Privacy Policy

Effective date: 29 September 2026

Controller: CTRLON GROUP LTD (company no. 17389121). Privacy contact: info@ctrlon.co.uk. We do not sell personal information.

1. Information we collect

Depending on how you deal with us, we may collect your name, business and job role, email address, telephone number, billing and delivery details, order and payment references, enquiries, equipment and asset information, service/job records, uploaded photographs or documents, correspondence, website technical data and privacy choices.

2. Where it comes from

Most information comes directly from you through the website, phone, email, WhatsApp, orders or service activity. We may also receive relevant business or equipment information from your employer, colleague, supplier, manufacturer, payment provider, courier or connected business system where lawful.

3. Why we use it

We use personal information to answer enquiries; identify parts; prepare quotations; take and fulfil orders; process payments and delivery; create customer, site, equipment and job records; provide technical work; keep service history; manage accounts; prevent fraud and misuse; maintain and improve our systems; comply with legal obligations; and establish, exercise or defend legal claims.

4. Lawful bases

Depending on the activity, we rely on steps requested before a contract, performance of a contract, legal obligation, legitimate interests in operating and protecting the business and serving customers, or consent where consent is required. Optional analytics and newsletter sign-up use consent where required.

5. Payments and delivery

Online card payments are processed by Stripe. Card details are entered on Stripe’s service and are not stored by CtrlOn’s website server. Couriers receive the information needed to deliver an order and provide tracking.

6. Business systems and service providers

We may use providers for website hosting, Google Workspace email and files, payment processing, banking, delivery, analytics where enabled, Google Merchant or Customer Reviews features, business systems such as CtrlOn OS or Odoo, IT/security, accounting and professional advice. We share only information reasonably required for the relevant purpose.

7. International processing

Some technology providers may process data outside the UK. Where UK data-protection law requires safeguards for an international transfer, we use an applicable transfer mechanism or another lawful route provided by that law.

8. How long we keep information

We keep information only as long as needed for the purpose and legal requirements. Transaction, accounting and contractual records may be kept for applicable statutory or limitation periods, commonly up to six years where relevant. Equipment and service history may be retained while it remains useful to an ongoing customer relationship or safety/technical record. Marketing consent is kept until withdrawal; limited suppression information may then be retained so we do not contact someone who has opted out.

9. Marketing and trade updates

If you actively join our trade updates, we record the email address, time, source and wording of the consent. You can withdraw at any time using the unsubscribe method in a marketing email or by contacting us. We also respect applicable rules for business-to-business marketing and objections.

10. Cookies and analytics

Essential browser storage supports the basket and privacy choices. Non-essential analytics is not activated unless the required consent is obtained. See the Cookie Policy.

11. Google Customer Reviews

After an eligible paid order, the confirmation page may offer a voluntary Google Customer Reviews opt-in. If you choose to participate, order reference, email address, country and estimated delivery date may be provided to Google so it can administer the survey.

12. Security

We use proportionate technical and organisational measures including access controls, restricted server-side credentials, protected operational storage and encrypted transport where available. No internet service can be guaranteed completely secure.

13. Your rights

Subject to applicable UK data-protection law, you may have rights to access, correct or erase personal data; restrict or object to processing; request portability; and withdraw consent. Rights are not absolute and exemptions can apply. To exercise a right, email info@ctrlon.co.uk.

14. Complaints

Please contact us first if you have a privacy concern. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.

15. Changes

We may update this notice when our services, providers or legal requirements change. The effective date above identifies the current version.