Your data, your rights & your privacy

Cycle-In Logistics Ltd is responsible for the personal information we collect and use for our own business purposes and is the data controller for that information.

Cycle-In Logistics Ltd
Unit 5 Carr Lane Business Park
Carr Lane
Hoylake
Wirral
CH47 4AZ

Email: sales@cycle-in.co.uk
Telephone: 0330 220 1207

This Policy applies to individuals, including consumers, sole traders and people acting as contacts for companies, public bodies, schools, contractors and other organisations.

The information we collect depends on how you interact with us.

Identity and contact information

This may include your name, job title, business or organisation, billing and delivery addresses, email address and telephone number.

Order, quotation and project information

This may include products requested or purchased, quantities, project requirements, delivery or installation details, correspondence, quotation history, order history and associated references.

Transaction and payment information

We may receive billing information, payment status, transaction references and other information needed to process or reconcile payments.

Payment-card information may be processed by Shopify and the payment provider used at checkout. We do not need to receive or retain your full payment-card details in order to administer an ordinary Shopify transaction.

Account information

If you use customer-account functionality, we may process account identifiers, contact information, order history and information connected with account access.

Communications and customer support

We process information contained in emails, contact forms, quotation requests, telephone notes, returns or complaints and other communications you send to us.

Website and technical information

Depending on your privacy choices and the technologies being used, this may include IP address, browser or device information, pages visited, interactions, session information, traffic source and analytics identifiers.

Preferences

We may process communication preferences, marketing preferences and privacy or cookie choices.

We may obtain personal information:

• directly from you when you place an order, create an account, request a quotation, submit a form or contact us;
• from the organisation you work for or another person involved in an order or project;
• through our Shopify store and associated services;
• from payment, delivery or project-service providers where necessary to administer a transaction;
• from Google Analytics and our Google & YouTube integration, subject to applicable privacy choices; and
• from publicly available business information where it is lawful and appropriate for us to use it.

If another person or organisation provides us with your contact details for an order, delivery or commercial project, we expect them to have an appropriate basis for doing so.

We use personal information for purposes including:

• responding to enquiries and preparing quotations;
• processing, supplying and administering orders;
• arranging delivery, installation or project support;
• processing payments and maintaining accounting records;
• managing customer accounts;
• handling returns, refunds, faults, complaints and customer-service requests;
• operating, maintaining and securing our website;
• detecting or preventing fraud and misuse;
• measuring website performance and improving our customer experience;
• communicating relevant marketing where lawful;
• managing privacy choices and data-rights requests;
• establishing, exercising or defending legal rights; and
• complying with legal, regulatory, tax and accounting obligations.

UK data-protection law requires us to identify a lawful basis before using personal information.

Where we rely on legitimate interests, those interests may include operating and improving our business, responding to commercial enquiries, providing customer support, protecting our systems and pursuing or defending legal rights.

We consider whether those interests are necessary and balanced against the rights and interests of the people whose information is involved.

Cycle-In supplies both individuals and organisations. Many of our enquiries and transactions involve business contacts acting for schools, contractors, councils, healthcare organisations, developers, workplaces or other organisations.

Personal information relating to those contacts may be needed to:

• prepare and discuss quotations;
• confirm project requirements;
• manage purchase orders;
• coordinate deliveries and installations;
• communicate project information;
• issue invoices and payment information; and
• provide after-sales support.

Even where an organisation is the customer, information such as an employee's name, business email address or direct telephone number can still be personal information and is handled accordingly.

Our online store is powered by Shopify.

Shopify provides services including ecommerce functionality, hosting, checkout, customer accounts, security, privacy controls and related store services.

Personal information processed through our store may therefore be processed by Shopify and its authorised service providers in connection with providing those services.

Depending on the particular Shopify service, Shopify may process information on our behalf and may also have its own responsibilities for certain processing it carries out for its own stated purposes.

Google Analytics is active on our Shopify store through our Google & YouTube integration.

Subject to the privacy choices applicable to the visitor, Google Analytics may process information such as:

• pages viewed;
• website interactions;
• session information;
• traffic source;
• browser and device information;
• approximate location information; and
• pseudonymous analytics identifiers.

We use this information to understand website performance and identify opportunities to improve the customer experience.

Google & YouTube is also connected to our Shopify store for services including Google Merchant Center and related Google functionality.

Our current Shopify Customer Events configuration shows Google & YouTube as an active web pixel. Google Ads is not currently active through this integration.

Our website uses Shopify's native Customer Privacy controls for visitors in the United Kingdom.

The current preference categories are:

• Required;
• Personalization;
• Marketing; and
• Analytics.

Our Cookie & Storage Technologies Policy provides more detailed information about the technologies used, their purposes and how to manage your choices.

Where we send direct marketing, we comply with applicable UK data-protection law and the Privacy and Electronic Communications Regulations.

Individuals, sole traders and certain partnerships

Marketing by email or similar electronic message generally requires consent unless the requirements of the products-and-services soft opt-in are satisfied.

Where the soft opt-in is used, contact details must have been obtained during a sale or negotiation for a sale of our products or services, the marketing must relate to our similar products or services, and a clear opt-out must be provided when the details are collected and in each subsequent marketing message.

Corporate subscribers

PECR does not generally require consent for electronic marketing sent to corporate subscribers. However, where a named business contact's personal information is involved, UK GDPR still applies.

We may retain limited contact information on a suppression or do-not-contact list after an opt-out so that we can respect the request in future.

Where necessary and lawful, we may share personal information with categories of recipients including:

• Shopify and providers supporting our ecommerce platform;
• Google in connection with Google Analytics and the Google & YouTube integration;
• payment providers and financial institutions;
• delivery, courier, logistics and installation providers;
• IT, website, security, communications and support providers;
• accountants, auditors, insurers, solicitors and other professional advisers;
• public authorities, regulators, courts or law enforcement where disclosure is required or permitted by law; and
• a prospective buyer, seller or adviser where relevant to a genuine corporate transaction, reorganisation or transfer of business assets.

We do not disclose personal information to third parties simply so that they can use it for their own unrelated direct marketing.

Some service providers used in connection with our website and business operate internationally. This means personal information may sometimes be transferred outside the United Kingdom.

Where a transfer is a restricted transfer under UK data-protection law, we take steps to ensure that an appropriate transfer mechanism applies.

Depending on the destination and recipient, this may include:

• UK adequacy regulations;
• the UK Extension to the EU-US Data Privacy Framework where the relevant US recipient is eligible and appropriately certified;
• appropriate safeguards such as the International Data Transfer Agreement or UK Addendum; or
• another lawful transfer mechanism permitted by UK data-protection law.

Where required, we also assess whether the applicable transfer arrangements provide the standard of protection required by UK law.

We do not aim to keep personal information for longer than is reasonably necessary for the purpose for which it was collected and any applicable legal, contractual, accounting or dispute-resolution requirements.

When deciding retention periods we consider the nature and sensitivity of the information, why it is needed, legal requirements, limitation periods and whether the purpose can be achieved without continuing to retain identifiable information.

We take reasonable technical and organisational steps designed to protect personal information against unauthorised access, accidental loss, alteration, disclosure or destruction.

Appropriate measures may include:

• access controls and account security;
• use of reputable ecommerce and service platforms;
• restricting information to those who need it;
• appropriate staff procedures;
• data minimisation;
• security and fraud-prevention controls; and
• reviewing providers and integrations where appropriate.

No internet or electronic-storage system can be guaranteed to be completely secure. If you believe information relating to you has been compromised, please contact us promptly.

Our ordinary ecommerce and commercial activities do not require us to routinely request special-category personal information or criminal-offence information from customers.

Please do not provide sensitive personal information unless it is genuinely necessary for the matter you are asking us to deal with.

If we need to process special-category or criminal-offence information, we will only do so where an appropriate lawful basis and any additional condition required by law applies.

Depending on the circumstances and the lawful basis being used, your rights may include:

Right of access

You can ask whether we process personal information about you and request a copy together with relevant supplementary information.

Right to rectification

You can ask us to correct inaccurate personal information and complete information that is incomplete.

Right to erasure

In certain circumstances you can ask us to erase personal information. This right is not absolute and may not apply where we need to retain information for another lawful reason.

Right to restriction

In certain circumstances you can ask us to restrict how personal information is used.

Right to data portability

Where the legal conditions apply, you can request certain information you provided to us in a structured, commonly used and machine-readable format.

Right to object

In certain circumstances you can object to processing based on legitimate interests.

Right to withdraw consent

Where processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing before consent was withdrawn.

Significant automated decisions

If we make a decision about you based solely on automated processing that has a legal or similarly significant effect, the safeguards required by UK law apply. These include information about the decision and rights to make representations, challenge the decision and obtain human intervention.

Rights are subject to the conditions and exemptions in applicable data-protection law and not every right applies in every situation.

We will respond to valid data-protection rights requests without undue delay and normally no later than one calendar month after receiving the request and any information reasonably required to confirm identity or properly understand the request.

Where permitted by law, this period may be extended by up to two additional months if a request is complex or a number of requests have been made.

If an extension applies, we will explain this within the initial one-month period.

We may ask for reasonable evidence of identity where necessary to protect personal information from being disclosed to the wrong person.

Any identification information requested will be limited to what is reasonably necessary for that purpose.

If you have a concern about how we have handled your personal information, you can make a data-protection complaint directly to Cycle-In Logistics Ltd.

We provide a clear complaints route through the Privacy & Data Rights form on this page.

For a data-protection complaint we will:

• acknowledge the complaint within 30 days;
• take appropriate steps to investigate it; and
• communicate the outcome of our investigation.

Information Commissioner's Office

You also have the right to raise a concern with the Information Commissioner's Office, the UK's independent data-protection regulator.

Information about making a complaint to the ICO is available at ico.org.uk.

We would appreciate the opportunity to address your concern directly, but contacting us first does not remove your right to approach the ICO.

We may update this Privacy Policy where our products, services, systems, suppliers or legal obligations change.

We may also update it where:

• a new Shopify app or integration is introduced;
• a service or processor is removed;
• our purposes or lawful bases change;
• our privacy controls change;
• data-protection law or regulatory guidance changes; or
• a privacy review identifies information that should be updated.

The date shown at the top of this Policy identifies when this version was last updated.

Where a material change affects how personal information is used, we will take appropriate steps to provide updated information and obtain consent where a new consent is legally required.

For privacy questions, data-rights requests or data-protection complaints, contact:

Cycle-In Logistics Ltd
Unit 5 Carr Lane Business Park
Carr Lane
Hoylake
Wirral
CH47 4AZ

Email: sales@cycle-in.co.uk
Telephone: 0330 220 1207