5.0 Privacy Policy

5.1 Who controls your information

SAFE TOOLS LIMITED is the controller of personal information used for its sales, hire and customer services. Contact support@safetools.co.uk or write to 16 Dean Street, Whitburn, Bathgate, EH47 0EA. This notice covers customers, prospective customers, website visitors and people authorised to receive or return tools. It explains our proposed processing under UK data protection law, including the UK GDPR, Data Protection Act 2018 and applicable amendments. Effective date: 12 October, 2026.

5.2 Information we collect and its sources

We collect information you provide when you ask for a quote, place an order, hire tools, contact us, return goods or make a complaint. This can include your name, contact details, delivery and billing addresses, selected products, hire dates, delivery instructions, payment status and correspondence. We record the order reference and relevant condition or handover evidence. Where reasonably needed for hire security, we verify identity or address using Identification document with address like driving license. We prefer a record that verification was completed to retaining a full identity-document copy. Any retained copy, reason and retention period must be explained at collection. Do not submit unnecessary identity documents or sensitive personal information in the “Any other information” field. We also receive transaction or fraud-status information from payment providers, delivery confirmation from carriers, and information from someone acting with your authority. Website systems may collect IP address, browser details, timestamps, security logs and cookie preferences. The providers and technologies actually used are identified in the completed notice and cookie schedule. We provide this notice when collecting data from you. Where information comes from someone else, we provide the required privacy information within a reasonable period and no later than one month, or by the first communication or disclosure if earlier, unless a lawful exception applies.

5.3 Why we use data and our lawful bases

Contract: we use customer identity, contact, order and delivery information to prepare a requested quote, accept and fulfil purchases or hire, arrange collection, take payment, issue receipts, manage returns and provide contracted support. Where you act for a business, we generally use your professional contact details under our legitimate interest in administering that business relationship. Legal obligation: we retain required accounting and tax records, comply with legal requests, and meet applicable product-safety and data-protection duties. Legitimate interests: we use proportionate records to protect tools, investigate fraud, maintain website security, manage disputes and establish or defend legal claims, after considering the impact on you. We do not use “legitimate interests” as a blanket justification for unrelated processing. Consent: if we offer optional marketing or optional cookies requiring consent, we ask separately and allow withdrawal. Providing information needed for an order is necessary to fulfil it; withholding that information may prevent us accepting or delivering the order. Optional marketing consent is never a condition of buying or hiring.

Privacy policy sharing and retention

5.4 Sharing and international transfers

We share only information needed for the relevant purpose with payment processors, delivery and collection providers, website or cloud hosts, customer-support providers, professional advisers and insurers where a claim requires it. Regulators, courts or law-enforcement bodies receive information where legally required or otherwise lawfully justified. Providers acting as processors are subject to appropriate data-processing terms. Some payment providers and advisers act as independent controllers for their own legal responsibilities. Actual main providers and links to their notices: Sokin, Starling bank, Namecheap, Evri Courier Service, Parcel force. We do not sell customer information. We do not provide it to other businesses for their own marketing without a separate lawful basis and any required consent. Our use is limited to the purposes explained in this notice and compatible or lawfully notified purposes. International transfer position: Where a restricted transfer occurs, we use an applicable UK adequacy arrangement or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum with the required assessment, with confidential material redacted where necessary.

5.5 How long we keep information

We retain personal information only as long as needed for its purpose and applicable legal obligations. We then delete or anonymise data securely. A documented legal hold may justify longer retention of relevant records, not all customer information indefinitely. Orders, invoices and core payment records: six years after the end of the relevant financial year, or a different statutory period where required. Hire contracts, condition records and substantive disputes: normally six years after closure, subject to the applicable UK jurisdiction, nature of a claim and insurer requirements. Unconverted enquiries: twelve months after the last meaningful contact unless a shorter period is appropriate. Identity-document copies: avoid retaining copies; if exceptionally necessary, delete within 30 days after successful verification unless a specific documented need requires longer. We keep only the minimum verification result with the hire record. Security logs: normally 90 days, except records needed to investigate a specific incident. Cookie lifetimes: as stated in the complete cookie schedule. Marketing details: until withdrawal or a periodic inactivity review. We keep a minimal suppression record afterwards to respect the opt-out. Backups expire in 30 days and are not used for routine processing after deletion.

Privacy policy choices, rights and complaints

5.6 Marketing cookies and automated decisions

Order confirmations, safety notices and necessary hire reminders are service messages. Promotional email or text is sent only with an appropriate legal basis and compliance with electronic-marketing rules. Our proposed approach is separate opt-in consent for consumer email and text marketing. Each promotional message includes an easy opt-out. We do not bundle marketing consent with agreement to the order terms. Strictly necessary cookies may support security, checkout and your saved privacy choices. Under this proposed policy, optional analytics and advertising technologies remain off until you choose them, even where a narrow legal exception might otherwise be available. You can reject or later change optional choices as easily as accepting them. Only functional cookies are mandatory on our website. Automated decisions: There are no automated decisions on our website. You have the right to select where options are provided. However, you will be notified if any of our providers detect and report any fraud or impersonation at any phase of our transaction with you.

5.7 Your rights and security

Depending on the circumstances, you may request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. You may object to direct marketing at any time. Where we rely on consent you may withdraw it, without affecting the lawfulness of earlier processing. Some rights have legal exceptions; we explain any refusal and how to challenge it. Contact our privacy address to make a request. We will acknowledge within 24 hours but respond without undue delay and normally within one month. We may take up to two additional months for a complex request or multiple requests, explaining the extension within the initial month. We use proportionate identity checks; any pause for clarification or verification must meet the applicable legal conditions and is explained. Requests are normally free; any permitted fee or refusal must have a lawful basis. We use proportionate access controls, secure transmission, staff procedures and retention controls. No security measure eliminates all risk; we manage incidents and make legally required notifications.

5.8 Privacy complaints and updates

You can make a data protection complaint by email or post to the privacy contact, describing your concern and desired outcome. We acknowledge it within 24 hours, and respond fully within 30 days, make appropriate enquiries, keep you informed and communicate the outcome without undue delay. This process is separate from the response deadline for a data-rights request. You may complain to the UK data protection regulator, the ICO, at https://ico.org.uk/make-a-complaint/ or telephone 0303 123 1113. You do not have to give up other remedies. We update this notice when processing changes and bring material changes to your attention where appropriate; a new notice does not itself authorise a new use of existing data.