Home / Privacy Policy

Privacy Policy

EPS Services & Tooling Ltd customer privacy notice

This privacy notice tells you what to expect us to do with your personal information.

Contact details

Post
EPS Services & Tooling Ltd
Unit 2, Edwards Industrial Estate
Sandys Moor
Wiveliscombe
Taunton
Somerset
TA4 2TU
United Kingdom

Telephone
01984 624 273

Email
enquiries@eps-services.co.uk

What information we collect, use, and why

Providing services and goods, including delivery

We collect or use the following information:

  • Names and contact details
  • Addresses
  • Purchase or account history
  • Account information
  • Website user information, including user journeys and cookie tracking
  • Information relating to compliments or complaints

Operating customer accounts and guarantees

We collect or use the following information:

  • Names and contact details
  • Addresses
  • Purchase history
  • Account information, including registration details
  • Marketing preferences

Preventing, detecting, investigating or prosecuting crimes

We collect or use the following information:

  • Names and contact information
  • Customer or client accounts and records
  • Financial transaction information

Service updates or marketing

We collect or use the following information:

  • Names and contact details
  • Addresses
  • Marketing preferences
  • Purchase or viewing history
  • IP addresses
  • Website and app user journey information
  • Records of consent, where appropriate

Complying with legal requirements

We collect or use the following information:

  • Name
  • Contact information
  • Financial transaction information
  • Any other personal information required to comply with legal obligations

Dealing with queries, complaints or claims

We collect or use the following information:

  • Names and contact details
  • Address
  • Account information
  • Purchase or service history
  • Customer or client accounts and records
  • Financial transaction information
  • Correspondence

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

  • Your right of access: You have the right to ask us for copies of your personal information. You can request other information, such as details about where we get personal information from and who we share personal information with. There are some exemptions which mean you may not receive all the information you ask for.
  • Your right to rectification: You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
  • Your right to erasure: You have the right to ask us to delete your personal information.
  • Your right to restriction of processing: You have the right to ask us to limit how we can use your personal information.
  • Your right to object to processing: You have the right to object to the processing of your personal data.
  • Your right to data portability: You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
  • Your right to withdraw consent: When we use consent as our lawful basis, you have the right to withdraw your consent at any time.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for the collection and use of your data

Providing services and goods

Contract: We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Operating customer accounts and guarantees

Contract: We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legal obligation: We have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Preventing, detecting, investigating or prosecuting crimes

Legitimate interests: We’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

We use limited customer, account, transaction and technical information to prevent and detect fraud, unauthorised transactions and other unlawful activity. This helps protect our customers, our business and our payment systems from financial loss and misuse. We only use information that is relevant to assessing suspicious activity, and we limit access to staff and service providers who need it for this purpose. We consider this use necessary and proportionate because the benefit of preventing fraud and protecting customers outweighs the limited privacy impact, particularly as the information is not used for unrelated purposes.

For more information on our use of legitimate interests as a lawful basis, you can contact us using the contact details set out above.

Service updates or marketing

Consent: We have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you have the right to withdraw your consent at any time.

Legitimate interests: We’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

We use limited customer and website information to provide relevant service updates and, where permitted, marketing about products that may interest existing customers. This helps us keep customers informed about their orders, products, pricing and services. We only use information that customers would reasonably expect us to use, and we do not use it for unrelated purposes. Marketing communications include a clear way to opt out, and customers can object to direct marketing at any time. Where consent is required, such as for certain email marketing or advertising cookies, we rely on consent instead of legitimate interests. We consider this processing proportionate because it supports customer communication and business development while giving individuals clear control over whether they receive marketing.

For more information on our use of legitimate interests as a lawful basis, you can contact us using the contact details set out above.

Legal requirements

Legal obligation: We have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Dealing with queries, complaints or claims

Contract: We have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

Legal obligation: We have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Legitimate interests: We’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

We use relevant customer, order, correspondence and transaction information to respond to queries, investigate complaints, assess guarantee or refund requests, and establish, exercise or defend legal claims. This helps us resolve issues fairly, keep an accurate record of what happened and protect both customers and the business from error, misuse or unfounded claims. We only use information that is necessary for the particular enquiry or claim, restrict access to those who need it, and do not use it for unrelated purposes. We consider this processing proportionate because customers reasonably expect us to review their order history and communications when resolving a complaint or claim, and the benefit of reaching a fair and evidence-based outcome outweighs the limited privacy impact.

For more information on our use of legitimate interests as a lawful basis, you can contact us using the contact details set out above.

Where we get personal information from

  • Directly from you
  • Suppliers and service providers
  • Third parties

We may receive personal information from payment providers, delivery and courier companies, fraud-prevention and security providers, website hosting and ecommerce service providers, analytics services, advertising platforms, and other suppliers involved in processing orders, operating the website or supporting customer service. This may include transaction status, delivery updates, technical information, fraud-risk indicators and information about how people interact with our website or advertisements. We only use information received from third parties where it is relevant and lawful to do so.

How long we keep information

We keep personal information only for as long as necessary for the purposes described in this notice.

  • Customer and order records are normally kept for 7 years after the end of the relevant financial year to meet tax, accounting and legal obligations.
  • Customer account information is kept while the account remains active and for up to 7 years after account closure, unless a longer period is required by law.
  • Guarantee, returns, complaints and claims records are normally kept for 7 years after the matter is closed.
  • Customer service enquiries and correspondence that do not lead to a purchase or claim are normally kept for up to 2 years after the last contact.
  • Marketing records, including consent and unsubscribe records, are kept while marketing continues and for as long as necessary afterwards to demonstrate consent or honour an opt-out.
  • Website analytics, advertising and cookie-related information is kept in line with the retention periods set within the relevant platforms and is reviewed regularly.
  • Fraud-prevention, security and failed transaction records are kept only for as long as necessary to investigate and protect against fraud, normally for up to 2 years unless a longer period is needed for a legal claim or investigation.

We review retention periods regularly and securely delete or anonymise personal information when it is no longer required.

Who we share information with

Data processors

We share information with ecommerce, website hosting and IT service providers in the UK and other countries where their services are operated.

These providers host and operate our website and online shop, store customer and order information, provide website security, backups, technical support and related IT services, and process personal information only as needed to provide those services to us.

Others we share personal information with

  • Professional or legal advisers
  • Financial or fraud investigation authorities
  • Relevant regulatory authorities
  • Organisations we are legally obliged to share personal information with
  • Suppliers and service providers
  • PayPal for payment processing and fraud prevention
  • Royal Mail and FedEx for delivering orders and providing delivery updates
  • Distinctive for website hosting, technical support, security and backups
  • Mailchimp for email marketing where customers have subscribed or where marketing is otherwise permitted by law
  • Google Analytics for measuring website use and understanding how visitors interact with the website, where consent has been provided
  • Google Ads for measuring advertising performance, tracking conversions and displaying relevant advertising, where consent has been provided
  • Google Tag Manager for managing website analytics and advertising tags in accordance with visitors’ cookie consent choices
  • WooCommerce for operating our online shop, processing orders and managing customer and product information
  • WordPress for operating and managing the website and its content
  • Professional advisers, regulators and law-enforcement bodies where necessary to comply with the law or protect legal rights

Sharing information outside the UK

Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR and make sure appropriate safeguards are in place.

Mailchimp

Organisation name: Mailchimp, The Rocket Science Group LLC / Intuit

Category of recipient: Email marketing and customer communications platform

Country the personal information is sent to: United States

How the transfer complies with UK data protection law: The country or sector has been assessed as providing adequate protection to data subjects, also known as Adequacy Regulations or the UK data bridge.

Where necessary, our data processors may share personal information outside of the UK. When doing so, they comply with the UK GDPR and make sure appropriate safeguards are in place.

Organisation name: Mailchimp and its approved subprocessors

Category of recipient: Cloud hosting, infrastructure, security and technical service providers

Country the personal information is sent to: United States and other countries where approved subprocessors operate

How the transfer complies with UK data protection law: Mailchimp relies on the UK Extension to the EU-US Data Privacy Framework where applicable. Where that framework does not cover a transfer, Mailchimp relies on the UK Addendum to the EU Standard Contractual Clauses and other appropriate safeguards.

How to complain

If you have any concerns about our use of your personal information, you can make a data protection complaint to us: