Privacy Policy

This notice covers AOS Online LLP’s website, enquiries, orders, accounts, rewards and business-credit applications. It applies to individual customers, people acting for customer organisations and trade-reference contacts.

Personal information identifies or relates to an individual. It includes a named work email address, a director’s details and a signatory’s signature, even when collected for a business transaction. This privacy notice is separate from our trading terms.

1. Who is responsible and how to contact us

AOS Online LLP is the controller of the personal information covered by this notice. We are registered in England and Wales under number OC347383. Our registered office is Epsilon House, The Square, Gloucester Business Park, Brockworth, Gloucester, GL3 4AD.

For privacy questions, requests or complaints, use our Contact page, telephone 01452 888 186, or write to AOS Online LLP, Privacy enquiries, PO Box 1341, Cheltenham, GL50 9FA. Please make clear that your message concerns personal information so we can direct it appropriately. You do not have to use a particular form or legal wording.

We handle personal information under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations, as amended. Other websites linked from ours have their own privacy notices. Separate information will be provided where a service or activity needs a more specific explanation.

2. Information we collect

• Contact and organisation details: names, job titles, organisation names and types, registration numbers, business addresses, email addresses and telephone numbers.
• Account and purchasing information: account identifiers, account access records, quotes, orders, invoices, purchase-order details, delivery instructions, returns, enquiries, correspondence and rewards activity.
• Payment information: information needed to process and reconcile payments, transaction references and payment status. Payment providers process payment details through the payment methods offered at checkout. Please do not send full card details or security codes through a general enquiry form or email.
• Credit information: the requested limit, expected monthly spend, invoicing contacts, trade-reference details, eligibility confirmations, business credit reports, payment history, signed agreements, signatory details and organisation letterheads.
• Website and device information: IP address, browser and device information, access and security logs, and information about pages, searches and interactions where collected through the website and permitted technologies.
• Preferences and feedback: communication preferences, consent and objection records, reviews and survey responses. If we invite you to provide optional profile details for a specific offer or service, the form will explain their purpose and whether they are optional.
• Project information: delivery-site contacts and information you provide for furniture, installation, workwear, printing or promotional projects. Artwork or personalisation instructions may include names or other personal information.

Please provide only information relevant to the service or request. We do not ask for your birthday, gender or unrelated personal interests in the credit-account application. Do not include children’s details, health information, identity documents or other sensitive information unless it is necessary and we have agreed an appropriate way to provide it.

3. Where information comes from

We receive information directly from you through forms, orders, calls, emails and other communications; from your organisation or an authorised colleague; from delivery, payment and service providers; and from website interactions. For credit applications, we may receive information from nominated trade references, business credit-report providers and relevant public registers, including Companies House. A bank reference would be requested only where appropriate and authorised.

If you give us someone else’s details, such as a delivery contact or trade referee, provide only relevant information and make this notice available to them. We remain responsible for providing any privacy information the law requires us to give them directly. Where information is obtained indirectly, we provide it within the applicable legal timeframe, normally no later than one month or, if earlier, when first contacting the person or first disclosing their information, unless a lawful exception applies.

4. Why we use information and our lawful bases

We use the lawful basis appropriate to each activity. Where you are personally a party to a contract, the contractual basis may apply. Where the customer is a company, school or other organisation, our use of its employees’ or representatives’ personal information normally relies on legitimate interests rather than a contract with those individuals.

Where we rely on legitimate interests, we consider the purpose, necessity and impact on individuals and do not rely on that basis where your rights override those interests. You can ask us for further information about the assessment relevant to your information.

5. Credit-account applications and checks

We use the application, trade references and relevant business credit information to assess the organisation, decide the facility and limit, administer payments and review the account while it remains open. This may involve contacting the suppliers you nominate and reviewing relevant public information and business payment history.

Required fields are identified on the form. Without information necessary to assess or administer a facility, we may be unable to complete the application or provide the requested credit. Optional information is not a condition of unrelated marketing or benefits. Our credit-account page explains eligibility and the separate signed-agreement requirement.

Checks about an organisation and checks of an individual’s personal credit file are different. Before any personal credit-file search, we will provide any additional information required about the agency, purpose, lawful basis, type of search, record it leaves and relevant sharing. Submitting an organisation’s application is not blanket permission to search every employee’s or director’s personal file.

Credit-reference providers may act as independent controllers under their own privacy notices. Contact us for the provider and privacy information relevant to your application. Before reporting an individual’s payment performance or default to an agency, we will provide the required information about that reporting and have an appropriate lawful basis. Ticking the credit-terms box does not, by itself, authorise this use.

You may ask our accounts team to explain or review a credit outcome and correct inaccurate information. If a decision about an individual is made solely by automated processing with a legal or similarly significant effect, we will provide the additional information and safeguards required by law, including applicable rights to human intervention, make representations and challenge the decision. Business report scores do not, by themselves, establish that such an automated decision has occurred.

Accepting credit terms does not subscribe you to marketing. Signed agreements and reference information are used for the credit and administration purposes explained here.

6. Who receives information

We share relevant information where necessary for the purposes described in this notice, with appropriate safeguards. Recipients may include:

• Manufacturers, wholesalers, couriers and installers fulfilling orders, including suppliers delivering directly to your address.
• Payment providers, banks, accountants and systems used to manage accounts, payments and business records.
• Website hosting, IT support, security, customer-service and communications providers.
• Business credit-report providers, nominated trade referees, debt-recovery providers and professional advisers where relevant to a credit account or unpaid debt.
• Review providers, including Feefo, for relevant order feedback. We share the contact and order details needed for the review service; the provider’s applicable privacy information also explains its role.
• Marketing, analytics and advertising providers, where the relevant legal requirements and preferences permit.
• Insurers, legal advisers, regulators, law-enforcement bodies and courts where necessary for a claim, lawful request or legal duty.

Providers working on our instructions are subject to appropriate contractual controls. Others, including banks, authorities and credit-reference agencies, may be responsible for their own use of information under their privacy notices.

If all or part of our business is sold or reorganised, relevant information may be disclosed to advisers and a potential or new owner where lawful and necessary, with confidentiality and other appropriate safeguards. We will provide information about a change of controller where required. Such a transaction does not remove your data-protection rights.

7. International processing

Some service providers may process information outside the UK. Where this involves a restricted international transfer, we use an applicable lawful transfer route, such as UK adequacy regulations or approved contractual safeguards, with the required assessment and any necessary supplementary protections. These safeguards are intended to protect your information when it is processed overseas.

You can contact us for information about overseas processing relevant to your information and how to obtain details of applicable safeguards, subject to necessary redactions to protect confidential information.

8. Marketing, preferences and feedback

We may use relevant purchasing history, organisation details and communication preferences to make business offers more useful. Where we use personal information for this purpose, we need a lawful basis and must respect your rights.

Marketing emails and texts to individual subscribers, including sole traders and certain partnerships, require consent unless all conditions of a lawful exception apply. The existing-customer “soft opt-in” applies only to our own similar products or services where we obtained the details during a sale or negotiations and offered an opt-out both at collection and in each message.

Different electronic-marketing rules apply to corporate subscribers, including limited companies and LLPs. Relevant business marketing may be sent without prior consent where permitted, but named contacts’ personal information remains protected by data-protection law. We identify AOS and provide an opt-out. We respect objections and unsubscribe requests.

Use the unsubscribe link in a marketing message or contact us to stop marketing. You can withdraw consent at any time, without affecting earlier lawful processing. We may keep a minimal suppression record so that we do not contact you again by mistake. Opting out does not prevent necessary order, delivery, invoice, credit-account or safety communications.

Service feedback requests are used to understand and improve customer experience. If a message contains promotional material, the applicable marketing rules and preferences apply to that message. Accepting our trading terms does not provide marketing consent.

9. Cookies and similar technologies

Cookies and similar technologies can store or access information on your device. Some are needed to provide requested functions, such as the shopping basket, sign-in and security. Other technologies may support analytics, personalisation, advertising or remarketing.

Where consent is legally required, those technologies must not operate before you have made a valid choice. Continuing to browse, accepting trading terms or closing a notice is not consent. You can refuse or withdraw optional consent. Where a lawful exemption applies, the required information and any applicable objection mechanism must still be provided.

Use the preference controls presented with the website’s cookie notice to accept or refuse optional technologies and revisit your choice. If those controls are unavailable or do not work, contact us; technologies requiring consent must not be enabled without a valid choice. Browser settings can also restrict or delete cookies, but may affect website functions and do not control every type of tracking.

Before asking for consent, we will provide information about the relevant technology, its provider, purpose and duration. Advertising and remarketing technologies, including AdRoll where used, require the applicable consent; accepting this privacy notice is not a substitute for that choice. Contact us if you need details about a technology used on the website.

10. How long we keep information

We keep information only for as long as necessary for the relevant purpose, legal obligations and justified record-keeping or claims needs. Retention depends on the record, rather than applying one period to every piece of data.

• Orders, invoices and relevant customer records: generally for six years after your last order, with a different period where tax, accounting or other legal requirements require it. Unrelated information need not be retained for the same period.
• Credit agreements and supporting records: for the life of the account and then for the period needed to meet applicable record-keeping requirements or establish, exercise or defend claims, taking account of closure, final payment and unresolved disputes. Unsuccessful or withdrawn applications are reviewed against the shorter purposes of handling queries, preventing fraud and evidencing the decision.
• Enquiries and project quotations: for as long as needed to answer and follow up the enquiry and resolve related issues, with relevant information retained if an order or dispute follows.
• Marketing records: while the relevant lawful basis and purpose remain, subject to preference changes and review of inactivity. We do not retain a complete marketing profile indefinitely merely because someone once bought from us.
• Opt-out and consent records: the minimum information needed to respect your choices and demonstrate compliance.
• Security logs, analytics and cookies: for the period justified by the security or measurement purpose and the relevant technology’s stated duration.

Relevant information may be retained longer for an outstanding debt, safety issue, legal requirement or active or reasonably anticipated dispute. Once no longer needed, information is deleted or anonymised under the applicable retention arrangements. Ask us for the period or criteria applying to a particular record.

11. Keeping information secure

We use appropriate organisational and technical measures proportionate to the information and risks, including access controls and arrangements with service providers. No online service or transmission method can be guaranteed completely secure.

Protect your account credentials, restrict purchasing access to authorised staff and tell us promptly if you suspect misuse. Please do not send unnecessary sensitive documents through general email or contact forms; ask us about an appropriate method first. If a personal-data breach occurs, we assess it and notify the regulator and affected individuals where the law requires.

12. Your data-protection rights

Depending on the circumstances, you may ask to access your information, correct inaccuracies, erase information, restrict processing, receive or transfer certain information in a portable format, or object to processing based on legitimate interests. You can withdraw consent where that is the basis used. Some rights have conditions or exceptions, for example where information is needed for a legal obligation or claim.

You have the right to object to use of your personal information for direct marketing, including associated profiling. We will stop that processing when you object.

Contact us using section 1. We may reasonably check identity or authority to avoid disclosing information to the wrong person. We normally respond to rights requests without undue delay and within one month, subject to the applicable rules. Where a lawful extension or pause applies, we will explain it. Requests are normally free; a fee or refusal is possible only where legally permitted.

We will explain a refusal or restriction and the available complaint routes. Closing an online account or withdrawing marketing consent does not automatically require deletion of records we must lawfully retain.

13. Privacy complaints

If you are concerned about how we have handled your information, contact us through the channels in section 1 and explain the issue. We will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you appropriately informed and explain the outcome without undue delay. This complaint procedure is separate from the deadlines for exercising your data-protection rights.

You can also complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. You do not need our permission to do so. Its helpline is 0303 123 1113.

14. Changes to this notice

We may update this notice when our services, use of information or legal obligations change. Material changes will be explained in an appropriate way. A revised notice does not, by itself, create consent or authorise an incompatible new use of personal information. Where further information or consent is required before new processing begins, we will provide or obtain it.

Terms & Conditions · Business credit accounts · Contact AOS