-finance providers and financial institutions for payments, refunds, fraud prevention, identity checks, eligibility or credit assessment and transaction processing;
• ShipStation, delivery carriers, warehouses and fulfilment providers for processing and delivering orders;
• Klaviyo for email communications;
• Tidio for website chat and customer service;
• Google Analytics for website analytics;
• Google Ads and Meta for advertising and campaign measurement;
• WaterRower-affiliated companies, distributors, retailers and authorised service partners where required to fulfil an order, provide support or administer a warranty;
• professional and technology providers supporting our legal, accounting, security and business operations;
• a purchaser, adviser or other relevant party in connection with a proposed or completed sale, merger or restructuring of all or part of our business; and
• government bodies, regulators, courts, law enforcement or other parties where required by law or reasonably necessary to protect our legal rights.

Customer service telephone calls are not recorded.

If you choose a payment or customer-finance service, its provider may process personal data as a separate controller under its own privacy notice. The provider may conduct identity, affordability, credit or fraud checks and is responsible for its own approval decisions.

6. International transfers

Some of our affiliated companies and service providers are located outside the United Kingdom. Personal data may therefore be transferred to and processed in other countries.

Likely destination countries include the United States, Canada, Germany, Australia, Poland and Singapore. Providers may also use personnel or subprocessors in other countries.

Where required, we protect restricted transfers using an applicable UK adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the European Commission's Standard Contractual Clauses, or another lawful transfer mechanism. We also apply supplementary measures where appropriate.

You may contact us for further information about the safeguards applying to a particular transfer and, where available, to request a copy of the relevant safeguards.

7. Email marketing

We may send you email marketing where you have consented or where PECR permits us to rely on the existing-customer soft opt-in. We will only use the soft opt-in for our own similar products or services, and only where you were offered a clear opportunity to opt out when your details were collected.

You can opt out at any time by selecting the unsubscribe link in an email or contacting us. We will stop sending marketing as soon as reasonably practicable. We may keep a minimal suppression record to ensure that we respect your request.

We may continue sending non-marketing messages concerning orders, deliveries, accounts, warranties, finance arrangements, product safety, recalls or customer service.

8. Automated processing and finance decisions

We and our service providers may use automated tools to detect fraud, assess transaction or account risk, secure the website and personalise content or advertising. These tools may use contact, transaction, payment, device and website activity information.

Automated fraud or risk checks may cause a transaction to be declined, delayed or referred for review. Payment and customer-finance providers may also carry out automated identity, credit, affordability, eligibility or fraud assessments under their own privacy notices.

Where we make a significant decision based solely on automated processing, we will apply the safeguards required by law. Depending on the circumstances, these may include providing information about the decision, allowing you to make representations, enabling meaningful human intervention and allowing you to challenge the decision.

You may contact us if you would like more information about automated processing relating to your order.

9. Your data protection rights

Depending on the circumstances, you may have the right to:

• receive information about how we use your personal data;
• request access to personal data we hold about you;
• ask us to correct inaccurate or incomplete data;
• request deletion of your personal data;
• ask us to restrict how we use your personal data;
• receive certain personal data in a structured, commonly used and machine-readable format and ask us to transfer it to another organisation;
• object to processing based on legitimate interests;
• object at any time to the use of your personal data for direct marketing;
• withdraw consent at any time where processing is based on consent; and
• exercise rights relating to certain significant automated decisions.

These rights are not absolute and may be subject to legal conditions and exemptions. For example, we may retain information required to complete an order, provide warranty support, maintain tax and accounting records, prevent fraud or defend legal claims.

To exercise a right, contact us using the details in section 17. We may request information reasonably necessary to confirm your identity and understand your request. We will normally respond without undue delay and within one month, although the law may allow additional time for a complex request or multiple requests.

There is normally no charge. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.

10. Privacy complaints

If you have concerns about how we handle your personal data, please contact us using the details in section 17 or use the contact form on our website. Please provide enough information for us to understand and investigate your concern.

We will acknowledge a data protection complaint as soon as reasonably practicable and no later than 30 days after receiving it. We will investigate and respond without undue delay, keep you informed where appropriate and explain the outcome of our investigation.

If you are not satisfied with our response, you may complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

The ICO will usually expect you to raise your concern with us first.

11. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy, including to meet legal, regulatory, tax, accounting and reporting requirements.

The retention period depends on:

• the duration of our relationship with you;
• order, delivery and payment requirements;
• product warranty and service periods;
• customer-finance and transaction requirements;
• tax, accounting and legal obligations;
• fraud-prevention and security requirements; and
• applicable legal limitation periods.

We may retain personal data for longer where a complaint, dispute or legal claim is active or reasonably anticipated. When personal data is no longer required, we will delete, anonymise or securely dispose of it.

12. Security

We use appropriate technical, organisational and physical measures designed to protect personal data from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Depending on the data and the relevant system, these measures may include access controls, authentication controls, encryption in transit, staff procedures, service-provider reviews, system monitoring, backups and incident-response processes.

Payment card data is handled by specialist payment providers. You are responsible for keeping your account password confidential and should contact us promptly if you believe your account or personal data has been compromised.

No internet transmission or electronic storage system is completely secure, and we cannot guarantee absolute security.

13. Personal data breaches

If we become aware of a suspected personal data breach, we will assess, contain and respond to it in accordance with our legal obligations.

Where a breach is likely to result in a risk to individuals' rights and freedoms, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it. Where a breach is likely to result in a high risk, we will also notify affected individuals without undue delay, unless an exception applies.

14. Children's privacy

Our website purchasing services are intended for adults and are not directed to children.

We do not knowingly collect personal data online from children under 16 without appropriate involvement from a parent or guardian where required. If we learn that we have collected a child's personal data inappropriately, we will take reasonable steps to delete or anonymise it. A parent or guardian who believes a child has provided personal data to us should contact us.

15. Third-party websites and services

Our website may link to third-party websites or services. Their privacy practices are governed by their own privacy notices, and we are not responsible for how they handle personal data.

16. Changes to this Policy

We may update this Policy to reflect changes to our website, providers, practices or legal obligations.

We will publish the updated Policy on this page and change the "Last updated" date. Where required, we will provide additional notice or obtain consent.

17. Contact us

WaterRower (UK) Ltd
Attn: Privacy
Company number: 02595975
Unit 4, The Valley Centre
Gordon Road
High Wycombe
Buckinghamshire HP13 6EQ
United Kingdom

Email: info@waterrower.co.uk
Telephone: +44 (0)20 8749 9090