Privacy Policy

1. Scope of this policy

We may process personal information about you when you:

• visit or use the GRP Express website;
• browse, search for or purchase products;
• create or use a customer account;
• apply for, operate or administer a GRP Express trade account;
• apply for credit facilities or agreed payment terms;
• request a quotation or submit a project or product enquiry;
• ask us to cut, fabricate, prepare or supply products to your requirements;
• use trade-only tools, saved projects or account-specific functionality;
• contact us by telephone, email, website form or another communication channel;
• subscribe to newsletters or other marketing communications;
• interact with our advertising or social media content;
• provide feedback, reviews or testimonials;
• take part in a survey, promotion or competition;
• attend an event, exhibition or meeting involving GRP Express; or
• otherwise do business or communicate with us.

This policy applies to personal information relating to identified or identifiable individuals. It does not apply to information that has been irreversibly anonymised so that an individual can no longer be identified. We may use properly anonymised and aggregated information for analysis, service improvement, stock planning and business reporting.

Where we obtain personal information from another source rather than directly from you, we will provide appropriate privacy information within the period required by law unless an applicable exemption applies.

2. Information we collect

The personal information we collect depends on how you interact with GRP Express and the products, accounts and services you use.

Identity and contact information

This may include:

• your name;
• job title and role;
• company or organisation name;
• billing and delivery addresses;
• email address;
• telephone and mobile numbers; and
• other contact details you provide to us.

Customer and account information

Where you create a GRP Express customer or trade account, we may process information including your account identifier, contact details, login information, saved addresses, account preferences, previous orders, quotation history, saved projects, trade pricing information and other account activity.

You are responsible for keeping your account credentials secure. We do not ordinarily ask you to disclose your password to us.

Order and transaction information

This may include:

• products ordered;
• quantities, specifications, colours and dimensions;
• cutting and fabrication requirements;
• order values;
• discounts and promotional pricing;
• trade or account-specific pricing;
• delivery instructions;
• delivery contact information;
• purchase history;
• returns, refunds and warranty information;
• invoices, credit notes and transaction records; and
• communications relating to your order.

Payment information

When you make a payment, payment information may be collected and processed by the payment service provider used to complete the transaction.

Where payment card information is entered directly into a secure payment service operated by a third-party payment provider, we may not receive or store your complete payment card details. We may receive limited transaction information necessary to confirm, administer, refund or reconcile payments.

Trade account and credit information

If you apply for a GRP Express trade account, credit account or another commercial facility, we may collect additional information about you and the organisation you represent.

This may include:

• business name and company registration details;
• registered and trading addresses;
• VAT information;
• company officers or relevant business contacts;
• purchasing contacts;
• accounts payable contacts;
• bank or payment information where required;
• trade references;
• credit information;
• credit limits and payment terms;
• payment history;
• account-specific prices and commercial terms;
• quotation and order history;
• saved projects and purchasing information; and
• information obtained from credit reference, fraud-prevention or publicly available business information sources where appropriate.

Quotation, technical and project information

When you request a quotation, product recommendation, cutting service, panel optimisation, material planning or technical assistance, we may collect information relating to your project or application.

This may include:

• drawings;
• dimensions;
• cut lists;
• panel layouts;
• quantities;
• material requirements;
• project references;
• delivery requirements;
• site information; and
• other information necessary to understand and respond to your requirements.

Communications

We may retain records of communications between you and GRP Express, including emails, website enquiries, online communications, telephone enquiries and correspondence relating to quotations, accounts, orders, deliveries or customer service matters.

Website and technical information

When you visit our Website, we may automatically collect certain technical information, which may include:

• IP address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from technical information;
• referring website;
• pages viewed;
• products viewed or searched for;
• links and buttons used;
• shopping basket activity;
• date and time of visits;
• session information;
• login, authentication and password-reset events;
• account, quotation, project and restricted-tool activity;
• security, fraud-prevention and access logs; and
• cookie and similar technology identifiers.

Marketing preferences

We may record whether you have requested or agreed to receive marketing from us, the types of communication you are interested in and any decision to unsubscribe or object to marketing.

Feedback, reviews, photographs and case studies

Where you provide a review, testimonial, customer feedback, photograph or information for a case study, we may process that information for customer service, business improvement and, where we have appropriate permission, marketing and promotional purposes.

Special category personal data

GRP Express does not ordinarily need to collect sensitive or special category personal data in order to sell and supply GRP products.

We ask that you do not provide sensitive personal information unless it is genuinely necessary. Where we need to process special category personal data, we will only do so where an appropriate lawful basis and any additional legal condition required by law applies.

3. How we collect your information

We may obtain personal information:

• directly from you;
• from the organisation you work for or represent;
• when another customer or business contact provides your details as a delivery, purchasing, accounts or project contact;
• through your use of our Website and online store;
• through customer or trade account applications;
• through cookies and similar technologies;
• from our payment, delivery, logistics and service providers;
• from publicly available business sources;
• from credit reference or fraud-prevention services where relevant;
• from trade references where provided or requested; and
• from events, exhibitions, meetings and other legitimate business interactions.

4. How and why we use your information

We only process personal information where we have an appropriate lawful basis for doing so.

Information you are required to provide

Some personal information is required so that we can enter into or perform a contract, comply with a legal obligation, verify an account, process a payment, assess a credit application or deliver Products safely.

We will normally identify required information at the point of collection. If you do not provide information that is reasonably necessary, we may be unable to open or administer an account, provide credit, prepare a quotation, process an order, arrange delivery, investigate an issue or provide the requested service.

Legitimate interests

Where we rely on legitimate interests, we consider whether the processing is necessary for a genuine business purpose and whether your interests, rights or freedoms override that purpose.

Our legitimate interests may include:

• operating and developing GRP Express;
• providing efficient customer service;
• responding to commercial and technical enquiries;
• managing customer and trade relationships;
• administering trade accounts;
• managing commercial pricing and credit risk;
• improving our Website and ecommerce experience;
• understanding customer demand and product performance;
• preventing fraud and misuse;
• protecting our systems and business;
• recovering debts;
• keeping appropriate business records; and
• marketing our products and services where permitted by law.

5. Orders and ecommerce

When you place an order with GRP Express, we process personal information in order to accept, administer and fulfil the order.

This may include processing information to:

• confirm product availability;
• process payment;
• apply agreed trade pricing or account terms;
• prepare, cut or fabricate products where requested;
• confirm and administer your order;
• arrange collection or delivery;
• communicate delivery information;
• provide invoices and transaction records;
• manage returns or refunds;
• handle warranties or product issues; and
• respond to questions about your purchase.

We may share relevant delivery information with couriers, hauliers, logistics providers, warehouses or other organisations involved in fulfilling your order.

If you provide personal information relating to another person, such as a site or delivery contact, you should ensure that it is appropriate for you to provide their details and that they understand their information may be used for the purpose of fulfilling the order.

6. Customer accounts and GRP Express trade accounts

Online customer accounts

You may create an online GRP Express account to manage your contact and delivery information, view or manage orders and access other services made available through our Website.

When you create or use an account, we may process information including your name, company name, contact details, billing and delivery addresses, login information, order history, quotation history, saved preferences and other information associated with your account.

GRP Express trade accounts

GRP Express may offer trade account facilities to eligible business customers.

A trade account may provide access to additional commercial features, services, pricing arrangements or functionality that are not available to standard customers.

Approved trade account features may include:

• trade or account-specific pricing;
• quantity-based pricing or commercial terms;
• saved projects and material requirements;
• saved quotations and quote baskets;
• previous order history and faster reordering;
• project-specific ordering information;
• cut lists and cutting requirements;
• panel optimisation or material planning tools;
• account-specific delivery arrangements;
• credit facilities or agreed payment terms where approved; and
• other trade-only services or purchasing tools introduced by GRP Express.

We may process information generated through your use of these features in order to provide and administer the relevant service, maintain your account, fulfil orders and quotations and improve the services we provide to trade customers.

Authorised trade account users

A business may nominate more than one individual to access or manage its GRP Express trade account.

Where this occurs, we may process the personal information of authorised users for the purpose of managing account access, processing orders, maintaining security and recording relevant account activity.

7. Credit, trade-account and fraud-prevention checks

We may carry out proportionate checks when assessing an application for a GRP Express trade account, credit facility or agreed payment terms.

These checks may be used to:

• verify the identity and status of the applicant business;
• confirm company and trading information;
• verify authorised contacts and company officers where relevant;
• prevent fraud and account misuse;
• assess commercial and payment risk;
• determine eligibility for particular account facilities;
• establish appropriate credit limits and payment terms; and
• manage our ongoing commercial relationship.

Information may be checked against Companies House, publicly available business information, trade references and information already held through the commercial relationship.

Where a customer applies for credit facilities or payment terms, we may obtain or share relevant information with credit reference agencies, fraud-prevention services, trade-reference providers, insurers or other appropriate business-information services.

These organisations may retain a record of a search or enquiry and may use information in accordance with their own privacy information and applicable law.

Information obtained through these checks may be used to decide whether to approve an account or credit facility, establish or change a credit limit or payment terms, require payment in advance, suspend credit, or manage debt and fraud risk.

GRP Express currently applies meaningful human review to trade-account and credit decisions. We do not ordinarily make a decision producing legal or similarly significant effects solely by automated means.

8. Marketing communications

We may use your contact details to tell you about GRP Express Products, services, technical resources, guides, offers, events or other information that we reasonably believe may be relevant to you where permitted by data protection law and the Privacy and Electronic Communications Regulations.

The rules that apply may depend on the communication method and whether the recipient is a company or other corporate body, an individual consumer, a sole trader or another type of individual subscriber.

Depending on the circumstances, we may rely on:

• your consent;
• the electronic-mail soft opt-in for our own similar Products and services where all legal conditions are met; or
• our legitimate interests in appropriate business-to-business marketing where permitted by law.

Publicly available contact information is not treated as consent. Where we use business-contact information obtained from a public or third-party source, we must still have an appropriate lawful basis, provide privacy information where required and respect objections.

Marketing messages will identify the sender and provide a valid and straightforward way to opt out where required.

You can opt out of direct marketing at any time by:

• using the unsubscribe link included in a marketing email;
• replying or using another opt-out method provided in the message;
• changing available communication preferences within your account;
• telling a member of our team that you do not wish to receive marketing; or
• contacting GRP Express.

Opting out of marketing does not prevent us from sending communications that are genuinely necessary for your account, quotation, order, delivery, payment, product safety, security or another ongoing commercial relationship. We will not disguise promotional content as a service message.

9. Cookies and online technologies

Our Website uses cookies and similar storage or access technologies to operate the site, maintain security, remember choices, provide ecommerce functionality and understand how visitors use the Website.

These technologies may include:

• strictly necessary technologies, required for security, shopping baskets, checkout, account access and core Website functionality;
• functional technologies, used to remember choices or provide enhanced functionality;
• analytics and measurement technologies, used to understand Website usage and performance; and
• advertising or marketing technologies, where used, to measure or support advertising and marketing.

We will request consent before using non-essential storage or access technologies where consent is required by law.

Applicable law permits limited categories of low-risk technologies to be used without consent where the relevant legal conditions and safeguards are met. We will identify and manage any such use transparently through our Cookie Policy and consent controls.

Further information about the specific technologies used by GRP Express, their providers, purposes, duration and available controls is provided in our Cookie Policy.

10. Who we share your information with

We do not sell or rent your personal information to third parties.

We may share personal information where reasonably necessary with the following categories of recipient.

Payment providers

We may share transaction information with payment processors, banks and financial service providers involved in processing payments, refunds and fraud checks.

Delivery and logistics providers

We may provide your name, delivery address, contact telephone number, delivery instructions and other information reasonably required to couriers, hauliers, logistics providers and fulfilment partners responsible for delivering your order.

Website, hosting and IT providers

We may use third-party service providers to host, operate, maintain and secure our Website, ecommerce systems, customer and trade accounts, communications, databases and other business systems.

This may include providers supporting WordPress, WooCommerce or associated website and ecommerce functionality.

Customer service, communications and marketing providers

We may use appropriate service providers to support customer enquiries, account communications, email delivery, direct marketing, preference management and related communications.

Analytics and technology providers

Where permitted by applicable law and your cookie choices, analytics or technology providers may process information relating to your use of our Website.

Credit reference and fraud-prevention services

Where appropriate for trade accounts, credit applications, payment risk or fraud prevention, we may share or obtain relevant information from credit reference agencies, fraud-prevention services, trade reference providers or business information services.

Professional advisers, insurers and debt-recovery providers

We may share relevant information with accountants, auditors, insurers, insurance brokers, solicitors, debt-recovery providers and other professional advisers where necessary for them to provide services, manage risk, recover sums due or deal with claims and disputes.

Public authorities and regulators

We may disclose personal information to law enforcement agencies, courts, regulators, tax authorities, government bodies or other competent authorities where required or permitted by law.

Business transactions

If Vital Distribution Ltd or the GRP Express business is involved in a proposed sale, restructuring, merger, investment or transfer of all or part of the business, relevant information may be disclosed to prospective purchasers, investors and their professional advisers subject to appropriate confidentiality and data protection arrangements.

Other disclosures

We may disclose your personal information to another party where you have specifically asked or authorised us to do so, or where another lawful basis for disclosure applies.

11. International transfers of personal information

Some service providers or technology platforms used by GRP Express may process or store personal information outside the United Kingdom.

Where an international transfer is restricted by UK data protection law, we will ensure that an appropriate transfer mechanism applies and will complete any required data-protection test or other transfer assessment.

Depending on the circumstances, safeguards may include:

• applicable UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to recognised standard contractual clauses;
• binding corporate rules where applicable;
• additional contractual, technical or organisational measures; or
• another lawful transfer mechanism or limited exception permitted by law.

You may contact us for further information about the safeguards relevant to a particular transfer and, where available and appropriate, how to obtain a copy.

12. How we protect your information

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Measures may include, where appropriate:

• access controls and role-based permissions;
• account authentication and credential-management controls;
• secure system configuration;
• encryption in transit and, where appropriate, at rest;
• security, access and authentication logging;
• fraud, bot and abuse detection;
• software updates, vulnerability management and system maintenance;
• backup, recovery and business-continuity procedures;
• staff access restrictions, training and confidentiality requirements;
• supplier due diligence and contractual security requirements; and
• incident-response and personal-data-breach procedures.

Security records may include IP address, browser or device information, account identifier, access times, authentication events, requested resources, restricted-service activity and actions taken within an account. We use these records for security, fraud prevention, service integrity, investigation and enforcement of our Website Terms of Use & Acceptable Use Policy.

No internet-based service or information system can be guaranteed to be completely secure. You are responsible for keeping your customer or trade account credentials confidential and should contact us promptly if you believe your account or personal information may have been compromised.

We record and assess personal-data breaches. Where a breach is reportable, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours after becoming aware of it. Where a breach is likely to create a high risk to affected individuals, we will also notify them without undue delay as required by law.

13. How long we retain your information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected and for legitimate legal, accounting, tax, contractual, warranty, fraud-prevention, security and reporting requirements.

When determining an appropriate retention period, we consider:

• the nature, volume and sensitivity of the information;
• the reason it was collected and whether the purpose remains active;
• whether we have an ongoing relationship with you or your organisation;
• whether a customer or trade account remains active;
• contractual, product, warranty and safety requirements;
• credit, payment and debt-recovery obligations;
• applicable accounting and tax requirements;
• relevant legal limitation periods;
• the possibility of complaints, disputes or legal claims;
• fraud-prevention and security requirements; and
• whether information can appropriately be anonymised.

Order, invoice, payment and accounting records are normally retained for at least six years from the end of the relevant accounting period, and may be retained longer where required for an ongoing transaction, tax enquiry, dispute, warranty, legal claim or another lawful reason.

Customer and trade-account information may be retained while the account or commercial relationship remains active and for an appropriate period afterwards to deal with reordering, warranties, credit control, disputes, legal claims, accounting obligations and other legitimate business needs.

Unsuccessful account applications, enquiries and quotations that do not result in an order are periodically reviewed and deleted or anonymised when they are no longer reasonably required.

Security, access and fraud-prevention logs are retained for periods proportionate to the risk, investigation requirements and the purpose for which the record was created.

Marketing information may be retained while we have a lawful basis to use it. Where you opt out, we may retain a minimal suppression record for as long as reasonably necessary to ensure that we continue to respect your preference.

When information is no longer required, we will delete it, anonymise it or securely put it beyond routine use in accordance with our retention procedures.

14. Your data protection rights and complaints

Depending on the circumstances, the lawful basis and applicable data protection law, you may have the following rights.

Right to be informed

You have the right to clear and accessible information about how your personal information is collected and used.

Right of access

You may request confirmation of whether we process your personal information and request access to personal information we hold about you.

Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

Right to erasure

In certain circumstances, you may ask us to delete your personal information. This right is not absolute and may not apply where information must be retained for a lawful reason.

Right to restrict processing

In certain circumstances, you may ask us to restrict how we process your personal information.

Right to data portability

Where applicable, you may have the right to receive certain personal information in a structured, commonly used and machine-readable format and to request transmission to another organisation.

Right to object

Where we process personal information on the basis of legitimate interests or recognised legitimate interests, you may have the right to object. We will consider the circumstances and any compelling legitimate grounds that may allow the processing to continue.

Right to withdraw consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights relating to significant automated decisions

Where applicable law gives you safeguards in relation to a decision based solely on automated processing that has a legal or similarly significant effect, you may be entitled to information about the decision, to make representations, to obtain meaningful human intervention and to contest the decision.

Exercising your rights

You can contact GRP Express to exercise a data protection right. There is normally no fee.

We may request proportionate information to verify your identity or clarify the scope of a request. We will respond within the statutory timescale, normally one month, subject to any lawful extension or pause where further information is reasonably required.

A right may be subject to conditions or exemptions. If we cannot comply fully with a request, we will explain our decision and the available complaint options unless the law permits otherwise.

Making a data protection complaint to GRP Express

You can make a complaint if you believe that we have not handled your personal information in accordance with data protection law. Please use our Contact page and make clear that your message is a data protection complaint.

We will acknowledge a data protection complaint within 30 days of receipt. Without undue delay, we will take appropriate steps to investigate it, keep you appropriately informed and tell you the outcome.

When making a complaint, please explain what happened, when it happened, which information or service is involved and the outcome you are seeking. Do not send passwords, complete payment-card details or unnecessary sensitive information.

Complaining to the Information Commissioner’s Office

We would appreciate the opportunity to resolve your concern directly, but you also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Further information is available at ico.org.uk.

15. Automated decision-making and profiling

GRP Express may use automated processing or profiling to support activities such as fraud detection, Website security, product recommendations, customer segmentation, account administration, credit-risk indicators, stock planning or commercial analysis.

These tools may flag an application, transaction or account for review, but GRP Express currently applies meaningful human review to trade-account and credit decisions and does not ordinarily make decisions about individuals solely by automated means where the decision produces a legal or similarly significant effect.

If we introduce significant solely automated decision-making, we will provide appropriate information about the personal information used, the purpose, the logic or main factors involved, the likely consequences and the applicable lawful basis.

Where required by law, we will enable the affected person to make representations, obtain meaningful human intervention and contest the decision. Additional restrictions and safeguards apply where special category personal information is involved.

16. Children’s information

GRP Express is an ecommerce and trade supply business providing GRP materials and associated products. Our Website and services are not specifically directed at children.

We do not knowingly seek to collect personal information from children where it is not necessary or appropriate for our business activities.

17. Third-party websites and services

Our Website may contain links to websites, services or content operated by third parties.

This Privacy Policy applies to personal information processed by or on behalf of Vital Distribution Ltd in connection with the GRP Express business. We are not responsible for the privacy practices of independent third-party websites or services.

We recommend reviewing the privacy information provided by any third-party service before providing personal information to it.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the GRP Express business, Website, products, services, trade account facilities, technology, service providers or legal obligations.

When we update this Privacy Policy, we will publish the revised version on our Website and update the “Last updated” date shown at the top of the page.

If we intend to use personal information for a materially new purpose, we will assess whether that use is compatible, identify an appropriate lawful basis and provide updated privacy information before the new processing begins where required.

Where a change is significant and applicable law requires us to bring it specifically to your attention, we will take appropriate steps to do so.