Privacy Policy

HILLPOINTE LTD · Version 1.0 · Effective date: 9 July 2026

1. Scope and data controller

HILLPOINTE LTD (the “Company”, “we”, “us”) is the data controller for the personal data described in this policy. The Company's registered details and contact details are shown in the footer of this page. This policy explains how the Company handles personal data collected through its website, by email, by telephone, through trade enquiries and in the course of supplying goods. It applies to trade customers, prospective customers, suppliers and website visitors. It is issued for the purposes of the UK General Data Protection Regulation and the Data Protection Act 2018.

2. Data we collect

• Enquiry data submitted through the contact form or by email: name, company name, telephone number or email address, product interest and the content of the message.
• Order and account data: company and contact names, business address, delivery address, order history, invoices, payment references and bank details supplied for payment.
• Correspondence: emails, messaging history, notes of telephone calls and meeting records.
• Technical data: IP address, browser type, device type, referring page and pages visited, limited to what is needed to serve and secure the website.
• Marketing data: contact details and preferences where you have asked to receive product updates.

We do not knowingly collect data from children. The website is directed at business users and is not intended for anyone under 16.

3. How we collect data

Data is collected when you complete the enquiry form on the website, when you email, telephone or message us, when we prepare a quotation or pro forma invoice, when an order is placed and fulfilled, and automatically through the technical operation of the website.

4. Purposes and lawful bases

• Responding to enquiries and preparing quotations — legitimate interests in operating a trade business and responding to business requests.
• Performing and administering a contract — performance of a contract with the customer.
• Delivery, invoicing, payment collection and after-sales support — performance of a contract.
• Warranty, claims and quality records — legitimate interests in managing product claims and product safety.
• Accounting, tax and customs records — compliance with a legal obligation.
• Security, fraud prevention and debt recovery — legitimate interests in protecting the business.
• Sending product and trade communications — consent, or legitimate interests for existing business contacts, with an opt-out in every message.

We have completed a Legitimate Interest Assessment where we rely on legitimate interests as our lawful basis for processing.

5. Who we share data with

• Carriers, freight forwarders and customs brokers, for delivery and export documentation.
• Banks and payment service providers, to receive payment.
• Manufacturers and suppliers, where an order is produced or drop-shipped.
• Accountants, auditors, insurers and legal advisers.
• IT, hosting and email providers.
• Public authorities, courts and regulators, where disclosure is required by law.

We do not sell personal data.

Some recipients are data processors acting on our instructions and required to keep the data confidential and secure. Others, such as carriers, freight forwarders, customs brokers and accountants, are independent data controllers who process personal data for their own separate legal purposes.

6. International transfers

The Company trades internationally and some manufacturers, suppliers and service providers are located outside the United Kingdom and the European Economic Area. Where personal data is transferred outside the United Kingdom, we rely on the UK International Data Transfer Agreement (UK IDTA), the UK Standard Contractual Clauses (UK SCCs), or another transfer mechanism permitted by law, together with any additional safeguards needed. A copy of the relevant safeguards may be requested using the contact details in the footer of this page.

7. How long we keep data

• Enquiries that do not lead to an order: up to 24 months from the last contact.
• Order, invoice, payment and customs records: 6 years from the end of the financial year to which they relate, as required by UK tax and accounting law.
• Warranty and claim records: 3 years from closure of the claim.
• Correspondence: up to 6 years where it forms part of the business record.
• Marketing contact data: until you unsubscribe or object, or after 24 months of no engagement.
• Technical and security logs: up to 12 months.

Data may be kept longer where required by law or where needed for a live legal claim.

8. Security

We use access controls, password protection, encrypted connections where available, secure storage of business records and restriction of access to staff who need it. No transmission over the internet can be guaranteed secure, but we take reasonable steps to protect personal data against loss, misuse, unauthorised access and disclosure. Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we notify the Information Commissioner's Office as required by law and, where the risk is high, the affected individuals.

9. Cookies and website technology

• Essential cookies and similar technologies used to display pages, remember preferences and protect forms from abuse.
• Analytics, where enabled, used to count visits and improve the site, with an option to refuse them.
• Third-party content such as fonts and images may be loaded from external providers, which receive your IP address as part of that request.

You can block or delete cookies through your browser settings. Disabling cookies may affect the operation of parts of the website.

10. Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• be informed about how your data is used, as set out in this policy;
• access your personal data and receive a copy;
• have inaccurate or incomplete data corrected;
• have data erased, where one of the grounds in Article 17 applies;
• restrict processing while a dispute or accuracy issue is resolved;
• object to processing based on legitimate interests, and to object at any time to direct marketing;
• receive data you provided in a portable format, where processing is based on consent or contract and carried out by automated means;
• withdraw consent at any time, where processing is based on consent;
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect.

We do not carry out automated decision-making or profiling that produces legal effects. To exercise any right, contact 3251900043@qq.com or +44 7536 486096. We respond within one month, which may be extended by two further months for complex requests, and we will tell you if that happens. We may ask for information to verify your identity.

11. Complaints

If you are unhappy with how we handle your data, please contact us first. You may complain to the Information Commissioner's Office at ico.org.uk, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

12. Links to other websites

Links to other websites are provided for convenience. We are not responsible for their content or their privacy practices, and this policy does not apply to them.

13. Changes to this policy

We may update this policy. The current version is published on the Company's website with its effective date.