Data Governance

Privacy Policy

Last updated: September 2026 · Mountains Research

PAYMENT SECURITY AND ZERO ACCOUNT PHILOSOPHY:Mountains Research does not operate customer user accounts and does not store customer passwords. Furthermore, all payments are conducted exclusively through Fena Open Banking. No payment card numbers, CVVs, or bank passwords ever touch our servers.

1. Data Controller

Mountains Research operates as the data controller for personal data collected through this website pursuant to the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

2. Categories of Information We Collect

Because customer accounts are disabled, we collect only the minimal data required to execute your order:

Order and Fulfilment Data: Customer name, shipping address, contact email, telephone number, line items, and generated order reference.
Payment Identifiers: We store only external transaction identifiers (e.g., Fena payment ID and callback confirmation timestamp) for audit and reconciliation.
Technical logs: Standard web server connection logs, IP addresses, and security session metadata retained for fraud mitigation and service uptime.

3. Fena Open Banking Payment Architecture

All financial authorizations are executed via Fena, an Open Banking payment institution regulated by the UK Financial Conduct Authority (FCA).

When initiating checkout, your order reference and amount are conveyed to Fena. You are redirected to your bank's authenticated interface to authorize the direct bank-to-bank transfer. Mountains Research never has access to your online banking username, password, or two-factor authentication tokens.

4. Sharing with Fulfilment Partners

To pick, pack, and deliver your supplies, order details are shared strictly with:

Royal Mail Click & Drop: Your name, delivery address, phone number, and email are transmitted via the Click & Drop API to print shipping documentation and provide tracking.
Statutory Authorities: Where disclosure is mandated by applicable UK law or regulatory request.

5. Retention and Researcher Rights

Order records and transaction manifests are retained for statutory accounting and VAT compliance purposes (typically 6 years under UK law). Under UK GDPR, you have the right to request access to your records, rectification of inaccuracies, and restriction of processing where applicable.

To exercise your statutory data protection rights, please contact the Mountains Research compliance team at compliance@mountainsresearch.co.uk.