30+ approved UK dealers!Li-Ion material handling leadersIndustry leading pricing
Contact Your Local Dealer

Privacy Policy

A. Introduction

With this privacy policy, we wish to inform you about the types of personal data (hereinafter also referred to as “data”) we process, for what purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the provision of our services and, in particular, on our website, in mobile applications and within our online presence, including our social media profiles (collectively referred to as “online offering”).

The terms used are intended to be gender-neutral.

B. Responsibility and Contacts

Last updated: January 2026

B.1. Data Controller

Forkline Trucks GmbH (operating as EP Store)

Graf-Adolf-Platz 12

40213 Düsseldorf, Germany

HRB 106945

Managing Director: Bennit Schmieder

Telephone: +44 (0) 800 000 0000

Email: [email protected]

B.2. Data Protection Contact

Email: [email protected]

C. Overview of Data Processing

The following overview summarises the types of data processed, the purposes of processing and refers to the categories of data subjects. Details regarding specific data collection are further explained in Section D.

C.1. Types of Data Processed

Personal identification data; Payment data; Geolocation data; Contact information; Content data; Contractual data; Usage data; Metadata and communication data; Video and/or photographic recordings; Contact information (social platforms); Event data (social platforms).

C.2. Categories of Data Subjects

Customers; Employees; Interested parties; Communication partners; Users; Participants in competitions and promotions; Business and contractual partners; Persons depicted in content.

C.3. Purposes of Processing

Provision of contractual services and customer support; Management of enquiries and communications; Security measures; Direct marketing; Audience measurement; Tracking; Remarketing; Conversion measurement; Click tracking; Creation of target groups; Management and response to enquiries; Organisation of competitions and promotions; Server monitoring and error detection; Firewall; Feedback collection; Heatmap; Surveys and questionnaires; Marketing; Creation of user profiles; Credit assessment; IT infrastructure management.

C.4. Relevant Legal Bases

Below is an overview of the legal bases provided by the UK GDPR on which the processing of personal data is founded. Please note that, in addition to the provisions of the UK GDPR, national data protection regulations may also apply. Should more specific legal bases apply in individual cases, we will inform you in the relevant sections of this privacy policy.

Consent (Article 6(1)(a) UK GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.

Performance of a contract and pre-contractual measures (Article 6(1)(b) UK GDPR) – Processing is necessary for the performance of a contract to which the data subject is party or for the implementation of pre-contractual measures taken at the request of the data subject.

Legal obligation (Article 6(1)(c) UK GDPR) – Processing is necessary to comply with a legal obligation to which the data controller is subject.

Legitimate interests (Article 6(1)(f) UK GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the data controller or a third party, provided that the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data do not take precedence.

Application procedures (Articles 6(1)(b) and 9 UK GDPR) – To the extent that, in the context of application procedures, special categories of personal data within the meaning of Article 9(1) UK GDPR are requested (e.g. health data such as disability status or ethnic origin), processing takes place in accordance with Article 9(2)(b) UK GDPR. If such data is provided voluntarily, processing is based on Article 9(2)(a) UK GDPR.

In addition to the provisions of the UK GDPR, the UK Data Protection Act 2018 also applies.

D. Transfer of Personal Data

To provide our services on our website, we may transfer data to other recipients, such as dealers registered on our site and manufacturers of the products ordered (Section F.2.), providers of analytics or marketing tools (Section F.7.), providers of embedded functionalities (Section F.8.) or providers of IT services and IT infrastructure (Section F.10.).

The transfer of data to dealers, manufacturers and IT service and infrastructure providers is necessary for the performance of the services offered on our website.

Providers of analytics, marketing or embedded functionality tools only receive personal data if the user consents to the use of such tools and data processing.

In some cases, data may also be transferred to the United States. In this privacy policy, we explain if and when such a transfer occurs.

Under Article 45(1) of the UK GDPR, the transfer of personal data to a third country is permitted if the Secretary of State has decided that the third country, a territory or one or more specific sectors within the third country ensure an adequate level of protection. The United States is a third country for which an adequacy decision exists. The US and UK have agreements in place regarding data protection standards.

Based on the adequacy decision, personal data may be transferred to organisations in the United States that have been certified. The list of certified organisations is available here: https://www.dataprivacyframework.gov/list

E. Cookies

E.1. Purpose

We use cookies in accordance with legal requirements. Cookies are text files that are stored in the internet browser or by the browser itself on the user’s computer system. When a user visits a website, a cookie may be saved on the user’s operating system. This cookie contains a unique string of characters that allows the browser to be identified when the site is visited again.

We use cookies to ensure the functionality of our website (technically necessary cookies). Some elements of our site require that the browser making the request can be recognised even after a page change.

The following data is stored and transmitted via cookies: cookie preferences; shopping basket data (hash, items, recently viewed products); session cookies (unique hash, login status, user settings).

We also use cookies on our website for analytics and marketing purposes. Details on the use of these cookies are described in Section F.7 of this Privacy Policy.

We do not use cookies for analytics or marketing purposes without the explicit consent of the user.

E.2. Information on the Legal Basis

The legal basis for processing personal data using technically necessary cookies is Article 6(1)(f) of the UK GDPR.

The legal basis for processing personal data using cookies for other purposes is Article 6(1)(a) of the UK GDPR, where the user has given consent.

E.3. Retention Period

We distinguish between: Temporary cookies (session cookies), which are deleted when the user closes the browser; and Permanent cookies, which remain stored even after the browser is closed and may have a duration of up to two years.

E.4. Right to Withdraw Consent

Users have the right to withdraw their consent at any time by changing their Cookie Settings. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

It is also possible to deactivate or limit the storage of cookies by changing your internet browser settings.

E.5. Cookie Consent Management Procedure

We use a cookie consent management procedure that allows us to obtain, manage and revoke consent. Consent is retained to demonstrate compliance with legal obligations and may be maintained for up to two years.

F. Specific Data Processing Activities

F.1. Provision of Website and Log Files

Each time our website is visited, data that may allow user identification is temporarily stored.

Data processed: date and time of access, IP address, host name of the accessing device, referring website, pages visited, notification of successful access, amount of data transferred, browser and operating system information, search terms entered, access frequency.

Data subjects: Users (website visitors, users of online services).

Purposes: Temporary storage of data is necessary to enable access to the website. Continued storage in log files is necessary to ensure the functionality of the site and the security of our IT systems.

Legal basis: Legitimate interest (Article 6(1)(f) UK GDPR). The legitimate interest lies in ensuring the secure, reliable and efficient operation of the website.

Retention: Data is deleted as soon as it is no longer necessary for the purposes for which it was collected. For the provision of the website, this occurs at the end of the session. Log files are retained for 7 days and are accessible only to administrators.

F.2. Intermediation Services

Through our website, it is possible to place orders with dealers registered on our platform. The purchase contract for ordered products is concluded directly with the respective specialist dealer. We offer exclusively an intermediation service.

To provide this intermediation service, as well as additional services such as customer support and enquiry management, we process user data from our website.

Data processed: First name, surname, company name, address, telephone number, email address; payment data; contact data; contractual data; usage data; metadata; candidate data.

Data subjects: Users of our website.

Purposes: Provision of contractual services and customer support; security measures; management of enquiries and communications; administrative procedures.

Legal basis: Performance of a contract and pre-contractual measures (Article 6(1)(b) UK GDPR); legal obligation (Article 6(1)(c) UK GDPR); legitimate interest (Article 6(1)(f) UK GDPR). The legitimate interest lies in providing intermediation services via our website.

Retention: Data is deleted upon expiry of legal warranty obligations, generally after 4 years, unless a retention obligation exists for legal archiving purposes. The statutory retention period is ten years for tax-relevant documents and six years for commercial correspondence.

Transfer of data to local dealers: We transfer the following data to the dealer in your area: first name, surname, company name, address, telephone number, email address; payment data; contact data; contractual data.

Transfer of data to EP Equipment: Furthermore, we transfer the following data to EP Equipment Germany, EP Equipment Germany GmbH, Schanzenstraße 35, 51063 Cologne, Germany, and to EP Equipment Europe BVBA, Gustave Demeurslaan 69 – 1, 1654 Huizingen, Belgium, to enable dealers to make deliveries and support them in the dispatch process.

F.3. Payment Processing

In the context of our contractual relationships, we offer efficient and secure payment options through the use of payment service providers.

The data processed by payment service providers includes personal data, bank details, passwords, TANs and verification codes. However, the data entered is processed and stored exclusively by the respective payment service providers. In some cases, such data may be transmitted by these providers to credit agencies for identity and credit checks.

Data processed: First name, surname, company name, address, telephone number, email address; payment data; contractual data; usage data; metadata; contact data; content.

Data subjects: Customers; potential customers; users.

Purposes: Provision of contractual services and customer support; feedback management.

Legal basis: Performance of a contract and pre-contractual measures (Article 6(1)(b) UK GDPR).

Retention: Data is deleted after 14 months.

F.4. Registration, Login and User Account

Users can create a user account. During registration, the mandatory data required to create the account is collected and processed. It is also possible to purchase products without creating an account.

During the use of the registration and login functions, we store IP addresses and timestamps of user actions to prevent misuse.

Data processed: First name, surname, company name, address, telephone number, email address; contact data; content; metadata.

Data subjects: Users.

Purposes: Provision of contractual services and customer support; security measures; enquiry management; provision of online services.

Legal basis: Performance of a contract and pre-contractual measures (Article 6(1)(b) UK GDPR); legitimate interest (Article 6(1)(f) UK GDPR). The legitimate interest lies in providing users with access to personalised functionalities, managing user accounts and ensuring the secure and efficient operation of the registration system.

Retention: Data is deleted after 24 months.

Additional information – Registration with real name: Due to the nature of our service, we require users to register using their real name. The use of pseudonyms is not permitted.

F.5. Contact and Enquiry Management

When you contact us via our contact or enquiry forms, we process the data of data subjects to the extent necessary to respond to enquiries received.

Data processed: First name and surname, company name, email address, telephone number, postal address, IP address, browser information (user agent), referring URL. Data is collected only when the user actively submits an enquiry.

Data subjects: Communication partners; customers; potential customers; business and contractual partners; users.

Purposes: Enquiry and communication management; administration; feedback; provision of online services; provision of contractual services; administrative procedures; marketing; conversion tracking.

Legal basis: Legitimate interest (Article 6(1)(f) UK GDPR); performance of a contract and pre-contractual measures (Article 6(1)(b) UK GDPR). The legitimate interest lies in enabling efficient communication with users, managing enquiries and providing the requested information or assistance.

Retention: Data is deleted after 24 months.

F.6. Newsletter and Advertising Communications

You have the option to subscribe to our newsletter to receive information about our current offers and interesting content. This requires your explicit consent. The products and services advertised are specified in the declaration of consent.

For newsletter registration, we use the double opt-in procedure. This means that, after registration, we will send you an email to the address provided, asking you to confirm that you are the owner of the email address and that you wish to receive the newsletter.

If you do not confirm your registration within 24 hours, your data will be blocked and automatically deleted after one month.

Furthermore, we store the IP addresses used and the timestamps of registration and confirmation. This process serves to prove registration and, if necessary, to investigate any misuse of personal data.

The only mandatory data required to receive the newsletter is your email address. The provision of additional information marked as optional serves exclusively to address you in a personalised manner.

After confirming registration, we store your email address for the purpose of sending you the newsletter.

Legal basis: Processing takes place on the basis of your consent under Article 6(1)(a) UK GDPR.

You have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

You can withdraw consent and unsubscribe from the newsletter at any time by clicking on the unsubscribe link in each newsletter email.

You can also provide your consent to the analysis of user behaviour in relation to the newsletter. For this purpose, emails contain web beacons or tracking pixels, which are single-pixel image files stored on our website.

We combine the above-mentioned data and web beacons with your email address and an individual ID for analytical purposes.

Using the data collected, we create a user profile to personalise the newsletter according to your interests. We track when you read the newsletter, which links you click on and deduce your personal interests. We may also link this data with actions you take on our website.

You can withdraw consent to this type of tracking at any time (without affecting the lawfulness of processing prior to withdrawal) by clicking on the opt-out link in each email or by contacting us through one of the channels indicated.

Tracking information is retained for as long as you are subscribed to the newsletter. After unsubscribing, the data is anonymised and used only for statistical purposes.

Retention: Data is deleted after 24 months. As mentioned above, if you do not confirm registration within 24 hours, your data will be automatically deleted after one month.

Advertising communications (other than the newsletter): We also process personal data for sending advertising communications (other than the newsletter) through various channels (email, telephone, post, fax), if recipients have given their consent.

Data processed: Name, email address, company name (if provided), marketing preferences and interaction data (e.g. email open rates, link clicks).

We use this data to create a user profile and tailor advertising communications to your individual interests.

Data subjects: Communication partners.

Purposes: Sending advertising communications (direct marketing).

Legal basis: Consent (Article 6(1)(a) UK GDPR). Recipients have the right to withdraw their consent at any time.

Retention: Data is deleted after 24 months.

F.7. Analytics and Marketing

Google Analytics: We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The purpose of using this tool is to analyse user interactions with our website and use the resulting statistics and reports to improve our services and make them more interesting for you as a user.

We primarily collect interactions between you as a user and our website through cookies, device/browser data, IP addresses and site or app activity. Google Analytics also records anonymised IP addresses to ensure the security of the service and provide regional information about users (known as “IP geolocation”). With the anonymisation function (“IP masking”), Google shortens IP addresses within the EU/EEA by removing the last octet.

Google acts as a data processor, and we have entered into an appropriate data processing agreement with Google. The information collected about the use of our website and anonymised IP addresses is usually transmitted to a Google server located in the United States and processed there. In such cases, Google adheres to the EU-U.S. Privacy Framework.

Legal basis: Data processing takes place on the basis of your consent under Article 6(1)(a) UK GDPR.

Data is processed for a maximum period of 24 months. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

The easiest way to withdraw consent is via our cookie consent manager, or by installing the browser add-on provided by Google, available at: https://tools.google.com/dlpage/gaoptout?hl=en

Further information on Google Analytics features is available at: https://marketingplatform.google.com/about/analytics/terms/us

Details on data processing when using Google Analytics are provided by Google at: https://support.google.com/analytics/answer/6004245?hl=en

General information on data processing by Google, also applicable to Google Analytics, can be found in Google’s privacy policy: https://www.google.com/policies/privacy

HubSpot: Our website is hosted by HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA (“HubSpot”). The purpose of using this tool is to host our website, as well as a CRM tool, for marketing automation, email campaigns, integration of contact forms and live chat. HubSpot helps us manage user enquiries, optimise sales flows and improve customer interaction.

In this context, we use cookies for analytics and marketing purposes. The purpose of using tracking cookies is to analyse user interactions on websites and use the resulting statistics and reports to improve our services and measure campaign performance.

HubSpot acts as a data processor, and we have entered into an appropriate data processing agreement with HubSpot, available at: https://legal.hubspot.com/dpa

The legal basis for the use of tracking cookies and for processing data collected through these cookies (for a maximum of 24 months) is your consent (Article 6(1)(a) UK GDPR). You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Further information on HubSpot features is available at: https://www.hubspot.com/products

HubSpot’s privacy policy is available at: https://legal.hubspot.com/privacy-policy

Google Ads: We use the Google Ads service to draw attention to our offers through advertisements. If you access our website through a Google ad, Google Ads will store a cookie on your device. The legal basis for processing your data is Article 6(1)(a) UK GDPR, i.e. this integration only occurs with your consent. You can withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Ads are provided by Google through so-called “ad servers”. We and other websites use ad server cookies that can measure certain performance metrics such as ad impressions or user clicks. The cookies stored by Google Ads on our site allow us to understand the success of our advertising campaigns. These cookies are not intended to identify you personally. Typically, the analytical values stored in this cookie include: a unique cookie ID, number of impressions per ad (frequency), last impression (relevant for post-view conversions) and opt-out information (indicating that a user no longer wishes to be targeted).

The cookies set by Google allow Google to recognise your internet browser. If a user visits certain pages on an Ads customer’s site and the cookie stored on their computer has not yet expired, Google and the customer can recognise that the user clicked on the ad and was redirected to that page. Each Ads customer is assigned a different cookie, so cookies cannot be tracked across the websites of different Ads customers. By integrating Google Ads, Google is informed that you have visited a relevant part of our site or clicked on one of our ads. If you are registered with a Google service, Google can associate your visit with your account. Even if you are not registered or not logged in, it is possible that Google may identify and store your IP address.

Due to the marketing tools used, your browser automatically establishes a direct connection to Google servers. We do not personally collect data during these advertising activities; we only provide Google with the means to collect such data. We only receive statistical reports from Google indicating which ads were clicked, how many times and at what price. We do not receive further data nor can we identify users from this information.

You can withdraw consent at any time without affecting the legality of processing carried out before the withdrawal. You can withdraw consent most easily through our consent manager or through the following methods: (a) by changing your browser settings, in particular by blocking third-party cookies, which will prevent receiving third-party ads; (b) by setting your browser to block cookies from the domain “www.googleadservices.com” at https://www.google.de/settings/ads (note: this setting will be deleted if you delete your cookies); (c) by deactivating interest-based ads through providers participating in the “About Ads” self-regulatory campaign at https://www.aboutads.info/choices (note: this setting will also be deleted if you delete your cookies); (d) by permanently disabling ads in your browser (Firefox, Internet Explorer or Google Chrome) through the following link: https://www.google.com/settings/ads/plugin.

Retention: Data is deleted after 24 months.

Further information on data protection by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is available at: https://www.google.com/intl/en/policies/privacy and https://services.google.com/sitestats/en.html

Meta Pixel: This website also uses advertising measures provided by Meta Inc., 1601 S California Ave, Palo Alto, California 94304, USA (“Meta”). By integrating the so-called “Meta Pixel” on our website, we can show our advertising campaigns (“Meta Ads”) to users of our site and Meta’s social networks, as well as measure and evaluate their effectiveness (“conversion tracking”). The connection between Meta and our site is technically established through the Meta Pixel. The legal basis for processing your data is Article 6(1)(a) UK GDPR, so this integration only occurs with your consent. You can withdraw consent at any time, without affecting the lawfulness of processing based on consent before the withdrawal.

Due to the marketing tools used, your browser automatically establishes a direct connection with Meta’s server when you visit our site. We have no control over the scope and further use of data collected by Meta through this tool and inform you accordingly based on the information available to us: by integrating the Meta Pixel, Meta is informed that you have visited a specific page on our site or clicked on one of our ads. If you are registered with a Meta service, Meta can associate your visit with your account. Even if you are not registered or have not logged in, Meta may identify you through your IP address and other identifiers and use this information to create a user profile.

The information collected is stored on Meta servers, including those in the United States. In such cases, Meta adheres to the EU-U.S. Privacy Framework and undertakes to comply with applicable data protection laws for international data transfers.

You can withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal. Registered users can also object through the settings provided by the respective social network.

Retention: Data is deleted after 24 months.

For more information on data processing by Meta, see: Privacy policy: https://www.facebook.com/privacy/policy/?entry_point=about_fb

We also use the remarketing function “Custom Audiences”, which is also based on the Meta Pixel. When you visit our site or other sites that have integrated the Meta Pixel, interest-based ads may be shown to you. This allows us to show you advertising relevant to your interests, making browsing more interesting and more effectively promoting our offers.

Meta Ads Lead Generation Forms: We use so-called Meta Ads Lead Generation Forms on Instagram and Facebook. Meta Ads Lead Generation Forms are provided by Meta Inc., 1601 S California Ave, Palo Alto, California 94304, USA (“Meta”).

Data processed: Name, email address, telephone number, company name (if provided), job title (if applicable) and any other custom field completed by the user (e.g. interests, enquiry content). Data is transmitted only when the user actively submits the form.

Meta Ads Lead Generation Forms are forms hosted on Instagram and Facebook. The completed form is transmitted to us only if the user submits it by clicking the “Submit” button. Before submission, you can review and modify the data entered in the form. Data is transmitted to us and subsequently processed only if you have given your consent. The legal basis for processing your data is Article 6(1)(a) UK GDPR, meaning that this integration only occurs with your consent. You can withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.

Retention: Data is deleted after 24 months.

We have entered into a data processing agreement with Meta, available at: https://www.facebook.com/legal/terms/dataprocessing

CCM19 (Cookie Consent Management): We use the cookie consent management system CCM19, provided by Papoo Software & Media GmbH – Agentur Auguststraße 4, 53229 Bonn, Germany (“Papoo”).

Data processed: Consent ID, time of consent, opt-in/opt-out status, banner language, customer settings in the banner, device data (HTTP agent, HTTP referrer, HTTP page), browser data, date and time of page view, a random ID, consent status, anonymised IP data, IP address recorded in rotating logs every 24 hours.

The legal basis for processing is Article 6(1)(f) UK GDPR (legitimate interest). The processing of personal data in the context of the cookie consent banner is necessary to document and manage user consent choices, thereby ensuring compliance with legal obligations on data protection and telecommunications; the legitimate interest lies in complying with these legal obligations and demonstrating accountability.

Data is deleted after 6 months, unless longer retention is legally required or technically necessary to demonstrate compliance with consent obligations under Articles 5(2) and 7(1) UK GDPR.

Papoo’s privacy policy is available at: https://www.papoo.de/datenschutzerklaerung.html

We have entered into a data processing agreement with the provider, available at: https://www.ccm19.de/en/contract-processing-contract-ccm19.html

F.8. Embedded Functionalities

YouTube: We have integrated YouTube videos into our online offering, which are stored on YouTube.com and can be played directly from our website.

Videos are embedded in “enhanced privacy mode”, which means that no data about you is transmitted to YouTube unless you play the videos. Data is only transferred when you start playback, as described below. We have no influence over this data transmission.

Data processed: IP address, device information, browser type, referring URL, timestamp, viewed video ID and YouTube cookies if you are logged in with an account.

The legal basis for viewing videos is your consent under Article 6(1)(a) UK GDPR, i.e. embedding occurs only after you have given your consent. You can withdraw consent at any time, without affecting the lawfulness of processing based on consent before the withdrawal.

Retention: Data is deleted after 24 months.

When you visit a page on our site that contains a YouTube video, YouTube is informed that you have visited the relevant subpage of the site. In addition, basic data such as your IP address and timestamp is transmitted. This occurs regardless of whether you are logged into a Google account or not.

If you are logged into your Google account, the data will be directly associated with your profile. If you do not want your activity to be linked to your YouTube profile, you must log out of your account before activating the video.

YouTube uses this data (including for users not logged in) to create user profiles for market research, personalised advertising, website optimisation and/or to inform other users of the social network about your activities on our site. You have the right to object to the creation of such profiles. To exercise this right, you must contact YouTube directly.

The information collected is processed on servers managed by Google, including those located in the United States. In such cases, Google complies with the EU-U.S. Data Privacy Framework.

For more information on the purposes and scope of data collection and processing by YouTube, as well as your rights and privacy settings, see YouTube’s privacy policy: https://www.google.com/policies/privacy

WhatsApp: We use WhatsApp Business, a tool provided by Meta Inc., 1601 S California Ave, Palo Alto, California 94304, USA (“Meta”), to facilitate communication with us.

Data processed: Name, telephone number.

Data is transferred only when you use the WhatsApp Business function in our webshop.

The legal basis for processing your data is Article 6(1)(a) UK GDPR, meaning that processing occurs only with your consent. You can withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Retention: Data is deleted after 24 months.

Meta acts as a data processor and we have entered into an appropriate data processing agreement with Meta.

The information collected is stored on Meta servers, including those in the United States. In such cases, Meta adheres to the EU-U.S. Privacy Framework and undertakes to comply with applicable data protection laws for international transfers.

For more information on data processing by Meta, see: https://www.whatsapp.com/legal/privacy-policy

Live chat: We use a live chat on our website, a feature provided by HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA (“HubSpot”) to offer real-time customer interaction.

Data processed: Name, email address.

Data is transferred only when you use the live chat function on our website.

The legal basis for processing your data is Article 6(1)(a) UK GDPR, meaning that processing occurs only with your consent.

You can withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal. The easiest way to withdraw consent is through our consent manager.

Retention: Data is deleted after 24 months.

HubSpot acts as a data processor and we have entered into an appropriate data processing agreement with HubSpot.

The information collected is stored on HubSpot servers in the United States. In such cases, HubSpot adheres to the EU-U.S. Privacy Framework and undertakes to comply with applicable data protection laws for international transfers.

Further information on HubSpot features is available at: https://www.hubspot.com/products

HubSpot’s privacy policy is available at: https://legal.hubspot.com/privacy-policy

Friendly Captcha: We use the Friendly Captcha verification tool to ensure that data is entered by a human.

The provider of the tool is Friendly Captcha GmbH, Am Anger 3-5, 82237 Wörthsee, Germany.

Data processed: IP address, browser data, referring URL, user behaviour data (page interactions).

The legal basis for processing is Article 6(1)(a) UK GDPR (consent). You can withdraw consent at any time, without affecting the lawfulness of processing based on consent carried out before the withdrawal.

Retention: Data is deleted after 30 days.

Further information on Friendly Captcha is available at: https://friendlycaptcha.com

Friendly Captcha’s privacy policy is available at: https://friendlycaptcha.com/legal/privacy-end-users

We have entered into a data processing agreement with the provider, accessible at: https://friendlycaptcha.com/legal

F.9. IT Services and IT Infrastructure

We use IT services and IT infrastructure to provide our website and services.

HubSpot: Our website is hosted by HubSpot, Inc., 25 First Street, Cambridge, MA 02141 USA (“HubSpot”).

HubSpot acts as a data processor, and we have entered into an appropriate data processing agreement with HubSpot.

The legal basis for data transfer to HubSpot is: legitimate interests (Article 6(1)(f) UK GDPR); performance of a contract and pre-contractual measures (Article 6(1)(b) UK GDPR). The legitimate interest under Article 6(1)(f) UK GDPR lies in ensuring the secure, reliable and efficient operation of the website.

Retention: Data is deleted after 24 months.

The information collected is transmitted and processed on servers located in the United States. In such cases, HubSpot adheres to the EU-U.S. Privacy Framework.

HubSpot’s privacy policy is available at: https://legal.hubspot.com/privacy-policy

We also use the customer relationship management (CRM) system provided by HubSpot to manage contacts and enquiry forms mentioned above in Section F.5.

G. Data Deletion

The data we process is deleted in accordance with legal requirements as soon as consent to processing is withdrawn or other authorisations cease to be valid.

If data is not deleted because it is necessary for other legally permitted purposes, its processing is limited to those purposes. The data is blocked and not processed for other purposes.

This applies, for example, to data that must be retained for commercial or tax reasons or for the exercise of legal rights.

H. Security Measures

We implement appropriate technical and organisational measures in accordance with legal requirements, taking into account the state of the art, implementation costs, the nature, scope, circumstances and purposes of processing, as well as the risk to the rights and freedoms of natural persons.

Measures include safeguarding the confidentiality, integrity and availability of data, controlling physical and electronic access, as well as access, input, disclosure, availability and separation of data.

H.1. IP Address Masking

If IP addresses are processed by us or by the service providers we use, and if processing of a complete IP address is not necessary, the address is masked (pseudonymised). The last digits or the final part of the IP address are removed or replaced with generic values.

H.2. TLS Encryption (https)

To protect data transmitted through our online service, we use TLS encryption.

Such connections are recognisable by the “https://” prefix in the browser’s address bar.

I. Rights of Data Subjects

As data subjects, you have various rights under the UK GDPR:

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) or (f) UK GDPR, including profiling based on those provisions.

The data controller will no longer process your personal data unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal rights.

If data is processed for direct marketing purposes, you have the right to object at any time. If you object, your personal data will no longer be processed for such purposes.

Right to withdraw consent: You can withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

Right of access: You have the right to obtain confirmation as to whether personal data concerning you is being processed, as well as access to such data.

Right to rectification: You have the right to request rectification or completion of inaccurate personal data concerning you.

Right to erasure and restriction of processing: You can request the erasure of personal data concerning you or, alternatively, restriction of processing.

Right to information: If you have exercised the right to rectification, erasure or restriction of processing, the controller is obliged to communicate these changes to all recipients to whom your data has been disclosed, unless this is impossible or involves disproportionate effort. You have the right to be informed by the controller about these recipients.

Right to data portability: You have the right to receive personal data concerning you in a structured, commonly used and machine-readable format and to transmit it to another controller.

Right not to be subject to decisions based solely on automated processing: You have the right not to be subject to decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, unless the decision: (1) is necessary for the performance of a contract between you and the controller; (2) is authorised by UK law that provides appropriate measures to protect your rights and interests; or (3) is based on your explicit consent.

Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Website: https://ico.org.uk

J. Changes and Updates to the Privacy Policy

We will update our privacy policy whenever there are changes in the processing of personal data. You will be informed directly if changes require specific action on your part (e.g. giving new consent) or personal communication.

Please note that the contact details of the companies and organisations mentioned in this privacy policy may change over time. Therefore, it is advisable to verify their accuracy before contacting us.