1. Who is responsible
SPA SALES LTD, trading as SPA Wholesale, is the controller of personal data we use to handle website enquiries and manage our business relationships. Company number: 16275517. Registered office: C/O Atria Accountants Ltd Imperial House, 79–81 Hornby Street, Bury, England, BL9 5BN. For privacy enquiries or to exercise your rights, email sales@spawholesale.co.uk or write to us at that address.
2. Information we collect
If you contact us, we receive the name, business name, email address, product category and message you provide, together with subsequent correspondence. If a trade relationship follows, we may also process business contact details, delivery and invoice information and transaction records.
Our hosting and email services process technical information needed to deliver and protect the service, such as IP addresses, request times, browser information and error logs. The enquiry form uses a short-lived security session and hashed IP-based rate limiting. Please do not submit special-category information, banking credentials or payment card details through the form.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Respond to trade enquiries and communicate with business contacts | Legitimate interests in answering genuine requests and managing business relationships. Where you are personally a contracting party, taking requested steps before a contract or performing it may apply. |
| Fulfil agreed orders, deliveries and customer support | Contract where the individual is a contracting party; otherwise legitimate interests in fulfilling the business contract. |
| Accounting, tax and legally required records | Compliance with legal obligations. |
| Prevent abuse, protect the form and maintain service security | Legitimate interests in protecting visitors, communications and our systems. |
| Deal with complaints or legal claims | Legitimate interests in investigating issues and establishing, exercising or defending legal rights; legal obligations where applicable. |
We consider the effect on individuals when relying on legitimate interests. You can object where that basis applies. We do not add you to a marketing list because you submit this form. This website does not use advertising pixels or analytics scripts, and we do not make automated decisions producing legal or similarly significant effects about you.
4. Who receives it
Authorised people handling enquiries and trade administration can access relevant information. Our hosting and email service providers process information to operate the website and deliver correspondence. For actual orders, relevant information may also be shared with delivery providers, payment providers, accountants, legal advisers and public authorities where needed or required by law. We do not sell personal information.
Service providers may process information outside the UK. Where a restricted international transfer is involved, the applicable transfer requirements must be met, such as adequacy regulations or approved contractual safeguards and any required assessment. Contact us for information about the arrangements relevant to your enquiry or to request details of safeguards.
5. Retention
Our standard schedule is to retain unsuccessful or inactive enquiries for up to 12 months after the last meaningful contact, unless a continuing business need or dispute requires longer. For an active trading relationship, relevant correspondence is retained while needed to manage that relationship and legal claims. Accounting and transaction records are normally kept for six years after the relevant financial year, or longer where the law requires.
The form does not maintain a database of message submissions; enquiries are delivered to our business mailbox. Form security session data is temporary and subject to server session expiry; the session cookie lasts until the browser session ends. Hashed rate-limit files are eligible for deletion after 24 hours and are cleaned on subsequent form activity. Hosting and mail service logs and backups follow the service provider’s retention settings; contact us for the arrangements applying to your data.
6. Your rights
Depending on the circumstances, you may ask for access, correction, erasure, restriction, portability or object to processing, including processing based on legitimate interests. If processing is based on consent, you can withdraw that consent without affecting earlier lawful processing. Some rights have legal exceptions.
Email us to make a request. We may need proportionate information to verify identity. We normally respond within one month; if a lawful extension is needed, we will explain. Providing enquiry details is voluntary, but without sufficient contact and requirement information we may be unable to respond or progress a quotation.
7. Security and complaints
We use access controls and technical safeguards appropriate to the service, but no internet transmission can be guaranteed completely secure. If you have a concern, please contact us first so we can investigate. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
This notice may be updated when our processing changes. The date shown on this page indicates the latest revision.