The short version
- We collect what we need to dispatch your order and not much more.
- We don't sell or rent your data. Ever.
- We use Stripe for payments, DPD/Parcelforce for delivery, Brevo for transactional email, and Google Analytics for aggregate site stats. That's it.
- You can request a copy or deletion of your data by emailing [email protected].
1. What we collect
For account holders: name, email, phone (optional), shipping address(es), order history, trade application details (if you've applied).
For guest checkouts: the same shipping/contact details, but no account.
For all visitors: anonymised analytics (page views, device class, country) via Google Analytics 4 with IP anonymisation.
2. Why we collect it
Legitimate interest in (a) processing your order, (b) supporting you if anything goes wrong, (c) running our business effectively. We don't collect data we don't need to act on.
3. Who we share with
- Stripe — for processing card payments. Card details are sent directly to Stripe and never touch our servers.
- DPD / Parcelforce — name, address, phone (for delivery notifications).
- Brevo — for transactional emails (order confirmations, dispatch notifications). No marketing without explicit opt-in.
- Google Analytics — anonymised aggregate stats. No personally identifiable data.
- HMRC — VAT reporting (no personal data, transactional only).
That is the complete list. We don't sell or rent your data.
4. Cookies
Strictly necessary cookies (session, cart, VAT preference) — set without consent because the site doesn't work without them. Analytics cookies (GA4) require consent on first visit; you can change your mind at any time via the cookie banner.
5. Retention
Order data is retained for 7 years (HMRC requirement). Account credentials are retained while your account is active and for 12 months after closure. Analytics data is retained for 14 months.
6. Your rights
Under UK GDPR you have the right to (a) access your data, (b) correct inaccurate data, (c) delete data we no longer need to retain, (d) object to processing, (e) data portability. Email [email protected] and we'll respond within 30 days.
7. Contact us
Email [email protected] or write to: Data Protection, BM Hardware Ltd, Maxwell Road, Middlesbrough, TS3 8TE.
Last updated: 15 May 2026