1. Who we are (data controller)

This website is operated for Nelson's Used Racking & Shelving ("Nelson's", "we", "us"). The data controller responsible for your personal data is [GrafterUK Ltd / Nelson's — TODO confirm which entity, and add company number & registered address].

If you have any questions about this policy or how we handle your data, contact us at 01992 000000 TODO phone or by post at Etteridge Farm Depot, Pembridge Lane, Broxbourne, EN10 7QP. TODO — add a data-requests email address.

2. The two ways we collect your data

We collect personal data through two separate enquiry forms, for two different purposes. Which data we hold, and what we do with it, depends on which form you used.

a) The "We buy" form (you're selling racking to us)

• What we collect: your name, your contact details (email and/or phone), your location (town or postcode), a description of the racking or shelving you have, any photographs you choose to upload, and any notes you add.
• Why: to value what you're selling, make you an offer, and — if you accept — arrange payment, collection and dismantling.
• Who it goes to: our buying team.

b) The "What we sell" form (you're buying racking from us)

• What we collect: your name, your contact details (email and/or phone), your location, the product you're interested in and its details (type, size, number of bays, or quantity), and any notes you add.
• Why: to respond to your sales enquiry with availability, sizes and pricing, and to arrange supply, delivery or collection.
• Who it goes to: our sales team (racking & shelving, or general sales, depending on the product).

3. Lawful basis for processing

We rely on the following lawful bases under the UK GDPR:

• Consent (Article 6(1)(a)) — when you submit an enquiry, you tick a box giving us permission to use your details to respond. You can withdraw this consent at any time (see section 7).
• Taking steps at your request prior to entering a contract, and performance of a contract (Article 6(1)(b)) — where you ask us to value, buy, supply or deliver goods.
• Legitimate interests (Article 6(1)(f)) — to run and administer our business and respond to enquiries, where this is not overridden by your rights.

We do not use your enquiry details for marketing unless you have separately and specifically agreed to it.

4. How long we keep it (retention)

We keep enquiry data only as long as needed for the purpose it was collected:

• Enquiries that don't lead to a transaction: kept for up to [12 months] TODO confirm, then deleted.
• Enquiries that lead to a purchase or sale: kept as part of our business and accounting records for as long as required by law (typically [6 years] TODO confirm for tax and accounting purposes).

5. Who we share it with (third parties)

We do not sell your personal data. We may share it only with:

• Service providers who help us run the website and handle enquiries (for example, the form-delivery and email service that routes your enquiry to us) — TODO name the form provider once wired, e.g. Web3Forms.
• Collection, transport or dismantling partners, where necessary to fulfil a buy or sale you've asked us to progress.
• Professional advisers or authorities where we are legally required to do so.

Any provider we use is required to keep your data secure and to use it only for the purpose we've engaged them for.

6. Where your data is processed

Your data is processed in the UK. If any provider processes data outside the UK, we ensure appropriate safeguards are in place as required by data protection law. TODO confirm once the form provider is chosen.

7. Your rights

Under UK data protection law you have the right to:

• be informed about how we use your data (this policy);
• request a copy of the personal data we hold about you (access);
• have inaccurate data corrected (rectification);
• request that we delete your data (erasure / "right to be forgotten");
• restrict or object to our processing;
• withdraw consent at any time, including asking us to stop contacting you;
• data portability, where applicable.

To exercise any of these rights — including asking us to delete your enquiry, or to stop contacting you — contact us using the details in section 1. We'll respond within one month.

8. Cookies & analytics

This site does not set advertising or tracking cookies. TODO — if analytics (e.g. a privacy-friendly tool) or a conversion tag is added later, describe it here and add a cookie banner if required.

9. Complaints

If you're unhappy with how we've handled your data, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows when it last changed.