This notice explains what personal information Packcycle Ltd collects, why we use it, who we share it with and what rights you have. It applies to our website, to our customers and suppliers and to anyone who contacts us. It does not cover information about our employees or about people who apply to work with us.
We review this notice regularly and update it when our practices change. The date at the top shows when it last changed. Where a change is significant we will draw attention to it on our website, and tell affected people directly where the law requires.
1. Who we are
Packcycle Ltd (“we”, “us”, “our”) is the controller of the personal information described in this notice. We manufacture and supply paper packaging to businesses. We are registered in England and Wales under company number 17054394, with our registered office at 7 Wainman Road, Peterborough, England, PE2 7BU.
If you have a question about this notice or about your information, email sahin@packcycle.co.uk or write to us at the address above.
2. What information we collect
We deal mainly with businesses, but information about a named person is still personal information even where it relates only to their work. Depending on how you deal with us, we may collect:
- your name, job title, work email address and work telephone number
- your company name, and addresses for delivery and invoicing
- details of quotations, orders, artwork approvals, deliveries, invoices, payments and disputes
- anything you send us by enquiry form, email or telephone
- if you apply for a credit account, the application form details, trade references, public register information and the results of credit and fraud checks
- if you visit our website, information collected through cookies as described in section 7
- if you visit our premises, CCTV images as described in section 8 We do not ask for and do not knowingly collect special category data, such as health or biometric information. Where information is needed to process a credit application, accept an order or meet a legal obligation, we may be unable to open an account, provide credit or fulfil an order without it.
3. Where we get it
Usually from you directly, when you contact us, place an order or apply for an account. We may also obtain information from Companies House and other public registers, from the trade references you give us, from credit reference and fraud prevention agencies and from our invoice finance and bad debt protection provider. Where we obtain personal information about someone from another source, we provide the required privacy information within one month, or sooner if we contact that person or disclose their information before then, unless an exemption under data protection law applies.
4. Why we use it, and our legal basis
We use personal information for the following purposes:
- To quote for work, take and fulfil orders, deliver goods and invoice you. Legal basis: performing our contract, or taking steps at your request before entering one. Where the customer is a company, we rely on our legitimate interests in dealing with the people who act for it.
- To keep accounting, VAT and statutory records. Legal basis: complying with our legal obligations.
- To assess and manage credit risk, obtain invoice finance or bad debt protection, prevent fraud and recover debts. Legal basis: our legitimate interests in trading responsibly, managing credit risk and being paid.
- To answer enquiries, give support and keep in touch about your account. Legal basis: our legitimate interests in running and improving the business.
- To meet product safety, traceability and packaging obligations and deal with any incident or recall. Legal basis: complying with our legal obligations, and our legitimate interests in product safety.
- To set non-essential cookies on our website. Legal basis: your consent, which you can withdraw at any time.
- To operate CCTV at our premises for security and crime prevention. Legal basis: our legitimate interests in protecting our property and the people on our site.
Where we rely on legitimate interests, we have considered whether those interests are outweighed by the rights of the people concerned. You can ask for more detail about that assessment by emailing sahin@packcycle.co.uk.
5. Automated decisions
We do not make decisions about you by automated means alone, and we do not carry out profiling that produces legal effects or similarly significant effects for you. Credit accounts are offered to limited companies only, so a decision to open, refuse or withdraw an account is a decision about the company rather than about any individual. A credit reference agency, or our invoice finance and bad debt protection provider, may use automated systems to produce a score, set or recommend a limit, or decide whether to fund or insure an account. They are controllers in their own right and make those decisions under their own arrangements and privacy information, which we do not control.
Our provider’s decision determines whether a credit account is available. If it will not fund or insure an account, we cannot offer credit on it. If you ask us why we are unable to offer a credit account, we will tell you what we can. A person at Packcycle decides what we offer you. They cannot change the provider’s decision, but they do decide whether we can supply on other terms, such as payment in advance or a smaller order. You can ask that person to look at the outcome again, tell us anything we have missed and say why you disagree. We will consider it and tell you the result.
If we ever begin making decisions about individuals by automated means alone, we will tell you, explain the logic involved and the consequences for you, and give you the additional rights that apply.
6. Who we share it with
We share personal information only where we need to. That may include:
- couriers and hauliers delivering your order
- our invoice finance and bad debt protection provider, with whom we share order, delivery, invoice, payment and dispute information so they can fund, insure and collect our invoices, which they use under their own privacy information
- credit reference and fraud prevention agencies
- our accountants, insurers, legal and other professional advisers
- our IT, software, email and backup providers, acting on our instructions under a written contract
- debt recovery providers, where an account is overdue
- HMRC, regulators, courts and other authorities where the law requires or permits
- a buyer or prospective buyer, if we sell or reorganise the business, subject to confidentiality We do not sell personal information, and we do not share it for third party marketing.
Transfers outside the United Kingdom. Our suppliers are mainly in the United Kingdom. Where personal information is transferred outside the UK, for example by a cloud or email provider, we make sure the transfer is permitted under UK data protection law. That may be because the destination is covered by UK adequacy regulations, or because an appropriate safeguard is used, such as the International Data Transfer Agreement or the UK Addendum. You may contact us at sahin@packcycle.co.uk for details of any international transfer and to obtain a copy of the safeguards we rely on.
7. Cookies and similar technologies
Our website uses cookies and similar technologies. They fall into three groups.
- Essential cookies, needed to make the site work and keep it secure. These are always set and do not require consent.
- Analytics cookies, which help us understand how visitors find and use the site so we can improve it.
- Functional cookies, set by third party features such as embedded maps, video and our enquiry or chat tools. These providers may set their own cookies and receive information about your visit.
Analytics and functional cookies are only set where you have given consent. We ask for it through the banner shown when you first visit the site, and you can change or withdraw your choice at any time through the cookie settings on our website or by clearing cookies in your browser. Withdrawing consent does not affect anything done before you withdrew it.
8. CCTV at our premises
We operate CCTV at our premises at 7 Wainman Road, Peterborough. The cameras record images of people arriving at, leaving and moving around the site, including staff, visitors, drivers and contractors. The system does not record sound.
We use CCTV to protect the security of the premises, stock and equipment, to prevent and detect crime, and to help keep staff and visitors safe. We do not use it to monitor how individual members of staff perform their work. Signs are displayed so that people know CCTV is in operation before they enter. Access to recordings is limited to a small number of authorised people at Packcycle. We keep recordings only for as long as we need them for the purposes set out above. The system records over older footage automatically, so in normal circumstances recordings are available for a short period only. Where footage is needed for an investigation, an insurance claim or a legal claim, we keep that footage for as long as that requires and no longer.
We may share footage with the police or another law enforcement agency where it is requested in connection with an investigation, with our insurers in connection with a claim, and with our legal advisers.
You can ask for a copy of footage of yourself using the process in section 12. Where footage shows other people we will obscure them if we can, and we may not be able to release footage where doing so would unfairly affect someone else.
9. Marketing
We may use the contact details of customers and business contacts to send information about Packcycle’s packaging products, services and offers we consider may be relevant to them. Our legal basis is our legitimate interests in promoting and developing our business.
We will send electronic marketing only where the Privacy and Electronic Communications Regulations permit it. That may include marketing to companies and other corporate bodies without prior consent. Where consent is required, including in some circumstances involving sole traders and partnerships, we will obtain consent or rely on another lawful exception before sending.
Every marketing message will identify Packcycle and give a clear way to opt out. You can ask us to stop at any time using the unsubscribe option or by emailing sahin@packcycle.co.uk. If you opt out we will stop sending marketing, and keep only the limited information needed on a suppression list so that your preference is respected.
10. How we keep it secure
We take appropriate technical and organisational measures to protect personal information against loss, misuse and unauthorised access. These include limiting access to those who need it, password protected systems, reputable IT suppliers, keeping paper records secure at our premises, and written terms with the suppliers who handle information for us.
If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell the people affected where the law requires.
11. How long we keep it
We keep personal information only as long as we need it:
- customer and account records, including orders, invoices and payment history: six years after the end of our relationship, the ordinary period for a contract claim and for tax records
- unsuccessful credit applications: twelve months, unless longer is needed for fraud prevention or a legal claim
- general enquiries that do not lead to an order: twelve months
- product traceability and food contact compliance records: the period required by the applicable food and product safety rules
- CCTV recordings: kept only for as long as needed, with older footage overwritten automatically, unless footage is needed for an investigation, an insurance claim or a legal claim We may keep information for longer where the law requires it or where it is needed for a dispute or legal claim. When we no longer need information, we delete it or render it anonymous.
12. Your rights
Subject to certain conditions, you have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct information that is inaccurate or incomplete
- ask us to delete information where we no longer need it
- ask us to limit how we use your information
- ask us to transfer certain information to you or someone else
- withdraw your consent where we rely on it, for example for non-essential cookies; this does not affect anything done beforehand Not every right applies in every situation, and we will explain if one does not. To exercise one, email sahin@packcycle.co.uk. There is normally no charge. Where a request is manifestly unfounded or excessive, in particular where it repeats a request we have already answered, we may charge a reasonable fee based on our administrative costs or decline to act on it, and we will tell you why. We may ask you for information to confirm your identity before we act on a request.
We normally respond within one month. If a request is complex or you make several requests, we may extend that by up to two further months, and will tell you within the first month if we need to and why.
Right to object Where we rely on our legitimate interests, you can object because of something about your particular situation. Tell us at sahin@packcycle.co.uk and we will stop, unless we can show compelling reasons that override your interests, rights and freedoms, or we need the information for a legal claim.
You can object to direct marketing at any time, for any reason, and we will always stop.
13. Complaints
If you think we have handled your information badly, please tell us first at sahin@packcycle.co.uk. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, though it is usually quicker to come to us first.