This privacy policy explains how Citrus-Lime Ltd and its affiliated entities collect, use, disclose, and protect your personal data. It is designed to comply with the UK General Data Protection Regulation (UK GDPR), EU GDPR, and relevant U.S. state privacy laws, including the California Consumer Privacy Act (CCPA), where applicable.
How we collect your information
We collect our information from a variety of sources:
Individuals: Information you freely provide us when you sign up to our service, speak with our staff, or contact us in any way.
Automated technologies or interactions through use of service: As you interact with our product, website and service provisions, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies.
Third Parties: e.g. Credit Record Agencies & via Open Source means (usually Internet).
We may also collect basic visit information such as the web page you came from (referrer), pages you visited before completing a form, and UTM tracking parameters from the URL (e.g. source, medium, campaign) to understand how users find us. Your IP address may be collected and stored to help us detect spam, troubleshoot technical issues or understand general location at a city or regional level. This information is used solely for internal analysis and is not shared with third parties for advertising purposes.
1. Who We Are
This policy applies to the following entities:
Citrus-Lime Ltd
A private limited company incorporated in England and Wales (Company No. 03792454)
Registered Address: Lantern House, The Ellers, Ulverston, Cumbria, LA12 0AA, United Kingdom
Phone: +44 (0)1229 588 628
Citrus-Lime, Inc.
A corporation registered and incorporated in the State of Delaware, USA
Registered Address: 251 Little Falls Drive, Wilmington, DE 19808, USA
Phone: +1 617 927 9550
Citrus-Lime Global Ltd
A company registered in Ireland
Registered Address: 77 Camden Street Lower, Dublin, Dublin, D02 Xe80, Ireland
Phone: +44 (0)1229 588 628
These entities are separate legal persons. For the purposes of data protection, Citrus-Lime Ltd is the primary data controller for services provided from the UK. Citrus-Lime, Inc. and Citrus-Lime Global Ltd may act as independent or joint data controllers, depending on the services you engage with.
Citrus-Lime Global Ltd is a wholly owned subsidiary of Citrus-Lime Ltd, created to facilitate services to customers in Europe and the rest of the world. It is a non-staffed legal entity, and all data processing, control, and service provision are handled by Citrus-Lime Ltd in the United Kingdom.
2. Purpose and Scope
This policy applies to personal data collected during the provision of services by Citrus-Lime Ltd and its affiliated entities, with a core focus on services managed and delivered from the UK.
We collect and process personal data for:
- Service delivery and fulfilment
- Business communications
- Customer support
- Marketing (with consent or on the basis of legitimate interests, as applicable)
- Legal and regulatory compliance
- Business insights and service improvements
- AI-assisted marketing analytics and customer segmentation (see Section 3)
This policy applies to customers, partners, and users in all jurisdictions where we operate, including the UK, Europe, United States, Australia, and New Zealand.
3. How Data Is Used:
Personal information we hold may be used and disclosed only for the following purposes:
Service Provision: We use your information to provide the product and service requested from us.
Keep you up to date: We will contact you to inform you about updates, improvements, and temporary issues affecting our service.
Sales, Marketing and Promotion: We want our customers to have the best service we offer. We will promote additional products and services we believe will be of benefit, based on the information we have available. We will promote to potential, existing and former customers. Consent can be withdrawn at any time; please contact us if you require to do this.
Recommendations: We have a wealth of experience in industry and we will use the knowledge gathered to make recommendations to our customers and share lessons learned. We want all our customers to succeed, and if we can help we will. This knowledge sharing will not include confidential and personal data.
Invoicing: Sending invoices, receipts, delinquency notifications, and requests for information. We use third party secure accounting systems to process this information.
Meet Legal Requirements.
Staff Administration: This includes human resource related matters, performance monitoring and work allocation.
To provide support, and improve the Services we offer: Data collected will be used by us to analyse how we can improve what we do. Historic information can be kept to reference only by ourselves when developing further products in the future.
AI-Assisted Analysis: We may use artificial intelligence tools to analyse customer data to generate marketing insights, customer segmentation, and service analytics. Where personal data is processed in this way, it is submitted to a third-party AI service provider acting as our data processor. That provider processes data only on our documented instructions, does not use it to train AI models, and does not share it with third parties. See Section 4 for details of our AI service providers and Section 7 for information on international transfers.
4. Data Sharing
We operate a central CRM system that consolidates customer data from all countries in which we operate, including the UK, Ireland, and the United States. This system is accessible by staff employed by both Citrus-Lime Ltd (UK) and Citrus-Lime, Inc. (USA) for the purposes of service delivery, customer support, sales, and marketing. All staff with access to the CRM are subject to appropriate confidentiality obligations and access is restricted on a need-to-know basis.
We share personal data with the following categories of third parties:
- Integration service providers
- Courier and despatch partners
- Suppliers and retail distributors (where agreed)
- IT and cloud service providers
- Marketing agencies
- Accounting and payment processing platforms
- AI and machine learning service providers (where used for internal analytics and customer insight purposes)
- Legal counsel and courts
- Regulatory bodies and law enforcement (where legally required)
- Data destruction providers
Where we use AI tools to process personal data, those providers are subject to data processing agreements that require them to process data only on our instructions, maintain appropriate security standards, and not retain or use data beyond the scope of the service provided.
Where services are delivered to customers of Citrus-Lime, Inc., personal data may be shared with Citrus-Lime Ltd and its UK-based staff to enable effective service provision, customer support, and administrative functions. All such transfers are protected by appropriate safeguards, including internal policies and access controls.
5. California Privacy Rights (CCPA/CPRA Compliance)
If you are a resident of California, you are granted specific rights regarding your personal data under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
Your Rights Include:
Right to Know: You have the right to request disclosure of the categories and specific pieces of personal information we collect about you.
Right to Access: You may request access to your personal data in a portable format.
Right to Delete: You may request that we delete your personal data, subject to certain exceptions.
Right to Correct: You may request that we correct inaccurate personal information.
Right to Limit Use of Sensitive Personal Information: If applicable, you may restrict our use of sensitive personal data.
Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
6. What We Collect for U.S. Entities:
For U.S.-based customers and partners, including those interacting with Citrus-Lime, Inc., we may collect:
- Contact information (name, business email, phone)
- Billing and shipping details
- Business entity information
- Details of Persons of Significant Control (where applicable, for verification and due diligence)
- Technical usage data (via cookies, logs, etc.)
We do not sell or share your personal information with third parties for cross-context behavioural advertising. Therefore, the “Do Not Sell or Share My Personal Information” notice does not apply to our operations.
Customer data collected in connection with U.S. operations is held in our central CRM system, which is also accessible by UK-based staff of Citrus-Lime Ltd for service delivery and support purposes. See Section 7 for the safeguards governing this transfer.
7. International Data Transfers
We operate across multiple jurisdictions and personal data may be transferred internationally in the following circumstances:
EU/Ireland to UK: We rely on the UK adequacy decision issued by the European Commission.
US to UK (intra-group, CRM access): Customer data collected by Citrus-Lime, Inc. is accessible by Citrus-Lime Ltd’s UK-based staff via our central CRM system. We use appropriate safeguards for this transfer, including Standard Contractual Clauses (SCCs) and internal data sharing agreements, to ensure a lawful basis for the transfer under UK GDPR.
UK to US (AI service providers): Where we use AI tools to analyse customer data, personal data may be transferred to and processed by providers whose infrastructure is based in the United States. We rely on Standard Contractual Clauses incorporating the ICO’s International Data Transfer Addendum (UK IDTA) as the appropriate safeguard for these transfers under UK GDPR Article 46.
EU/Ireland to US (AI service providers): For processing that falls within the scope of EU GDPR, we rely on Standard Contractual Clauses approved by the European Commission (Module Two, controller to processor) as the appropriate safeguard for transfers of personal data to third countries.
8. Your Rights & How to Contact Us
All data subjects, regardless of jurisdiction, are entitled to the following rights. To exercise any of these rights or raise questions, please contact our Data Protection Officer using the details below.
- The right to be informed – This privacy notice aims to do this, but if you require further clarification or information please do contact us.
- The right of access – If you would like access to the data we hold you can request this.
- The right to rectification – Should any data we hold be incorrect we are happy to rectify this for you.
- The right to erasure.
- The right to restrict processing – You can update consent by contacting us.
- The right to data portability – We can provide information to allow you to easily use other service providers.
- The right to object – Including the right to object to processing carried out for marketing or profiling purposes.
- Rights in relation to automated decision making and profiling – We do not make solely automated decisions that produce legal or similarly significant effects on individuals. However, we may use AI tools to carry out profiling of customer data for marketing analytics purposes. You have the right to object to this processing.
Data Protection Officer contact details:
Email: privacy@citruslime.com
Phone: +44 (0)1229 588 628
Mail: Citrus-Lime Ltd, Lantern House, The Ellers, Ulverston, Cumbria, LA12 0AA, United Kingdom