PRIVACY POLICY

Last updated: 30 June 2026
Version: 2.0

1. Introduction & Controller Details

This privacy policy explains how Whittaker Office Supplies Ltd (trading as Whittaker Workplace) collects, uses, stores, and protects your personal data. It applies to visitors to our website, customers, suppliers, and individuals who interact with our services.

• Controller: Whittaker Office Supplies Ltd
• Company Number: 02133650
• Registered Office: 3 Weldon Road, Loughborough, Leicestershire, LE11 5TE, England 
• Privacy Contact: marketing@whittakerworkplace.co.uk
• ICO Registration Number: Z7542625

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.

2. Information We Collect

We collect, use, and share personal data only where we have a lawful basis to do so. The categories we collect include:

• Identity & Contact Data: Name, job title, company, address, email, telephone.
• Financial & Transactional Data: Payment details, order history, invoicing, and returns.
• Technical & Usage Data: IP address, browser type, device information, page views, clickstream data, and site performance metrics.
• Profile & Preferences: Account settings, communication preferences, and feedback.
• Correspondence: Emails, calls, chats, or support tickets where you contact us.
• Marketing & Communications Data: Preferences for receiving marketing, and records of your consent or opt-outs.

We do not intentionally collect special category data (e.g., health, ethnicity, biometrics) or criminal conviction data. If we do, we will notify you and apply additional safeguards.

3. Where We Get Personal Information From

We usually collect personal information directly from you when you place an order, open an account, make an enquiry, complete a form, subscribe to marketing, use our websites, or communicate with us.

We may also receive personal information from third parties, including:

• Your employer or colleagues
• Trade bodies
• Publicly available business sources
• Credit reference agencies
• Payment providers
• Suppliers
• Delivery partners
• Marketing partners
• Technology providers

If we collect personal data from a third party, we will inform you of this and provide the details in this policy within a reasonable period (usually within one month) or when we first communicate with you.

4. Children's Data

Our products and services are intended for business customers and are not directed at children under the age of 18.

We do not knowingly collect personal data from children. If we become aware that we have received personal data relating to a child, we will take appropriate steps to delete that information unless we are required by law to retain it.

5. Purposes of Processing and Lawful Bases

We process your personal data for the specific purposes listed below, relying on the lawful bases identified:

Where we rely on Legitimate Interests as a lawful basis, we have assessed that our interests are not overridden by the rights and freedoms of affected individuals. We apply appropriate safeguards and consider privacy impacts before processing personal data under this lawful basis.

6. Direct Marketing

We may contact you with marketing about products and services that we think may be relevant to you or your organisation. Marketing may be sent by email, telephone, post, social media or online advertising, depending on the contact details available and the rules that apply.

Consent and PECR Compliance

Where PECR requires consent, we will only send electronic marketing if we have valid consent or another permitted basis, such as the soft opt-in for relevant existing customer marketing. Where business-to-business marketing is permitted without consent, we rely on our legitimate interests in promoting our products and services, subject to your right to object.

Opting Out and Suppression

You can opt out of marketing at any time by using the unsubscribe link in our emails or by contacting us. We may keep a suppression record to make sure we do not send you further marketing where you have opted out or objected.

Third-Party Data

If we receive marketing contact details from a third party, such as a trade body or marketing partner, we expect that third party to confirm that the data was collected and shared lawfully and that appropriate notices and permissions were provided.

7. Cookies & Tracking Technologies

Our website uses cookies and similar technologies to ensure functionality, analyse usage, and deliver relevant content. This section covers all storage and access technologies, including cookies, pixels, tags, local storage, and device fingerprinting.

EvolutionX Platform Cookies (First-Party)

As our site is built on the EvolutionX platform, we use the following cookies. These are primarily "Strictly Necessary" as they are required for the site to function (e.g., logging in, keeping a session, remembering your cart).

Mandatory Third-Party Cookies

• Google reCAPTCHA: We use Google reCAPTCHA on user-submitted forms and within the checkout to help protect the site from spam and abuse. This is a strictly necessary security feature. You can view Google's privacy policy here.
• YouTube Videos: Product videos are embedded on our site. To comply with UK GDPR, we use youtube-nocookie.com links to ensure no cookies are stored unless you actively play the video.

Optional Third-Party Cookies (Analytics & Marketing)

If you have not consented to non-essential cookies, the following cookies will not be set:

• Google Analytics / Google Ads: For traffic analysis and advertising.
• Stripe: For payment processing security.
• AudioEye: For accessibility services.
• Social Media Pixels: (e.g., Meta, LinkedIn) for marketing purposes.

How to Control Cookies

• Cookie Banner: You can accept, reject, or customise preferences via the cookie consent banner on first visit.
• Browser Settings: You can block or delete cookies through your browser's privacy settings. Note that blocking essential cookies may affect site functionality.
• Third-Party Opt-Outs: Many analytics and advertising providers offer opt-out tools (e.g., Google Ads Settings, Network Advertising Initiative, Digital Advertising Alliance).
• Email Preferences: You can update marketing preferences in your account or via the unsubscribe link in any marketing email.
• Cookie Preferences: You may withdraw or amend your cookie preferences at any time by selecting the Cookie Preferences link available on our website. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

8. Who We Share Personal Information With

We may share personal information with suppliers, delivery partners, payment providers, banks, credit reference agencies, insurers, professional advisers, IT and system administration providers, CRM and marketing platforms, website and analytics providers, regulators, courts, law enforcement bodies and parties involved in a business sale, purchase, merger or restructuring.

We require service providers to protect personal information and use it only for the purposes for which it is provided, unless they are acting as an independent controller and have their own legal responsibilities.

9. International Transfers

Some of our service providers operate outside the UK. When personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

• UK International Data Transfer Agreements (IDTA) or UK Addendum to EU Standard Contractual Clauses (SCCs)
• Adequacy Regulations where the destination country has been deemed adequate by the UK Government
• Supplementary measures (technical, contractual, or organisational) where required

Transparency: We maintain a list of subprocessors and transfer mechanisms, available upon request.

Example: Our customer relationship management system (Salesforce) is hosted in the USA. Transfers are governed by the UK IDTA/SCCs and supplementary technical measures, with regular compliance reviews.

10. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, or as required by law. Retention periods are reviewed regularly and include:

Data that is no longer needed will be securely deleted, anonymised, or archived in compliance with our records management policy.

11. Your Rights Under UK GDPR & DPA 2018

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete data.
• Right to Erasure: Request deletion where data is no longer necessary, consent is withdrawn, or processing is unlawful.
• Right to Restrict Processing: Pause processing in certain circumstances (e.g., accuracy disputes).
• Right to Data Portability: Receive your data in a structured, machine-readable format and transmit it to another controller where applicable.
• Right to Object: Object to processing based on legitimate interests or public task, including direct marketing.
• Right to Withdraw Consent: Where processing relies on consent, you may withdraw it at any time without affecting prior lawful processing.
• Rights Regarding Automated Decision-Making & Profiling: We do not use automated decision-making or profiling that produces legal or similarly significant effects. If we do in the future, we will notify you and provide human intervention rights.

Response Timeframe & Identity Verification: We will respond to valid requests within one month, extendable by two months for complex requests. We may request reasonable identification to verify your identity and prevent unauthorised disclosures.

Requests are normally free of charge. However, where a request is manifestly unfounded, excessive or repetitive, we reserve the right to charge a reasonable administrative fee or refuse the request in accordance with UK GDPR.

ICO Complaints: If you believe your data has been mishandled, you may lodge a complaint with the Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/

12. Customer References & Case Studies

We may reference corporate customers in marketing materials, tenders, or case studies to demonstrate our service quality. This is based on our Legitimate Interests in promoting our business.

To protect privacy and comply with data protection principles:

• We will only use company names unless we have obtained explicit prior consent to include named individuals, job titles, contact details, logos, or testimonials.
• You may opt out of being referenced at any time by contacting [Privacy Email].
• We will not disclose commercially sensitive or confidential information without permission.

13. Security & Data Breaches

We implement appropriate technical and organisational measures to protect your data, including encryption, access controls, regular security testing, and staff training. In the event of a personal data breach, we will assess the risks to affected individuals and, where required by law, notify the Information Commissioner's Office and affected individuals without undue delay.

14. Changes to This Policy

We may update this policy to reflect legal, regulatory, or operational changes. Material changes will be communicated via email, website notice, or our cookie banner. The “Last Updated” date at the top indicates the most recent revision.

15. Contact & Privacy Queries

For privacy-related requests, access requests, or to exercise your rights, contact: