Privacy notice
How Carlton Building Plastics collects, uses and protects personal information.
Who we are
Carlton Building Plastics Limited ("Carlton", "we", "us") is the controller of the personal information described in this notice. We are a company registered in England and Wales, company number 02308251, with our registered office at 6 Beddington Trading Park, Bath House Road, Croydon CR0 4TT. We are registered with the Information Commissioner's Office (ICO), registration number [ICO registration number].
We are a small business and have not appointed a data protection officer. For anything about your personal information, contact us:
- Email: sales@carltonplastics.co.uk
- Phone: 020 8665 1221
- Post: Data Protection, Carlton Building Plastics Limited, 6 Beddington Trading Park, Bath House Road, Croydon CR0 4TT
What we collect
Most of our customers are businesses, but we still hold personal information about the people we deal with. Depending on how you deal with us, we collect:
- Contact details: name, company, job role, email address, phone number, and delivery and invoice addresses.
- Enquiry and order details: what you ask us for, quotes, orders, deliveries, returns, and messages and photos you send us by email, website form or WhatsApp.
- Account and payment details: trade account information, invoices, payment records and credit limits. We do not keep full card numbers; card payments are handled by Worldpay.
- Supplier and contractor details: contact and payment details for people at the businesses that supply us.
- Website and security data: IP address, browser and device details, and the pages requested, which our hosting provider uses to deliver the site and protect it from attack.
- Marketing data: whether you have subscribed to our emails, and whether you open them or click their links.
We collect this from you directly, from your employer or colleagues when they place orders or name you as a contact, from delivery drivers and our team when we deliver, and from public sources such as Companies House. When you apply for a credit account we may also receive information from credit reference agencies.
How we use it and why
Data protection law requires us to have a lawful basis for each use of your personal information. These are ours:
| What we do | Lawful basis |
|---|---|
| Answer enquiries, prepare quotes, take and deliver orders, handle returns and provide after-sales help | Contract, or steps before entering into one. Where you act for a business, our legitimate interests in dealing with our customers |
| Open and manage trade accounts, invoice and collect payment, and carry out credit checks | Contract, and legitimate interests in managing credit risk and recovering debts |
| Keep accounting and tax records | Legal obligation |
| Reply to messages you send on WhatsApp, by email or through the website | Legitimate interests in responding to you, or contract where it relates to an order |
| Send you news about products, offers and our product guide by email | Consent, or for existing customers, our legitimate interests under the "soft opt-in" rule for similar products. You can unsubscribe at any time |
| Run, secure and protect our website, systems and premises | Legitimate interests in keeping our business, staff and customers safe |
| Deal with suppliers and contractors | Contract and legitimate interests |
| Defend or bring legal claims and deal with complaints | Legitimate interests, and legal obligation where it applies |
Where we rely on legitimate interests, we have balanced them against your rights and expectations. You can ask us for details of that assessment.
You do not have to give us your personal information, but we need contact and delivery details to quote for, supply and invoice orders. Keeping financial records is a legal requirement.
We do not make decisions about you using only automated means, and we do not sell your personal information.
Transfers outside the UK
Some of our providers, such as Microsoft, Cloudflare, Resend, Mailchimp and Meta, are based in or use servers in the European Economic Area or the United States. Where personal information leaves the UK, we make sure it is protected by one of the safeguards the law allows: a UK adequacy decision (the EEA, and US companies certified under the UK Extension to the EU-US Data Privacy Framework), or the ICO's International Data Transfer Agreement or Addendum to the EU standard contractual clauses. Contact us for more detail on the safeguards used.
How long we keep it
| Information | How long |
|---|---|
| Quotes and enquiries that do not lead to an order | 2 years from our last contact |
| Orders, invoices, accounts and payment records | 6 years from the end of the financial year they relate to, as required for tax and accounting |
| Trade account and customer contact details | While the account is active, then 6 years after it closes |
| WhatsApp messages and photos | 2 years, unless they form part of an order record |
| Marketing preferences | Until you unsubscribe, and then a suppression record so we do not contact you again |
| Website security logs | As set by Cloudflare, typically a short period |
After these periods we securely delete or anonymise the information.
Your rights
You have the right to:
- Access: ask for a copy of the personal information we hold about you
- Rectification: ask us to correct information that is wrong or incomplete
- Erasure: ask us to delete your information in some circumstances
- Restriction: ask us to limit how we use your information in some circumstances
- Portability: ask for information you gave us in a portable format, where we rely on consent or contract and process it by automated means
- Withdraw consent: where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before
Your right to object
You can object at any time to us using your personal information for direct marketing, and we will stop. You can also object where we rely on legitimate interests, and we will stop unless we have compelling grounds to continue.
To use any of these rights, email sales@carltonplastics.co.uk or call 020 8665 1221. There is normally no charge. We will reply within one month, or tell you within that month if we need longer because your request is complex. We may need to check your identity first.
Complaints
If you are unhappy with how we have used your personal information, please tell us first at sales@carltonplastics.co.uk. We will acknowledge your complaint within 30 days and let you know the outcome without undue delay.
You also have the right to complain to the Information Commissioner's Office:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Other information
We keep your information secure using access controls, multi-factor sign-in, encryption in transit and staff training. If something goes wrong that puts you at high risk, we will tell you.
Our website and services are for trade and business customers and are not aimed at children.
Changes to this notice
We review this notice regularly and will post any changes on this page. It was last updated on 1 November 2026.