Privacy Policy

JCB Tools is operated under licence by Genpower Ltd. This Privacy Policy explains how Genpower Ltd collects, uses, stores and shares personal data when you visit our website, create an account, place an order, contact us, or interact with our marketing.

1. Who We Are

For the purposes of data protection law, the data controller is:

Genpower Ltd
Isaac Way, London Road
Pembroke Dock
Pembrokeshire
SA72 4RW
Company No. 05758983

If you have any questions about this Privacy Policy or about how we use your personal data, please contact:

Email: gdpr@genpower.co.uk
Telephone: 01646 404400

2. The Personal Data We Collect

We may collect and use the following categories of personal data:

• name;
• billing address and delivery address;
• email address;
• telephone number and mobile number;
• account details and login information;
• order history and transaction details;
• correspondence you send to us by email, contact form, phone or post;
• marketing preferences;
• technical and usage information collected through cookies and similar technologies, where applicable.

3. How We Collect Your Personal Data

We collect personal data when you:

• place an order on our website;
• create or use an online account;
• contact us by email, phone, post or contact form;
• sign up to receive marketing communications;
• enter promotions, surveys or other website forms;
• use or browse our website;
• interact with our adverts, emails or other digital content, where tracking is enabled with your consent.

4. How We Use Your Personal Data and Our Lawful Bases

We must have a lawful basis for processing your personal data. Depending on the purpose, we rely on one or more of the following:

Contract
We use your personal data to process and deliver orders, take payment, manage your account, provide customer support, and communicate with you about your order.

Legal obligation
We keep certain records to comply with tax, accounting, fraud prevention, consumer law and other legal obligations.

Legitimate interests
We may use your personal data where it is reasonably necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include improving our services, managing website performance, preventing fraud, handling customer service issues, and maintaining business records. The ICO recognises legitimate interests as a possible lawful basis, but organisations must identify and justify it properly.

Consent
Where required, we rely on your consent, including for certain electronic marketing and for non-essential cookies and similar technologies. The ICO says that where consent is required under PECR for cookies or electronic marketing, consent will usually also be the appropriate UK GDPR basis for that activity.

5. Marketing

If you sign up to receive marketing from us, we may send you news, offers, product updates and promotional content by email or other electronic means where permitted by law.

Where consent is required, we will ask for it. Where the “soft opt-in” applies, we may send marketing about our own similar products or services, provided you were given a clear opportunity to opt out when your details were collected and in every message after that. The ICO makes clear that the soft opt-in is limited and does not automatically cover marketing for other organisations, and that you should not assume one brand opt-in covers all trading names.

If Genpower Ltd wishes to send marketing for multiple brands within the group, this should be made clear at the point of sign-up, with wording that is specific and easy to understand.

You can unsubscribe from marketing emails at any time by clicking the unsubscribe link in any marketing message, or by contacting us directly. If you object to direct marketing, we must stop using your data for that purpose.

6. Sharing Your Personal Data

We may share your personal data with trusted third parties where necessary for the purposes described in this policy. These may include:

• payment providers, such as Stripe, Amazon Pay, Klarna, Clearpay and Tower Finance;
• ecommerce, fulfilment and ERP providers, such as NetSuite;
• customer service and support providers, such as Zendesk;
• email and marketing platforms, such as Omnisend;
• analytics, advertising and tag-management providers, such as Google and Meta;
• website performance, attribution and lead-identification providers, such as Ad Beacon and RaekData;
• fraud prevention, hosting, security and IT support providers;
• professional advisers, insurers, auditors and regulators where necessary;
• law enforcement or other authorities where required by law.

We require service providers acting on our behalf to process personal data only in accordance with our instructions, applicable contracts and data protection law.

7. International Transfers

Some of our service providers may process personal data outside the UK. Where that happens, we will take appropriate steps to protect your personal data, such as using approved contractual safeguards or relying on another lawful transfer mechanism recognised under UK data protection law.

8. How Long We Keep Your Personal Data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, tax, fraud prevention and reporting obligations.

As a general rule:

• order and transaction records may be kept for at least 6 years to meet tax and accounting obligations;
• customer service records are kept for as long as reasonably necessary to deal with the issue and maintain business records;
• marketing data is kept until you unsubscribe, withdraw consent, object, or until we decide it is no longer current;
• cookie-related data retention depends on the specific cookie or similar technology used and is set out in our Cookies Policy.

If we no longer need your data, we will securely delete or anonymise it.

9. Your Rights

Under data protection law, you may have the right to:

• access the personal data we hold about you;
• ask us to correct inaccurate or incomplete personal data;
• ask us to delete your personal data in certain circumstances;
• ask us to restrict how we use your personal data in certain circumstances;
• object to processing based on legitimate interests;
• object at any time to the use of your personal data for direct marketing;
• receive a copy of certain personal data in a portable format, where applicable;
• withdraw consent at any time where we rely on consent.

The ICO says privacy notices should explain the rights available to individuals, including access, rectification, erasure, restriction, objection and data portability.

We may ask you to verify your identity before dealing with a rights request.

10. Automated Decision-Making and Profiling

We may use limited profiling or audience segmentation in connection with marketing, fraud prevention or website performance, particularly where advertising or analytics tools are enabled. Where we carry out any processing that amounts to automated decision-making with legal or similarly significant effects, we will tell you separately if required by law.

11. Children

Our website and products are not directed specifically at children, and we do not knowingly collect personal data from children where we are not entitled to do so.

12. Security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, disclosure or alteration. These measures may include secure hosting, SSL, access controls, malware protection, firewalls and website security tools.

13. Complaints

If you have a concern about how we use your personal data, please contact us first at gdpr@genpower.co.uk.

You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
Telephone: 0303 123 1113

14. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page, and the updated version will apply from the date it is published.