Privacy Policy

1. Information We Collect

We may collect and process the following categories of personal data about you:

2. How We Use Your Information

We use the personal data we collect for the following purposes, and only where we have a lawful basis to do so under UK GDPR:

• To respond to your enquiries and provide our Services — including preparing and sending quotes, onboarding you as a client, managing your inventory, processing orders, and communicating about your logistics arrangements.
• To manage our business relationship — including invoicing, account management, client support, and keeping records of our transactions and communications.
• To improve our website and services — by analysing aggregated and anonymised data on how visitors use our website, identifying areas for improvement, and testing new features or content.
• To comply with legal and regulatory obligations — including customs and import/export regulations, financial record-keeping requirements, and any applicable UK or international laws.
• To send relevant communications — where you have opted in or where we have a legitimate interest in doing so, such as service updates, operational notices, or information about changes to our offerings that may affect you.

We will not use your personal data for any purpose that is incompatible with the purposes described above without first notifying you and, where required, obtaining your consent.

3. Legal Basis for Processing

Under UK GDPR, we are required to have a lawful basis for processing your personal data. Depending on the circumstances, we may rely on one or more of the following:

• Contract — processing is necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
• Legitimate interests — processing is necessary for our legitimate business interests, such as improving our services, maintaining security, and managing client relationships, provided these interests are not overridden by your rights.
• Legal obligation — processing is necessary to comply with a legal or regulatory obligation to which we are subject.
• Consent — where we rely on your consent (for example, for marketing communications or non-essential cookies), you have the right to withdraw that consent at any time.

4. Data Protection & Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect your information against unauthorised access, accidental loss, disclosure, alteration or destruction. These measures include secure server infrastructure, access controls, and staff training on data protection obligations. While we take every reasonable precaution to safeguard your data, no method of transmission over the internet or electronic storage is completely secure. In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant supervisory authority (the Information Commissioner’s Office) in accordance with our legal obligations.

5. Sharing Your Information

We do not sell, rent or trade your personal data to third parties. We may share your information only in the following limited circumstances:

• Service providers and subcontractors — we may share data with trusted third-party companies that assist us in operating our business, such as courier and carrier partners, IT service providers, and customs agents. These parties are contractually required to handle your data securely and in accordance with our instructions.
• Legal and regulatory requirements — we may disclose your information where required to do so by law, court order, or government authority, including HMRC, Border Force, or other UK regulatory bodies.
• Business transfers — in the event of a merger, acquisition or sale of all or part of our business, your data may be transferred to the relevant third party, subject to equivalent privacy protections.
• With your consent — in any other circumstances, we will obtain your explicit consent before sharing your personal data.

6. Cookies & Similar Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience, analyse site usage, and support our marketing activities. Cookies may be set by us directly or by third-party services that feature on our pages. You can control your cookie preferences at any time via our cookie consent tool or your browser settings. For a full explanation of the types of cookies we use, how long they are retained, and how to manage them, please refer to our Cookies Policy.

7. Data Retention

We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting or reporting requirements. For enquiries and contact form submissions where no business relationship develops, we typically retain data for up to 12 months. For active clients, we retain relevant records for a minimum of 6 years following the end of the business relationship, in line with UK tax and financial record-keeping obligations. When your data is no longer required, it is securely deleted or anonymised.

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to request that inaccurate or incomplete data be corrected.
• Right to erasure — to request that your personal data be deleted, where there is no compelling reason for us to continue processing it.
• Right to restrict processing — to request that we limit the way we use your data in certain circumstances.
• Right to data portability — to request that we transfer your data to you or a third party in a structured, commonly used format.
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@greenrocks.uk. We will respond to all valid requests within one month. If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

9. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business practices, the Services we offer, or applicable laws and regulations. Any updates will be published on this page with a revised “Last updated” date. We encourage you to check this page periodically. Where changes are material, we will take reasonable steps to notify you directly, such as by email or a prominent notice on our website, where we have your contact details on record.

10. Contact Us

If you have any questions, concerns or requests regarding this Privacy Policy or our data protection practices, please contact us. We aim to respond to all data-related enquiries within 5 working days.