We value and protect customer details. The information we collect from you in the course of processing your orders on-line will be used in a lawful and an abiding manner in accordance with the Data Protection Act of 2018.
Universal Paving UK Ltd ("we", "us", "our") is the data controller for personal data processed through:
| Detail | Value |
|---|---|
| Registered company | Universal Paving UK Ltd |
| Company number | 13542543 (Companies House, England & Wales) |
We collect data from our website to help us understand how many people access it, how it is used and whether there have been any technical problems. This doesn't contain any personal information and we cannot link this data to individual visitors. All the information we collect in this way is deleted periodically. The data we collect includes:
We collect this directly from you (checkout, account sign-up, trade enquiries, support conversations), automatically via cookies and tracking pixels, and from third parties such as our payment providers, delivery couriers, and advertising platforms confirming a transaction or interaction.
| Purpose | Legal basis |
|---|---|
| Processing and delivering orders, pallets and trade accounts | Contract |
| Invoicing, VAT and accounting records | Legal obligation |
| Customer support and handling delivery disputes (e.g. courier investigations) | Contract / legitimate interests |
| Fraud prevention and payment security | Legal obligation / legitimate interests |
| Site personalisation, calculators, stock and pricing display | Legitimate interests |
| Email/SMS marketing, retargeting ads, lookalike audiences | Consent (or legitimate interests for existing customers, UK PECR "soft opt-in") |
| Non-essential cookies, ad pixels (Google, Meta) | Consent |
| Reviews requests (Trustpilot) | Legitimate interests / consent |
| Responding to Subject Access Requests and legal claims | Legal obligation |
We do not use your data for any automated decision-making that produces legal or similarly significant effects without human review.
Our sites use cookies and similar technologies grouped into:
On first visit, UK and EU visitors see a cookie banner where they can accept, reject, or customise non-essential categories. We operate Google Consent Mode: until you give consent, ad-related signals (including ad_user_data and ad_personalization) are withheld or sent in a limited, non-identifying form; conversion and personalised advertising tracking is only enabled after you opt in. You can change your choice at any time via the cookie settings link in the site footer, or by clearing cookies in your browser.
We do not currently run a separate reviews cookie for Reviews.io (legacy integration, no longer sending data) but Trustpilot's review-invitation script is active and covered under Advertising & personalisation.
We send email/SMS marketing (offers, new ranges, trade programme updates) only where you have:
Every marketing email includes an unsubscribe link, and you can opt out of SMS by replying STOP. Opting out of marketing does not affect transactional messages (order confirmations, delivery updates, invoices) or our ability to contact you about an active order or courier dispute.
We share only the data each partner needs to perform its role. We do not sell personal data.
Most processing happens in the UK/EEA. Google and Meta may process data in the United States; these transfers are covered by their standard contractual clauses and UK International Data Transfer Agreements. We do not transfer customer personal data to our India sourcing operations — those relationships are supplier/business contacts, not customer data flows.
| Data | Typical retention |
|---|---|
| Order and invoice records | 6 years (UK tax/accounting requirement) |
| Account data | Duration of account, plus a reasonable period after closure |
| Marketing consent/contact data | Until you unsubscribe or after a period of inactivity |
| Cookie/ad identifiers | Per cookie category, typically 13 months or less |
| Support/dispute correspondence (e.g. courier claims) | Duration of the matter plus 6 years for potential legal claims |
We use technical and organisational measures appropriate to the risk, including encrypted checkout (Shopify PCI-DSS compliant infrastructure), access controls on internal systems, and confidentiality obligations in our contracts with processors. No online system is completely secure, but we review our safeguards regularly.
You have the right to:
To exercise any of these rights, contact us at [insert privacy contact email]. We will respond within one month, as required by law.
Children. Our sites and trade services are directed at adults; we do not knowingly collect personal data from anyone under 18.
Changes to this policy. We may update this policy as our processing, apps or suppliers change (e.g. completing the Pall-Ex migration, adding new ad or support tools). The "last updated" date at the top of this page will reflect any revision, and material changes will be highlighted on the site.
