This policy explains how Arden Winch & Co Limited ("we", "us", "Arden Winch") uses personal information when you use ardenwinch.com, place an order, open an account or contact us. We are the controller of that information under UK data protection law.

• Company: Arden Winch & Co Limited, registered in England and Wales, company number 01253792
• Registered office: 9 Acres Hill Lane, Sheffield, S9 4LR
• Privacy contact: privacy@ardenwinch.com
• Telephone: 0114 243 3755
• ICO registration number: ZA036270

We collect information you give us and information created when you use the website.

What	Examples	How we get it
Contact details	Name, job title, company, delivery and billing addresses, email, phone	Orders, account or trade applications, enquiries, phone and email orders
Account details	Login email, password (stored encrypted), saved addresses	When you create an account
Order and payment details	Items bought, order history, invoices, payment status. Card details are handled by our payment provider and we do not store full card numbers	Checkout, account orders, invoices
Credit and account information	Trade references, credit limit and payment history for account customers	Account applications and trading
Communications	Emails, contact form messages, call notes	When you contact us or we contact you
Technical data	IP address, browser and device type, pages viewed, basket session data	Automatically through the website, server logs and cookies

We do not knowingly collect special category data (such as health information).

We only use personal information where UK GDPR gives us a lawful basis to do so.

Purpose	Lawful basis
Taking, delivering and invoicing orders, and managing your account	Contract
Credit checks, collecting payment, keeping accounting and tax records	Contract, legal obligation, legitimate interests (managing credit risk)
Customer service, technical support and handling complaints or returns	Contract, legitimate interests
Product safety notices and recalls	Legal obligation, legitimate interests
Emailing existing business customers about similar products and offers	Legitimate interests, with an opt-out in every message
Emailing individuals who are not existing customers, or sending newsletters	Consent
Analysing sales and browsing trends to plan stock and improve the website	Legitimate interests; consent where cookies are involved
Keeping the website and systems secure, preventing fraud	Legitimate interests

We do not use your information for solely automated decisions that have a legal or similarly significant effect on you.

We do not sell personal information. We share it only with organisations that help us run the business, under contracts that require them to protect it and use it only on our instructions:

• [Our payment provider: to be confirmed with Reach before go-live]
• Couriers and carriers that deliver your orders
• Our website hosting provider (ANS) and Reach Studios Ltd, who maintain the website on our behalf
• Our email provider (Microsoft 365 Exchange, hosted in the UK)
• Our ERP system, OrderWise, which receives order and customer account data so we can process and invoice orders and manage stock
• Google (Google Analytics 4 and Google Tag Manager), only if you accept analytics cookies (see section 6)
• Professional advisers, auditors, insurers and credit reference or debt recovery agencies where needed
• Regulators, law enforcement or courts where we are legally required to

International transfers. Some of our providers (for example Google and payment providers) can process data outside the UK. Where they do, we rely on UK adequacy regulations (including the UK-US Data Bridge for certified US providers), the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

Retention. We keep personal information only as long as we need it:

Information	Kept for
Order, invoice and accounting records	6 years after the end of the financial year (tax and company law)
Customer account details	While the account is active, then 6 years after last order
Enquiries and correspondence	3 years after last contact
Marketing preferences	Until you opt out, plus a suppression record so we respect that
Website server logs	12 months

 

Security. The website uses HTTPS encryption, passwords are stored encrypted, access to personal information is limited to staff who need it, and we review our providers' security. No online system is completely secure, so please keep your login details private.

Your rights. Under UK data protection law you can ask us to:

• give you a copy of your information (access)
• correct anything that is wrong
• erase your information, where we have no good reason to keep it
• restrict how we use it
• hand over information you gave us in a portable format
• stop using it for direct marketing at any time, or object to use based on legitimate interests
• withdraw consent, where we rely on it, without affecting earlier use

Email privacy@ardenwinch.com. We may ask you to confirm who you are and will reply within one month. We will carry out reasonable and proportionate searches to find your information. If your request is complex we may extend the deadline by up to two further months, and we will tell you why. We do not charge a fee unless a request is clearly unfounded or excessive. We may refuse erasure where we must keep information for a legal claim, tax or accounting rule, or an unpaid account.

Cookies are small files a website saves on your device. We use them under the Privacy and Electronic Communications Regulations (PECR), as updated by the Data (Use and Access) Act 2025. Cookies that are strictly necessary for the site to work are set without asking. All others are only set if you accept them in the cookie notice, and you can change your choice at any time: [how to change choice depends on the consent tool chosen, e.g. a "Cookie settings" link in the footer]. We will not make rejecting cookies harder than accepting them.

Category	Purpose	Consent needed	Examples
Strictly necessary	Keep your basket, login session, checkout and site security working	No	Session, basket, login and checkout cookies, for example PHPSESSID, form_key, mage-cache-sessid, private_content_version, section_data_ids, and the record of your cookie choice (user_allowed_save_cookie)
Preferences	Remember choices such as whether prices show with or without VAT	Yes, unless essential to a feature you asked for	[Confirm once the site is final, for example the inc/ex VAT price setting]
Analytics	Count visits and show which pages and searches are used so we can improve the site	Yes	Google Analytics 4 via Google Tag Manager (_ga, _ga_*) [once added to the site]; site search tracking (STUID, STVID)
Marketing and social	None in use at present. If we add advertising or social sharing tools in future they will only run with your consent	Yes	None

You can also block or delete cookies in your browser settings. Blocking essential cookies may stop the basket and checkout working. Third parties that set cookies have their own privacy policies, such as Google's.

Marketing. Newsletter sign-ups are opt-in only. We email business customers about similar products only where you have not opted out, and everyone else only with consent. Every marketing email has an unsubscribe link, or you can write to privacy@ardenwinch.com.

Children. The website is for businesses and adults. We do not knowingly collect information from anyone under 18.

Other websites. Links to other sites are not covered by this policy.

Complaints. If you are unhappy with how we use your information, contact privacy@ardenwinch.com first and we will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes. We will update this policy if our practices or the law change. Last updated: [date of go-live].

Contact. Arden Winch & Co Limited, 9 Acres Hill Lane, Sheffield, S9 4LR. Email privacy@ardenwinch.com. Telephone 0114 243 3755.