Privacy Notice

DYTP Wholesale (company number [company number], VAT number [VAT number]), registered office [registered address], email [email protected].

1. Who we are

1.1 DYTP Wholesale (company number [company number], registered office [registered address]) is the controller of the personal data described in this notice. We can be contacted at [email protected].

1.2 This notice explains what personal data we collect from business contacts, customers, suppliers and website visitors, why we collect it, who we share it with, how long we keep it and what rights individuals have. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.3 We trade only with businesses. The personal data we hold is mainly the names and contact details of the people who work for or run those businesses.

2. What we collect and where it comes from

2.1 Enquiries. When you use the enquiry form on our website, email us or telephone us, we collect your name, business name, email address, telephone number, the message you send us and any files you attach.

2.2 Trade accounts. When you apply for a trade account we collect your business name and address, company or VAT registration number, the names and contact details of the people authorised to order and to pay, and where credit terms are requested, trade references and information from credit reference agencies.

2.3 Orders, invoices and payments. When you buy from us we collect the details needed to fulfil and record the sale: delivery address, contact details for the delivery, order and invoice history, and payment records. We do not store card numbers. Card payments, where offered, are taken by a payment processor.

2.4 Website. Our website sets only the essential cookies described in the Cookie Policy: a session cookie that carries your sign-in and the contents of your basket, and a CSRF cookie that protects our forms. We do not use analytics tools or advertising trackers. Our server keeps standard access logs (IP address, browser type, pages requested, date and time) for security and fault-finding.

2.5 Correspondence. We keep the emails, messages and notes of calls exchanged with you so that we have a record of what was agreed.

2.6 Visitors to our premises. If you visit our warehouse we may record your name, business and vehicle registration for safety and security, and our premises may be covered by CCTV, which is signed on site.

2.7 Website account users. When a person is given a sign-in on a trade account we hold their name, email address, telephone number, the company details on the account, a hashed form of their password (never the password itself), the times and IP addresses of their sign-ins and password changes, and the record of failed sign-in attempts. We hold this so that the account works and so that we can see whether it has been misused.

3. Why we use it and our lawful bases

3.1 To respond to your enquiry and give you a quote: our legitimate interest in running our business and dealing with prospective customers, and, where you are a sole trader, the steps needed to enter a contract with you.

3.2 To open and manage a trade account, including the sign-ins and account pages on our website, to take and process orders through the website basket and checkout, to arrange delivery, to invoice and to take payment: performance of a contract with you or with the business you represent, and the steps needed to enter that contract, together with our legitimate interest in managing our customer relationships.

3.3 To carry out credit checks and recover debts: our legitimate interest in protecting our business from non-payment.

3.4 To keep accounting and tax records: our legal obligation under company and tax law.

3.5 To keep our premises, systems and website secure and to detect fraud: our legitimate interest in protecting our business, staff and customers. This includes the sign-in and lockout records described in clause 2.7.

3.6 To tell existing customers about stock, offers and services similar to those they have bought or enquired about: our legitimate interest in marketing to trade customers. You can ask us to stop at any time by replying to any message or emailing [email protected], and we will stop.

3.7 Where we rely on legitimate interests we have considered the effect on you and believe the use is proportionate and what you would reasonably expect from a trade supplier.

4. Who we share it with

4.1 Couriers and pallet networks, so that they can deliver your goods and contact you about the delivery.

4.2 Payment processors and our bank, to take and reconcile payments.

4.3 Our accountants, bookkeepers and auditors, for accounting, tax and compliance.

4.4 Credit reference agencies and debt recovery agents, where credit terms are requested or an invoice is overdue.

4.5 Providers of the IT services we use to run the business, such as email, hosting, backup and our accounting and warehouse systems. They act on our instructions under written contracts.

4.6 Professional advisers, insurers, regulators, HM Revenue and Customs, the courts and the police, where we are required by law or need to do so to protect our rights.

4.7 A buyer or successor of our business, if the business is sold or reorganised.

4.8 We do not sell personal data and we do not share it with third parties for their own marketing.

5. International transfers

5.1 We keep personal data in the United Kingdom where we can. Some of our IT providers may store or process data outside the UK. Where that happens we make sure the transfer is covered by a UK adequacy decision or by the International Data Transfer Agreement or other safeguards approved under UK GDPR.

6. How long we keep it

6.1 Enquiries that do not lead to an order: 12 months from the last contact, then deleted.

6.2 Trade account records, including website account users and their sign-in history, and customer contact details: for as long as the account is active and for 6 years after the last order, in line with the limitation period for contract claims.

6.3 Orders, invoices, credit notes and payment records: 6 years from the end of the financial year to which they relate, as required for tax and company records.

6.4 Credit checks and references: for the life of the credit account and 12 months after it closes.

6.5 Server access logs: 90 days.

6.6 Visitor records and CCTV: 30 days unless needed for an incident.

6.7 Correspondence: with the record it relates to, for the period above.

6.8 When a retention period ends we delete or anonymise the data securely.

7. Your rights

7.1 Under UK GDPR you have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to have data erased where we no longer need it, to restrict or object to our use of it, to receive data you gave us in a portable form, and to withdraw consent where consent is the basis we rely on.

7.2 You can object at any time to direct marketing and we will stop.

7.3 To exercise any right, email [email protected] or write to [registered address]. We will respond within one month. We may ask you to confirm your identity before we act. There is normally no charge.

7.4 We do not make decisions about you by automated means that have a legal or similarly significant effect. Trade account applications are approved or declined by a person.

8. Security

8.1 We keep personal data on password-protected systems with access limited to the staff who need it, and we back it up. Our website is served over HTTPS. Account passwords are stored only as a salted hash, never as text we can read, and the links we email to confirm an address or reset a password work once and expire. No system is completely secure, and we will tell you and, where required, the Information Commissioner if a breach affects your data.

9. Complaints

9.1 If you are unhappy with how we handle your personal data, please contact us first at [email protected] so that we can try to put it right.

9.2 You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, website ico.org.uk.

10. Cookies

10.1 Our use of cookies is described in the Cookie Policy. The site sets a session cookie that carries your sign-in and your basket, and a CSRF cookie that protects our forms. There are no analytics or advertising cookies.

11. Changes to this notice

11.1 We may update this notice. The version and issue date at the top show when it was last changed. Significant changes will be brought to the attention of account holders by email.