PRIVACY POLICY

Last updated: 3rd July 2026
Version: 2.0

1. Introduction & Controller Details

This privacy policy explains how Whittaker Office Supplies Ltd (trading as Unity Dealer Support) collects, uses, stores, and protects your personal data. It applies to visitors to our website, customers, suppliers, and individuals who interact with our services.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.

2. Information We Collect

We collect, use, and share personal data only where we have a lawful basis to do so. The categories we collect include:

We do not intentionally collect special category data (e.g., health, ethnicity, biometrics) or criminal conviction data. If we do, we will notify you and apply additional safeguards.

3. Where We Get Personal Information From

We usually collect personal information directly from you when you place an order, open an account, make an enquiry, complete a form, subscribe to marketing, use our websites, or communicate with us.

We may also receive personal information from third parties, including:

If we collect personal data from a third party, we will inform you of this and provide the details in this policy within a reasonable period (usually within one month) or when we first communicate with you.

4. Children's Data

Our products and services are intended for business customers and are not directed at children under the age of 18.

We do not knowingly collect personal data from children. If we become aware that we have received personal data relating to a child, we will take appropriate steps to delete that information unless we are required by law to retain it.

5. Purposes of Processing and Lawful Bases

We process your personal data for the specific purposes listed below, relying on the lawful bases identified:

Purpose of Processing Lawful Basis
To set up and manage customer accounts, process orders, arrange delivery, provide products and services, and manage returns or complaints. Contract (for individual customers) or Legitimate Interests (for business contacts) to provide and manage our products and services.
To provide quotes, respond to enquiries and communicate with you about products, services, orders or account matters. Legitimate Interests (responding to enquiries/managing relationships) or Contract (if communication relates to an agreement).
To process payments, manage invoices, recover debts, undertake credit checks and maintain financial records. Contract, Legal Obligation (tax/accounting), and Legitimate Interests (managing credit risk and business finances).
To send service communications, such as order confirmations, delivery updates, account notices and important changes to our services. Contract, Legal Obligation or Legitimate Interests in keeping customers informed about services they use.
To send direct marketing about our products, services, offers, news and events. Consent (where required by PECR for B2C) or Legitimate Interests (where the law allows B2B marketing without consent). We always respect opt-outs and objections.
To use cookies and similar technologies on our websites. Consent for non-essential cookies and similar technologies, unless an exemption applies. Strictly necessary technologies are used because they are needed to provide the website or service requested.
To understand and improve our websites, products, services, customer experience and business operations. Legitimate Interests in improving our business and services. Where cookies or similar technologies are used, the cookie rules also apply.
To use customer examples, references, testimonials or case studies. Legitimate Interests in promoting our business, where appropriate. We will seek permission before naming an individual, using a testimonial, using a logo, publishing a case study or providing contact details as a reference.
To comply with legal duties, respond to regulators or law enforcement, resolve disputes, enforce our terms and protect our business. Legal Obligation and Legitimate Interests in protecting our legal rights and complying with lawful requests.

Where we rely on Legitimate Interests as a lawful basis, we have assessed that our interests are not overridden by the rights and freedoms of affected individuals. We apply appropriate safeguards and consider the privacy impacts before processing personal data under this lawful basis.

6. Direct Marketing

We may contact you with marketing about products and services that we think may be relevant to you or your organisation. Marketing may be sent by email, telephone, post, social media or online advertising, depending on the contact details available and the rules that apply.

Consent and PECR Compliance

Where PECR requires consent, we will only send electronic marketing if we have valid consent or another permitted basis, such as the soft opt-in for relevant existing customer marketing. Where business-to-business marketing is permitted without consent, we rely on our legitimate interests in promoting our products and services, subject to your right to object.

Opting Out and Suppression

You can opt out of marketing at any time by using the unsubscribe link in our emails or by contacting us. We may keep a suppression record to make sure we do not send you further marketing where you have opted out or objected.

Third-Party Data

If we receive marketing contact details from a third party, such as a trade body or marketing partner, we expect that third party to confirm that the data was collected and shared lawfully and that appropriate notices and permissions were provided.

7. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to ensure functionality, analyse usage, and deliver relevant content. This section covers all storage and access technologies, including cookies, pixels, tags, local storage, and device fingerprinting.

EvolutionX Platform Cookies (First-Party)

As our site is built on the EvolutionX platform, we use the following cookies. These are primarily "Strictly Necessary" as they are required for the site to function (e.g., logging in, keeping a session, remembering your cart).

This site uses no first party cookies

Mandatory Third-Party Cookies

Optional Third-Party Cookies (Analytics & Marketing)

If you have not consented to non-essential cookies, the following cookies will not be set:

How to Control Cookies

8. Who We Share Personal Information With

We may share personal information with suppliers, delivery partners, payment providers, banks, credit reference agencies, insurers, professional advisers, IT and system administration providers, CRM and marketing platforms, website and analytics providers, regulators, courts, law enforcement bodies and parties involved in a business sale, purchase, merger or restructuring.

We require service providers to protect personal information and use it only for the purposes for which it is provided, unless they are acting as an independent controller and have their own legal responsibilities.

9. International Transfers

Some of our service providers operate outside the UK. When personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

Transparency: We maintain a list of subprocessors and transfer mechanisms, available upon request.

Example: Our customer relationship management system (Salesforce) is hosted in the USA. Transfers are governed by the UK IDTA/SCCs and supplementary technical measures, with regular compliance reviews.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Retention periods are reviewed regularly and include:

Data Category Retention Period
Customer/Supplier Accounts Duration of the relationship + 6 years post-termination
Order & Transaction Records 6 years (Companies Act) / 7 years (HMRC tax requirements)
Marketing & Consent Records Until consent is withdrawn or 2 years after last contact
Suppression/Do-Not-Contact Lists Until opt-out is withdrawn or 3 years
Website Analytics & Usage Data 14–26 months (anonymised where possible)
Finance & Tax Records 6–7 years per HMRC guidance
Correspondence & Support Tickets 3 years unless longer retention is legally required

Data that is no longer needed will be securely deleted, anonymised, or archived in compliance with our records management policy.

11. Your Rights Under UK GDPR & DPA 2018

You have the following rights regarding your personal data:

Response Timeframe & Identity Verification: We will respond to valid requests within one month, extendable by two months for complex requests. We may request reasonable identification to verify your identity and prevent unauthorised disclosures.

Requests are normally free of charge. However, where a request is manifestly unfounded, excessive or repetitive, we reserve the right to charge a reasonable administrative fee or refuse the request in accordance with UK GDPR.

ICO Complaints: If you believe your data has been mishandled, you may lodge a complaint with the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/

12. Customer References & Case Studies

We may reference corporate customers in marketing materials, tenders, or case studies to demonstrate our service quality. This is based on our Legitimate Interests in promoting our business.

To protect privacy and comply with data protection principles:

13. Security & Data Breaches

We implement appropriate technical and organisational measures to protect your data, including encryption, access controls, regular security testing, and staff training. In the event of a personal data breach, we will assess the risks to affected individuals and, where required by law, notify the Information Commissioner's Office and affected individuals without undue delay.

14. Changes to This Policy

We may update this policy to reflect legal, regulatory, or operational changes. Material changes will be communicated via email, website notice, or our cookie banner. The “Last Updated” date at the top indicates the most recent revision.

15. Contact & Privacy Queries

For privacy-related requests, access requests, or to exercise your rights, contact:

Whittaker Office Supplies Ltd

  • 📝 marketing@whittakerworkplace.co.uk
  • 📞 01509 235 888
  • 📍 3 Weldon Road, Loughborough, Leicestershire, LE11 5TE, England