Privacy Policy

Easy Supply LTD ("Easy Supply", "we", "us" or "our") is the data controller responsible for your personal data. We are a company registered in England and Wales under company number 16202697. Our addresses are: Registered Office: Flat 200 Edinburgh House, Edinburgh Gate, Harlow, CM20 2TJ, United Kingdom — Trading/Warehouse: Unit 6 Marshall Paving, Cattlegate Road, Enfield, EN2 9ED, United Kingdom. We supply food packaging and related products to consumers and businesses through our website easysupply.co.uk. We are registered with the Information Commissioner's Office (ICO), the UK data protection regulator. This policy explains what personal data we collect, why we collect it, who we share it with, and the rights you have under UK data protection law, including the UK GDPR and the Data Protection Act 2018.

If you have any questions about this policy or about how we handle your personal data, or if you wish to exercise any of your rights, please contact us at [email protected] or call +44 7956 786011. You can also write to us at: Registered Office: Flat 200 Edinburgh House, Edinburgh Gate, Harlow, CM20 2TJ, United Kingdom — Trading/Warehouse: Unit 6 Marshall Paving, Cattlegate Road, Enfield, EN2 9ED, United Kingdom. We have appointed a data protection contact point who is responsible for overseeing questions in relation to this policy; a statutory Data Protection Officer (DPO) is not mandatory for a business of our size, but you can reach our data protection contact using the details above. We aim to respond to all data protection enquiries promptly, and to formal rights requests within the timeframe set out in section 12.

We collect and process the following categories of personal data:

• Account data — your name, email address, password (stored in hashed form), telephone number and, if you use Google sign-in, the basic profile information Google shares with us (name, email address and Google account identifier).
• Order and transaction data — the products you order, order value and history, billing address, delivery address, order references and, for business customers, company name and VAT number.
• Payment data — we do not store full card numbers; card payments are handled directly by WorldPay. We receive limited confirmation data such as the payment result, the last four digits of the card, the card type and a transaction reference.
• Delivery data — recipient name, delivery address, contact number and delivery instructions, which we pass to our courier (DHL) to fulfil your order.
• Marketing and communications data — your marketing preferences and consents, and the content and metadata of emails, SMS messages, live chat and calls between you and us.
• Technical and usage data — IP address, device and browser type, operating system, the pages you view, referring URLs, and cookie and analytics identifiers (see section 10 and our Cookie Policy).
• CCTV and premises data — if you visit our warehouse or premises, your image may be captured by CCTV operated for security and health and safety purposes, retained as set out in section 8.

We do not intentionally collect special category data (such as health or ethnicity) and ask that you do not send it to us. Where information is needed to enter into or perform a contract with you (for example a delivery address), we will make this clear, and if you do not provide it we may be unable to fulfil your order.

We collect personal data in three main ways. Directly from you — when you create an account, place an order, contact customer service, subscribe to marketing, complete a form or use our live chat. Automatically — through cookies and similar technologies when you browse easysupply.co.uk (see our Cookie Policy). From third parties — such as Google (when you choose Google sign-in), our payment provider WorldPay (payment and fraud-screening results), our courier DHL (delivery status), and fraud-prevention agencies. Where we are required to tell you the source of data we did not collect directly from you, we do so here.

UK data protection law requires us to have a lawful basis for each use of your personal data. The table below links what we do with your data to the lawful basis we rely on under Article 6 of the UK GDPR:

Where we rely on legitimate interests, we have carried out a Legitimate Interests Assessment (LIA) balancing our interests against your rights and freedoms, and concluded the processing is necessary and proportionate; you can ask us for a summary of the relevant assessment. You have the right to object to processing based on legitimate interests, as explained in section 12.

We will only send you marketing emails and SMS where you have given your consent, or where you are an existing customer who bought a similar product from us, we gave you a simple way to opt out when we collected your details, and you did not opt out (the PECR soft opt-in). Our email and SMS marketing is delivered through Brevo, which acts as our processor. Every marketing message contains an easy, free way to unsubscribe, and you can also update your preferences in your account or by emailing [email protected]. We keep records of the consents you give — what you agreed to, when and how — so that we can demonstrate compliance. Opting out of marketing will not stop the service messages we must send to fulfil your order, such as dispatch and delivery notifications, and we never sell your personal data or share it with third parties for their own marketing.

We share personal data only where necessary, and only with organisations that are required to protect it and to use it only on our instructions where they act as our processors. The categories of recipient are:

• Payment processor — WorldPay, to take and secure your payment and screen for fraud.
• Couriers and logistics providers — DHL, to deliver your order and provide tracking.
• Email and SMS provider — Brevo, to send service and marketing communications.
• IT, hosting and CDN providers — including Cloudflare and our website and platform maintainers, to run and secure easysupply.co.uk.
• Identity / sign-in provider — Google, where you choose Google sign-in.
• Analytics providers — Google (Google Analytics), subject to your cookie consent.
• Professional advisers — accountants, auditors, insurers and lawyers, where needed and under a duty of confidentiality.
• Fraud-prevention agencies — to prevent and detect fraud and financial crime.
• Regulators, law enforcement and public authorities — where we are legally required to disclose, or to establish, exercise or defend legal claims.
• Business transfers — a buyer or successor if we sell or reorganise our business, under confidentiality terms.

We enter into written data-processing agreements with all processors as required by Article 28 of the UK GDPR, requiring appropriate security and restricting their use of your data to the services they provide to us.

We keep personal data only for as long as necessary for the purposes we collected it for, including legal, accounting and reporting requirements. Our standard retention periods are:

• Order, transaction, invoice and payment records — 6 years from the end of the relevant financial year (up to 7 years including the current year), to meet HMRC and VAT record-keeping obligations and to defend potential contractual claims within the limitation period.
• Account data — for as long as your account remains open; if you close your account or remain inactive for 24 to 36 months, we will delete or anonymise it, subject to the accounting-record period above.
• Marketing data and consents — until you unsubscribe or withdraw consent, after which we keep a minimal suppression record so that we do not contact you again.
• Customer-service correspondence — up to 24 months after the matter is closed, unless it is linked to a dispute or claim.
• Website and analytics data — as set out in our Cookie Policy, typically up to 14 to 26 months for analytics.
• CCTV footage — around 30 days, unless required for an ongoing investigation.
• Fraud-prevention records — up to 6 years, as permitted for fraud-prevention purposes.

When data is no longer needed we securely delete or anonymise it. Where a longer period is required by law or to defend a legal claim, we retain only the relevant data for that period.

We take the security of your personal data seriously and use appropriate technical and organisational measures to protect it against unauthorised access, loss, misuse, alteration or disclosure. These include encryption of data in transit (HTTPS/TLS), hashing of passwords, access controls and role-based permissions, firewalls and bot protection provided by Cloudflare, regular patching and backups, and PCI-DSS-compliant payment handling by WorldPay. Our staff and processors are bound by confidentiality obligations, and we limit access to personal data to those who need it. No method of transmission or storage is completely secure; where the law requires, we will notify you and the ICO of a personal data breach that is likely to result in a risk to your rights and freedoms, within 72 hours of becoming aware of it where feasible.

We use cookies and similar technologies to operate our website, remember your basket and preferences, keep you signed in and secure your payments, and — with your consent — to measure traffic and show you relevant marketing. You can accept, reject or manage non-essential cookies at any time through our cookie banner and the "Cookie settings" link in our footer. For full details, including a table of the cookies we use and how to withdraw your consent, please see our Cookie Policy.

Some of our providers (for example certain payment, email and SMS, analytics or hosting services) may process your personal data outside the UK. Where we transfer personal data outside the UK, we ensure a similar level of protection by relying on one of the following safeguards: a UK adequacy decision for the destination country; the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses; or another lawful transfer mechanism. You can ask us for a copy of the relevant safeguard by contacting [email protected].

Under the UK GDPR you have the following rights, which you can exercise free of charge in most cases:

• The right to be informed — to be told how we use your personal data, which is the purpose of this policy.
• The right of access — to obtain a copy of the personal data we hold about you.
• The right to rectification — to have inaccurate or incomplete data corrected.
• The right to erasure (the "right to be forgotten") — to have your data deleted where there is no overriding reason for us to keep it, subject to our legal retention obligations in section 8.
• The right to restrict processing — to limit how we use your data in certain circumstances.
• The right to data portability — to receive certain data in a structured, commonly used, machine-readable format, and to have it transferred where technically feasible.
• The right to object — to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.
• Rights relating to automated decision-making and profiling — as explained in section 13.

You also have the right to withdraw your consent at any time where we rely on consent; this does not affect the lawfulness of processing carried out before withdrawal. To exercise any right, contact us at [email protected]. We will respond within one month; we may extend this by up to two further months for complex or numerous requests and will tell you if we need to. We may ask you to verify your identity before we act on a request.

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. Our payment providers and fraud-prevention partners may use automated checks to detect and prevent fraudulent transactions, which could result in an order being declined; where this happens you can ask for human review, express your view and contest the decision by contacting us. We may use limited profiling (for example grouping customers by purchase history) to make our marketing more relevant, but only within your cookie and marketing preferences, and you can object at any time.

Our website and products are intended for business and adult consumers and are not directed at children. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us at [email protected] and we will delete it.

Our website may contain links to third-party websites, plugins and services (for example Google, payment pages or social media). We are not responsible for the privacy practices or content of those third parties, and this policy does not apply to them. We encourage you to read the privacy policy of every website you visit.

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] so we can try to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at any time. You can reach the ICO at www.ico.org.uk, by helpline on 0303 123 1113, or by post at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would, however, appreciate the chance to address your concerns before you approach the ICO.

We may update this policy from time to time to reflect changes in our practices or the law. When we make material changes we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email or by a notice on our website. Please review this page periodically. The current version always governs our use of your personal data.

Easy Supply LTD — Registered Office: Flat 200 Edinburgh House, Edinburgh Gate, Harlow, CM20 2TJ, United Kingdom — Trading/Warehouse: Unit 6 Marshall Paving, Cattlegate Road, Enfield, EN2 9ED, United Kingdom. Data protection enquiries: [email protected], telephone +44 7956 786011. Company number 16202697. For information about the cookies we use, please see our Cookie Policy.