Privacy Policy

Privacy Notice

Last updated: 21st July 2026

1. About this privacy notice

Yorkshire Profiles Ltd respects your privacy and is committed to protecting your personal information.

This privacy notice explains how we collect, use, store and share personal information when you:

• visit our website;
• contact us or request a quotation;
• create or use an online account;
• place or receive an order;
• act as a customer, supplier or business contact;
• subscribe to marketing communications;
• apply for a job with us;
• visit our premises; or
• otherwise communicate or do business with us.

This notice also explains your data-protection rights and how to contact us with a question or complaint.

2. Who we are

Yorkshire Profiles Ltd is the controller responsible for the personal information described in this notice.

Our contact details are:

Yorkshire Profiles Ltd
Unit 6A
Hessay Industrial Estate
Hessay
York
North Yorkshire
YO26 8LE

Telephone: 01904 737095
General enquiries: sales@yorkshireprofiles.co.uk
Privacy enquiries and complaints: quality@yorkshireprofiles.co.uk

3. Our Privacy Contact

Our Privacy Contact is:

Amy Halliwell
Quality Assurance Director
Yorkshire Profiles Ltd

Our Privacy Contact oversees data-protection matters within the business and is the appropriate person to contact about this notice or the way we use personal information.

Yorkshire Profiles Ltd has not appointed a statutory Data Protection Officer. References in this notice to our Privacy Contact do not mean that the individual has been appointed as a Data Protection Officer under the UK GDPR.

4. The personal information we collect

The personal information we collect depends on your relationship and interactions with us.

It may include:

Identity and contact information

• your name;
• job title;
• employer or business name;
• business or delivery address;
• email address;
• telephone number; and
• usernames or other account identifiers.

Account and transaction information

• account-registration information;
• encrypted or securely stored account credentials;
• quotation requests;
• order details and order history;
• delivery instructions;
• invoices, payments and credit information;
• records of products and services purchased;
• customer account references; and
• marketing and communication preferences.

We do not normally store complete debit- or credit-card details. Card payments are processed by our payment-service provider.

Technical and production information

• technical drawings and design files, including DXF or similar files;
• specifications, measurements and manufacturing instructions;
• information contained in correspondence accompanying an order;
• records relating to repeat orders;
• quality-control records;
• complaints, errors and corrective-action records; and
• information recorded in our Problems and Improvements Log.

Technical files will not always contain personal information. However, they may constitute personal information where they identify or can be linked to an individual.

Communications information

• emails, letters and online enquiries;
• notes of telephone conversations;
• customer-service and complaint records;

Website and device information

• IP address;
• browser type and version;
• device type;
• operating system;
• website activity;
• referring website;
• login and session information;
• cookie identifiers;
• cookie preferences; and
• information collected through analytics or similar technologies.

More information is provided in the Cookies section below and in our separate Cookie Notice.

Recruitment information

Where you apply to work with us, we may collect:

• your name and contact details;
• employment history;
• qualifications and experience;
• CV and application information;
• interview notes;
• references;
• information about your right to work;
• salary expectations;
• information needed to make reasonable adjustments; and
• other information you choose to provide.

Recruitment information may sometimes include special-category personal information, such as health information, where this is relevant and lawful.

5. How we collect personal information

We collect personal information directly from you when you:

• contact us;
• complete a website form;
• register for an online account;
• request a quotation;
• place an order;
• send us technical files;
• communicate by telephone, email or post;
• subscribe to marketing;
• visit our premises; or
• apply for a position with us.

We may also receive personal information from:

• your employer, colleague or another authorised representative;
• customers who provide delivery or project contact details;
• suppliers and subcontractors;
• our online quotation or ordering provider;
• payment and credit-service providers;
• accountants, banks and invoice-finance providers;
• delivery and courier companies;
• publicly available business sources;
• recruitment agencies and referees; and
• fraud-prevention or identity-verification services, where used.

If someone gives us information about another person, they should ensure that they are authorised to provide it and should make this privacy notice available to that person.

Receiving information from another person does not remove our responsibility to use it fairly, lawfully and transparently.

6. How and why we use personal information

We only use personal information where we have a lawful basis for doing so.

The lawful bases we most commonly rely upon are:

• contract: where processing is necessary to enter into or perform a contract with you;
• legitimate interests: where processing is necessary for our legitimate business interests or those of another organisation, provided those interests are not overridden by your rights;
• legal obligation: where processing is necessary to meet a legal or regulatory requirement; and
• consent: where you have freely given a specific and informed choice, such as for certain marketing or optional cookies.

Where our customer or supplier is a limited company or other organisation, the contract will generally be with that organisation rather than with its employee. In those circumstances, we will normally rely on our legitimate interests in administering the business relationship and fulfilling the relevant contract.

Enquiries and quotations

We use identity, contact, communication and technical information to:

• respond to enquiries;
• understand your requirements;
• prepare and follow up quotations;
• communicate about potential work; and
• take steps towards entering into a contract.

Our lawful bases are contract or steps requested before entering into a contract, and our legitimate interests in responding to business enquiries and developing customer relationships.

Accounts and online services

We use account information to:

• create and manage online accounts;
• authenticate users;
• keep accounts secure;
• provide online quotation and ordering facilities;
• save information and preferences where requested; and
• provide account support.

Our lawful bases are contract, steps requested before entering into a contract, and our legitimate interests in providing secure and efficient online services.

Creating an account does not constitute consent to all uses of personal information.

Orders, manufacturing and delivery

We use personal, transaction and technical information to:

• receive and process orders;
• manufacture products;
• clarify specifications;
• manage repeat orders;
• arrange subcontracted services where required;
• take payment;
• issue invoices and receipts;
• arrange collection or delivery;
• provide customer support; and
• administer warranties, complaints or returns.

Our lawful bases are contract, steps requested before entering into a contract, legal obligations and our legitimate interests in fulfilling customer orders and managing business relationships.

Payments, accounting and credit control

We use transaction and contact information to:

• process payments;
• maintain financial records;
• conduct credit checks where appropriate;
• manage customer accounts;
• recover amounts owed;
• support invoice-finance arrangements;
• prevent and detect fraud; and
• comply with tax, accounting and audit requirements.

Our lawful bases are contract, legal obligation and our legitimate interests in managing our finances, preventing fraud and recovering debts.

Quality management and repeat orders

We may retain order details, technical files and relevant customer or company information to:

• ensure repeat orders are priced and manufactured correctly;
• maintain product quality;
• investigate errors;
• record corrective and preventative action;
• maintain our quality-management system; and
• support our ISO 9001 certification.

Our lawful basis is our legitimate interests in maintaining quality, preventing repeat errors, ensuring traceability and operating an effective quality-management system.

We will minimise the personal information included in quality records wherever reasonably possible.

Customer service and communications

We use communications information to:

• answer questions;
• manage projects and orders;
• provide customer service;
• record agreed instructions;
• resolve disputes;
• monitor service quality; and
• train relevant members of staff.

Our lawful bases are contract and our legitimate interests in providing customer service, maintaining accurate business records, protecting our position in disputes and improving our services.

Where calls are recorded, we will provide appropriate notification at or before the start of the call.

Website operation and security

We use technical and device information to:

• operate and maintain our website;
• provide essential website functions;
• keep users logged in where required;
• protect accounts and systems;
• detect malicious activity;
• troubleshoot faults;
• manage website capacity and performance; and
• maintain records of cookie choices.

Our lawful basis is our legitimate interests in providing a secure and functional website. Where storage or access technology is strictly necessary to provide a service requested by the user, consent may not be required under applicable electronic-communications rules.

Website analytics and advertising

Subject to your cookie choices, we may use analytics or advertising technologies to:

• understand how visitors use our website;
• measure website performance;
• improve website content and navigation;
• measure advertising effectiveness; and
• understand how enquiries were generated.

Where consent is legally required, these technologies will not be activated unless you give consent.

Our lawful basis for any associated processing of personal information is consent.

Direct marketing

We may use your contact details to send information about our products, services, company news or offers where:

• you have consented;
• applicable business-to-business marketing rules permit us to do so; or
• the electronic-marketing “soft opt-in” applies.

You can object to direct marketing or unsubscribe at any time by:

• using the unsubscribe link in a marketing email; or
• contacting quality@yorkshireprofiles.co.uk.

We may retain limited information on a suppression list after you unsubscribe. This ensures that we do not send marketing to you again accidentally. Our lawful basis for maintaining a suppression list is our legitimate interest in respecting your choice and complying with applicable law.

Recruitment

We use applicant information to:

• assess applications;
• arrange and conduct interviews;
• communicate with applicants;
• verify qualifications and references;
• make recruitment decisions;
• make reasonable adjustments;
• establish and defend legal claims; and
• comply with employment and right-to-work requirements.

Our lawful bases may include steps requested before entering into an employment contract, legitimate interests and legal obligation.

Where we process special-category information, we will also identify and document an additional lawful condition.

Legal, regulatory and business administration

We may use personal information to:

• comply with applicable laws;
• respond to lawful requests from regulators, courts or public authorities;
• establish, exercise or defend legal claims;
• obtain legal, insurance or professional advice;
• conduct audits;
• manage insurance claims;
• prevent or investigate crime, fraud or misuse; and
• support a sale, purchase, restructuring or transfer of all or part of our business.

Our lawful bases are legal obligation and our legitimate interests in protecting and administering our business.

7. Legitimate interests

Where we rely on legitimate interests, those interests may include:

• operating and developing our business;
• responding to enquiries;
• managing customer and supplier relationships;
• manufacturing and delivering orders;
• maintaining accurate business records;
• maintaining product quality and traceability;
• supporting repeat orders;
• securing our website, systems and premises;
• preventing fraud and recovering debts;
• improving our services;
• protecting our legal rights; and
• marketing relevant services to business contacts where legally permitted.

Before relying on legitimate interests, we consider the purpose and necessity of the processing and balance our interests against the rights and reasonable expectations of the people concerned.

You may object to processing based on legitimate interests. See the Your Rights section below.

8. When information is required

Some information is needed so that we can:

• provide a quotation;
• create or administer an account;
• enter into or perform a contract;
• manufacture and deliver an order;
• process a payment;
• issue an invoice; or
• comply with a legal obligation.

Where required information is not provided, we may be unable to provide the relevant quotation, product, service or account facility.

Optional fields will be identified as such where appropriate.

9. Who we share personal information with

We may share relevant personal information with:

• our employees and authorised personnel;
• providers of our website, hosting, online quotation or online-ordering systems;
• IT support and cybersecurity providers;
• payment processors;
• banks and invoice-finance providers;
• accountants, auditors and other professional advisers;
• couriers, hauliers and delivery providers;
• manufacturing subcontractors and finishing-service providers, where necessary to complete an order;
• email and marketing-service providers;
• analytics, advertising and website-performance providers, subject to your cookie choices;
• recruitment agencies, referees and screening providers;
• insurers and insurance advisers;
• certification bodies and quality auditors;
• debt-recovery providers;
• law-enforcement bodies, courts, regulators and public authorities where required or permitted by law; and
• prospective purchasers, sellers or advisers in connection with a business sale, acquisition or restructuring.

We require service providers acting as our processors to use personal information only on our documented instructions, protect it appropriately and comply with applicable data-protection requirements.

Some recipients act as independent controllers and will use personal information under their own privacy notices and legal responsibilities.

We do not sell personal information.

10. Payment processing

We do not normally receive or store complete debit- or credit-card details.

Card payments are processed by:

Lloyds Bank

The payment provider may process information such as your name, billing information, card details, payment amount, device information and fraud-prevention information.

The payment provider may act as an independent controller for some of its activities. You should review the privacy information supplied by the provider when making a payment.

11. International transfers

Some of our service providers may store, access or process personal information outside the United Kingdom.

Where personal information is transferred to a country that is not covered by UK adequacy regulations, we will ensure that an appropriate safeguard or other lawful transfer mechanism is in place where required.

These safeguards may include:

• the UK International Data Transfer Agreement;
• the UK Addendum to the European Commission’s Standard Contractual Clauses;
• another approved contractual safeguard;
• binding corporate rules; or
• a legally permitted exception for a specific transfer.

Where required, we will also assess whether the relevant protection is effective in practice and introduce supplementary measures.

You may contact quality@yorkshireprofiles.co.uk for further information about the safeguards used for relevant international transfers.

12. How long we keep personal information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, accounting, tax, quality-management and reporting requirements.

We may retain information for longer where it is relevant to a complaint, dispute, investigation or legal claim.

Our anticipated retention periods include:

The periods above should be read subject to applicable legal requirements and any need to preserve information in connection with an actual or anticipated dispute.

We periodically review the information we retain and securely delete or anonymise it when it is no longer required.

13. Cookies and similar technologies

Our website uses cookies and similar storage or access technologies.

These technologies may be used to:

• provide essential website functionality;
• maintain website and account security;
• keep users logged in;
• remember cookie choices;
• operate online quotation facilities;
• understand website use;
• improve website performance;
• display embedded content; and
• measure enquiries, telephone calls or advertising performance.

Except where an applicable legal exception applies, we will obtain consent before placing or accessing non-essential technologies on your device.

You should be given a meaningful choice to accept or reject non-essential technologies. You can also change your choices using the Manage Cookies control on our website.

Withdrawing consent will not affect the lawfulness of processing that took place before consent was withdrawn.

Our separate Cookie Notice should identify, for each technology:

• its name;
• its provider;
• its purpose;
• its category;
• how long it operates;
• whether it is first-party or third-party; and
• whether consent is required.

Browser settings may also allow you to block or delete cookies, although blocking essential technologies may affect website operation.

14. Security

We use appropriate organisational and technical measures designed to protect personal information against:

• unauthorised access;
• unlawful use or disclosure;
• accidental loss;
• alteration;
• destruction; and
• damage.

Measures may include access controls, authentication, encryption in transit, system monitoring, backups, staff confidentiality obligations, supplier controls and incident-management procedures.

Access to personal information is limited to employees, workers and service providers who have an appropriate business need.

Although we take reasonable steps to protect personal information, transmitting information over the internet is not completely risk-free.

If we become aware of a personal-data breach, we will assess it, document it and notify the Information Commissioner and affected individuals where required by law.

15. Automated decisions and profiling

We do not currently make decisions that produce legal or similarly significant effects about individuals solely through automated processing.

We may use limited analytics or advertising profiling where you have consented to the relevant technologies. This does not currently result in decisions producing legal or similarly significant effects.

We will update this notice before introducing relevant automated decision-making.

16. Your data-protection rights

Depending on the circumstances, you may have the right to:

Be informed

You have the right to clear information about how we collect and use your personal information.

Access your information

You may ask for confirmation that we process your personal information and request a copy of it.

Correct inaccurate information

You may ask us to correct inaccurate information or complete information that is incomplete.

Request deletion

You may ask us to delete personal information in certain circumstances.

The right to deletion is not absolute. We may need to retain information to comply with a legal obligation, establish or defend legal claims, prevent fraud, maintain a marketing-suppression record or for another lawful reason.

Restrict processing

You may ask us to restrict the way we use personal information in certain circumstances.

Data portability

Where applicable, you may request certain information you supplied to us in a structured, commonly used and machine-readable format or ask us to transmit it to another organisation.

Object to processing

You may object to processing based on legitimate interests. We will stop the relevant processing unless we can demonstrate compelling legitimate grounds or need the information for legal claims.

You have an absolute right to object to the use of your personal information for direct marketing.

Withdraw consent

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights concerning automated decisions

Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.

Complain

You may complain to us or to the Information Commissioner about how your personal information has been handled.

Your rights are subject to the conditions and exemptions set out in applicable data-protection law.

17. How to exercise your rights

To exercise a right, contact:

Email: quality@yorkshireprofiles.co.uk

Post:

Yorkshire Profiles Ltd
Quality Department – Data Protection
Unit 6A
Hessay Industrial Estate
Hessay
York
North Yorkshire
YO26 8LE

Telephone: 01904 737095

Please explain which right you wish to exercise and provide enough information to allow us to identify the relevant records.

We may ask for reasonable proof of identity. If a request is made on behalf of another person, we may ask for evidence of the representative’s authority.

We will normally respond without undue delay and within one month. In some circumstances, the period may be extended as permitted by law. We will explain any extension.

You will not normally be charged a fee. A reasonable fee may be charged, or a request may be refused, where permitted by law—for example, where a request is manifestly unfounded or excessive.

18. Data-protection complaints

You may make a complaint to us if you are concerned about how we have collected, used, stored, disclosed or otherwise handled your personal information.

Complaints may be submitted by:

• emailing quality@yorkshireprofiles.co.uk;
• writing to the address above;
• telephoning 01904 737095;

Please provide:

• your name and contact details;
• an explanation of your concern;
• relevant dates;
• details of any previous correspondence; and
• copies of relevant supporting information.

We will:

• provide appropriate assistance so that you can make your complaint;
• acknowledge receipt within 30 days;
• take appropriate steps to investigate and respond;
• keep you informed of progress where appropriate; and
• tell you the outcome without undue delay.

We may ask for proof of identity or authority where reasonably necessary.

19. Complaining to the Information Commissioner

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: ico.org.uk

We would appreciate the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.

20. Links, embedded content and third-party websites

Our website may contain links to third-party websites or embedded services such as maps, videos, payment pages or online quotation facilities.

Those third parties may collect personal information under their own terms and privacy notices. We do not control third-party websites and encourage you to review their privacy information.

Where an embedded service uses non-essential cookies or similar technologies, it should not be activated until the required consent has been obtained.

21. Children’s information

Our website and services are intended for business and manufacturing customers and are not directed at children.

We do not knowingly collect personal information from children through the website except where necessary and lawful—for example, in connection with work experience, apprenticeships or recruitment.

22. Changes to this notice

We may update this notice to reflect:

• changes to our services or systems;
• new processing activities;
• changes to suppliers;
• legal or regulatory developments; or
• improvements to the way we explain our processing.

The latest version will be published on our website with the date of the update.

Where a change materially affects the way we use personal information, we will take reasonable steps to bring it to the attention of affected individuals before the new use begins, where required.

23. Contact us

For questions about this notice, the information we hold about you or the exercise of your rights, contact:

Privacy Contact
Yorkshire Profiles Ltd
Unit 6A
Hessay Industrial Estate
Hessay
York
North Yorkshire
YO26 8LE

Email: quality@yorkshireprofiles.co.uk
Telephone: 01904 737095