Privacy Policy
Effective date: [01/01/2025]
Version: [v1.0]
This Privacy Policy explains how Office Specialties Ltd T/A OSWorkplace (“OSWorkplace”, “we”, “us”, “our”) collects and uses your personal data when you visit www.osworkplace.co.uk, contact us, or buy our products and services.
We are committed to protecting your privacy and handling your information fairly, lawfully, and transparently.
1) Who we are (Data Controller)
Office Specialties Ltd T/A OSWorkplace
Registered in Scotland, Company Number: SC243785
Registered address: Units 2-4 Dunsdale Workshops, Selkirk, TD7 5EA
Email: info@osworkplace.co.uk
Telephone: 01750 720745
We are the data controller for personal data processed in connection with our website and services. If you have questions about this notice or how we use your data, please contact us using the details above.
2) The data we collect
We collect and process the following categories of personal data:
- Identity & contact data: name, job title, company name, postal address, email, phone.
- Account & transaction data: login details, order history, invoicing, delivery details, payment status (we do not store full payment card details—see “Payments” below).
- Communications: enquiries, emails, call notes, live chat messages, support tickets.
- Website & device data: IP address, device identifiers, browser type/version, pages viewed, time/date of visits, referral sources, cookie IDs and similar technologies.
- Marketing preferences: subscriptions, consent records, opt‑out choices.
- Supplier/partner data (where relevant): contact and contract information.
We collect data directly from you (forms, checkout, emails, calls, chat), and automatically via cookies and similar technologies on our website. We may also receive data from third parties, such as delivery partners, payment processors, lead generation or advertising platforms, and credit‑reference services (where applicable and lawful).
3) Why we use your data (purposes) and lawful bases
We only use your personal data when the law allows, and we rely on the following lawful bases under the UK GDPR and Data Protection Act 2018:
| Purpose | Examples | Lawful Basis |
|---|
| Provide our website and services | Account setup, quote requests, order processing, deliveries, customer support | Contract (to perform a contract or take steps at your request) |
|---|
| Payments and fraud prevention | Processing payments via our processor(s), chargeback handling, fraud checks | Contract; Legitimate interests; Legal obligation |
|---|
| Customer service & communications | Responding to messages and enquiries, service updates | Contract; Legitimate interests |
|---|
| Marketing | Email newsletters, product announcements, promotions | Consent (email/SMS to individuals, as required by PECR); Legitimate interests for business-to-business contacts where appropriate |
|---|
| Analytics & site improvement | Measuring page performance, understanding usage, testing | Consent (for non‑essential cookies/analytics); Legitimate interests (for strictly necessary) |
|---|
| Legal & compliance | Record keeping, accounting, responding to regulators, handling disputes | Legal obligation; Legitimate interests |
|---|
| Security | Detecting and preventing unauthorised access or misuse | Legitimate interests |
|---|
If you rely on legitimate interests, we balance your rights and expectations against our interests and only proceed where they are not overridden by your interests or fundamental rights.
4) Cookies and similar technologies
We use cookies and similar technologies to run our site, keep you signed in, remember preferences, measure performance, and personalise content/ads (where applicable).
- Strictly necessary cookies – required for core site functionality (no consent required).
- Analytics cookies – help us understand site usage and improve.
- Functional cookies – remember choices to enhance your experience.
- Advertising/retargeting cookies – show relevant ads (if used).
Where required, we ask for your consent before setting non‑essential cookies. You can change your cookie choices at any time via our Cookie Preferences tool
See our Cookie Policy for full details: www.osworkplace.co.uk/cookies
5) Payments
We use third‑party payment processors to handle transactions. We do not store full card details on our servers. Payment data is processed by Stipe
6) Who we share your data with
We may share personal data with trusted third parties to help us deliver our services, strictly under appropriate contracts and safeguards:
- IT, hosting & support providers (e.g., website hosting, CRM, helpdesk, email service)
- Payment processors and banks
- Logistics & delivery partners
- Professional advisors (accountants, auditors, legal advisors)
- Analytics, cookie and advertising partners (with consent as required)
- Identity verification/fraud prevention providers (if used)
- Regulators, law enforcement or courts where required by law or to protect our rights or users
We require third‑party processors to protect your data and only process it in accordance with our instructions and the law.
7) International transfers
Some providers may process data outside the UK (and EEA). Where this occurs, we ensure appropriate safeguards, such as:
- An adequacy decision by the UK government; or
- International Data Transfer Agreement (IDTA) or UK Addendum to EU SCCs, plus supplementary measures where necessary.
You can contact us for details of the specific safeguards in place.
8) How long we keep your data (retention)
We keep personal data only for as long as necessary for the purposes described above, including to comply with legal, tax and accounting requirements, and to resolve disputes.
Typical retention periods include:
- Customer account, orders & invoices: up to 6 years after the end of the financial year in which the transaction occurred (to meet UK accounting requirements).
- Enquiry/contact records: typically 24 months from last contact (unless you become a customer).
- Marketing data: until you unsubscribe or withdraw consent, or following a period of inactivity per our retention schedule.
- Cookie identifiers/analytics: per cookie policy lifetimes.
We will securely delete or anonymise data when it is no longer needed.
9) Your rights
Under UK data protection law, you have rights which may include:
- Access – request a copy of your personal data.
- Rectification – correct inaccurate or incomplete data.
- Erasure – ask us to delete your data, subject to legal obligations.
- Restriction – ask us to limit processing in certain cases.
- Objection – object to processing based on legitimate interests or direct marketing.
- Portability – receive your data in a structured, commonly used format and have it transmitted to another controller where technically feasible.
- Withdraw consent – where we rely on consent (e.g., marketing or non‑essential cookies), you can withdraw it at any time.
To exercise your rights, please contact us at info@osworkplace.co.uk. We will respond within one month (or up to three months for complex requests, in which case we will inform you).
10) Marketing choices
- Email/SMS marketing: We will send marketing to individuals only with your consent (or as permitted by PECR for existing customers—“soft opt‑in”). You can unsubscribe at any time via the link in our emails or by contacting us.
- B2B marketing: We may contact corporate subscribers about our services where permitted by law and you can opt out at any time.
11) Security
We implement appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit (HTTPS), least‑privilege access, and regular security reviews. No system is perfectly secure, but we work to prevent unauthorised access, disclosure, alteration or destruction of data.
12) Children
Our website and services are not directed at children. We do not knowingly collect personal data relating to children. If you believe a child has provided us with personal data, please contact us and we will take appropriate action.
13) Third‑party links
Our website may include links to third‑party websites, plug‑ins and services. We are not responsible for their privacy practices. We encourage you to read the privacy notices of every website you visit.
14) Changes to this notice
We may update this Privacy Policy from time to time. We will post the updated version with a new effective date. For significant changes, we will take additional steps to notify you where appropriate.
15) How to contact us & complaints
Questions, requests, or complaints about this notice or your personal data can be sent to:
Email: info@osworkplace.co.uk]
Post: OSWorkplace, Units 2-4 Dunsdale Workshops, Selkirk, TD7 5EA
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
www.ico.org.uk | Tel: 0303 123 1113 | Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF