Privacy Notice

Who we are

Steel Traders (Midlands) Limited is committed to protecting and respecting your personal information.

For the purposes of UK data protection law, Steel Traders (Midlands) Limited is the data controller responsible for deciding how and why personal information is collected and used.

Our details are:

Steel Traders (Midlands) Limited
Company number: 12414423
13 Vansittart Estate
Windsor
Berkshire
SL4 1SE
United Kingdom
Telephone: 0333 577 6681
Email: [email protected]
Website: steeltraders.co.uk

This Privacy Notice explains how we collect, use, store and share personal information when you:

visit our website;
submit a website enquiry;
contact us by telephone or email;ask us to provide information or a quotation;
place an order;
supply products or services to us;
work with us as a business contact; or otherwise interact with Steel Traders.

The personal information we collect

The information we collect will depend on the nature of your relationship with us.

This may include:

your name;
your business email address;
your business telephone number;
your job title;
the name of the business or organisation you represent;
your business, billing or delivery address;
information submitted through our website enquiry form;
the nature and content of your enquiry;
steel product requirements;
product grades, quantities, dimensions and specifications;
quotation and order information;
project, delivery and logistics information;
invoicing and payment information;
communications between you and our team;
information required for financing, shipping, customs or order fulfilment;
information relating to suppliers, manufacturers and supply-chain contacts;
complaint and data protection request information;
your IP address;
browser, device and operating-system information;
website referral and usage information;
online and cookie identifiers; and
your cookie and consent preferences.

Our website enquiry form may ask for your name, email address, business name, enquiry type and message.

We do not intentionally collect special-category personal information through our website. This includes information about health, ethnicity, religion, political opinions, trade union membership, genetic or biometric information, or sexual orientation.

Please do not provide this type of information unless it is genuinely necessary and we have specifically requested it.

How we collect personal information

We may collect information:

directly from you when you complete our website enquiry form;
when you contact us by telephone or email;
when you ask for information or a quotation;
when you place or discuss an order;
through correspondence relating to procurement, financing, shipping, customs, logistics or delivery;
from the organisation you work for;
from customers, suppliers, manufacturers, mills and logistics partners;
from professional advisers and commercial service providers;
from publicly available business sources; and
automatically through website technologies, subject to your cookie choices where required.

Website enquiries are delivered to Steel Traders’ business email address and stored within its business email systems and servers.

Relevant enquiry, quotation and customer information may also be entered into customer relationship management, order management, accounting or other business systems where these are used by Steel Traders.

How and why we use personal information

Responding to enquiries

We use personal information to:

receive and respond to website enquiries;
understand your requirements;
provide product and service information;
determine whether we can assist you;
prepare and discuss quotations; and
maintain a record of our communications.

Preparing quotations and processing orders

We may use personal information to:

prepare and issue quotations;
confirm product requirements and specifications;
source products from suitable mills, manufacturers and suppliers;
conduct appropriate supplier and customer checks;
arrange commercial financing where applicable;
process and administer orders;
manage payment and invoicing;
arrange shipping, customs clearance, warehousing, haulage and delivery;
provide order and delivery updates;
deal with product or delivery queries; and
provide after-sales support.

Our lawful bases are:

taking steps before entering into a contract;
performing a contract;
complying with legal obligations; and
our legitimate interests in administering orders, supporting customers and operating our business.

Where our customer is a company or another organisation, we normally rely on legitimate interests to use the business contact information of its employees and representatives.

Managing our international supply chain

Steel Traders sources steel from suppliers, mills and manufacturers in the UK and internationally.

We may use and share limited personal information to:

source and procure products;
confirm product availability;
manage international shipments;
prepare commercial and shipping documentation;
coordinate customs clearance;
arrange warehousing and haulage;
provide delivery instructions; and
fulfil customer orders.

Our lawful bases are the performance of a contract, compliance with legal obligations and our legitimate interest in fulfilling orders and managing our supply chain.

We seek to minimise the information shared. Wherever reasonably practicable, Steel Traders acts as the intermediary between its customers and its international supply chain.

Managing suppliers and commercial relationships

We use supplier and business-contact information to:

source and purchase steel products;
manage supplier relationships;
discuss specifications and availability;
coordinate shipments and delivery;
administer supplier payments;
maintain commercial records; and
resolve queries or disputes.

Our lawful basis is our legitimate interest in maintaining our supply chain and managing our commercial relationships.

Accounting, taxation and legal compliance

We may process personal information to:

create and retain invoices;
administer payments;
maintain company and accounting records;
comply with tax and financial reporting requirements;
manage credit and commercial risk;
prevent and detect fraud;
comply with customs, sanctions and trade-control requirements;
respond to courts, regulators or public authorities;
establish, exercise or defend legal claims; and
obtain legal, accounting, insurance or professional advice.

Our lawful bases are compliance with legal obligations and our legitimate interests in managing risk and protecting our business and legal rights.

Operating and securing our website

We may use technical information to:

operate and maintain the website;
manage website forms;
prevent spam and malicious activity;
maintain website and server security;
diagnose technical issues;
investigate errors;
manage backups and updates; and
protect the website against unauthorised access.

Our lawful basis is our legitimate interest in operating a secure, reliable and functional website.
Technologies that are strictly necessary to provide website security or requested functionality do not normally require cookie consent.

Website analytics and search performance

We use website analytics and search-performance services to understand how the website performs and how people find and use it.

These services may include:

Google Analytics 4;
Google Search Console;
Google Tag Manager; and
Semrush.

The information processed may include:

pages viewed;
date and time of visits;
referral source;
search queries;
website interactions;
approximate geographic information;
browser and device category;
session information;
search impressions and clicks;
indexed pages;
technical website issues;
online identifiers; and
cookie identifiers where consent has been provided.

Where analytics technologies store or access information on your device and consent is required, our lawful basis is your consent.

Analytics technologies requiring consent should remain inactive unless you accept analytics cookies through the website’s cookie controls.

Google Search Console and standard Semrush search-ranking tools primarily provide aggregated search, website and publicly available information. They do not ordinarily identify individual website users to Steel Traders.

Digital agency access

Steel Traders appoints external service providers to manage, maintain, analyse and improve its website and online visibility.

Our appointed digital agency is:
Thriveonline UK Ltd, trading as Thrive Online Group UK.

Authorised members of the Thrive Online Group UK team may have access to:

the website administration system;
website hosting and technical information;
Google Analytics;
Google Search Console;
Google Tag Manager;
Semrush;
cookie-consent configurations;
website traffic and performance reports;
technical website logs; and

information submitted through website forms where access is reasonably necessary to maintain, test, investigate or support those forms.

Thrive Online Group UK processes relevant information on behalf of Steel Traders and in accordance with Steel Traders’ documented instructions.

It is not permitted to use Steel Traders’ personal information for its own unrelated purposes.

Steel Traders remains responsible for determining why and how personal information collected through the website is used.

Data protection requests and complaints

We use personal information where necessary to:

verify the identity of someone making a request;
respond to requests concerning personal information;
investigate data protection complaints;
communicate with complainants;
maintain records of our response; and
comply with our legal obligations.

Our lawful bases are compliance with legal obligations and our legitimate interest in investigating and resolving complaints.

Marketing communications

We do not add people to a general email marketing list solely because they have submitted a website enquiry.

We may contact you in connection with:

an enquiry;
a quotation;
an existing or proposed order;
a delivery;
a service issue; or
an existing commercial relationship.

Should Steel Traders introduce newsletters or broader electronic marketing in the future, we will update this Privacy Notice and introduce any consent or opt-out controls required by law

Who we share personal information with

We only share personal information where it is reasonably necessary and proportionate.

Depending on the enquiry, quotation, order or business relationship, we may share information with:

employees and authorised representatives of Steel Traders;
Thrive Online Group UK as our website, analytics and SEO agency;
website hosting, development, maintenance and security providers;
business email and IT service providers;
cookie-consent management providers;
customer relationship and order management providers;
accounting and financial software providers;
Google in connection with Google Analytics, Search Console and Tag Manager;
Semrush in connection with SEO auditing, tracking and reporting;
accountants, auditors, insurers, banks and professional advisers;
steel mills, manufacturers, stockholders and suppliers;
trade-finance and commercial-finance providers;
freight forwarders and shipping companies;
customs agents and port operators;
warehousing, haulage and delivery providers;
fraud-prevention, security and identity-verification providers;
courts, regulators, HM Revenue & Customs, law-enforcement bodies and public authorities; and
potential purchasers, investors or advisers where part or all of the business is restructured or transferred

We share only the information reasonably required for the relevant purpose.

An international mill or logistics provider may, for example, need a business contact name, delivery location, telephone number, project reference or order information.

It would not ordinarily require access to the complete customer relationship or unnecessary commercially sensitive information.

Our service providers are expected to handle information securely, confidentially and only for the agreed purpose.

Controllers, processors and service providers

Steel Traders is the controller of personal information collected through its website and business activities.

Some organisations process information on our behalf as data processors. These may include:

Thrive Online Group UK;
website hosting and maintenance providers;
business email providers;
analytics and reporting providers;
cookie-consent providers; and
relevant software providers.

Other organisations may act as separate controllers where they determine their own purposes and legal responsibilities. This may include banks, insurers, professional advisers, customs authorities, finance providers and certain logistics organisations.

The legal role of each organisation depends on the service it provides and the circumstances in which information is shared.

International transfers

Steel Traders operates within an international supply chain and works with suppliers, manufacturers, steel mills, freight providers and commercial partners located outside the United Kingdom.

Limited personal information may therefore be transferred or made accessible outside the UK where this is reasonably necessary to:

source products;
manage an order;
arrange financing;
coordinate shipping;
prepare customs documentation;
arrange delivery; or
fulfil a customer requirement.

Our website, analytics, email, IT and digital service providers may also use infrastructure or personnel located outside the UK.

Where a restricted international transfer takes place, we will seek to use an appropriate legal safeguard.

Depending on the country, provider and circumstances, this may include:

UK adequacy regulations;
the UK International Data Transfer Agreement;
the UK Addendum to approved standard contractual clauses;
appropriate contractual and organisational protections;
another transfer mechanism permitted under UK data protection law; or
a legal exception where the transfer is genuinely necessary for a particular transaction.

You may contact us for further information about the safeguards relevant to your personal information.

How long we retain personal information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, financial, contractual and regulatory requirements.

Our standard retention periods are as follows.

Website enquiries that do not become orders

Unsuccessful enquiries and related communications will normally be retained for up to 24 months after the last meaningful contact.

This allows us to respond to follow-up enquiries, understand previous requirements and maintain an appropriate record of the communication.

Quotations that do not become orders

Quotations and related correspondence that do not result in an order will normally be retained for up to 24 months after the quotation expires or the last related communication.

A longer period may be applied where the proposed project is ongoing or is reasonably expected to restart.

Customers, orders and transactions

Customer, order, invoice, payment and transaction records will normally be retained for seven years following the end of the relevant financial year, the completion of the transaction or the end of the customer relationship, depending on which is later.

Information may be retained for longer where necessary for:

an ongoing contract;
a product warranty;
a dispute;
a regulatory investigation;
a legal claim; or
another legal requirement.

Supplier and supply-chain records

Supplier, procurement, shipping, customs, logistics and commercial records will normally be retained for up to seven years after the last relevant transaction or the end of the commercial relationship.

Website analytics

Google Analytics user-level and event-level information will normally be configured for a retention period of no more than 14 months.

Aggregated or anonymised website reports that no longer relate to an identifiable visitor may be retained for longer for historical comparison and business analysis.

Cookie consent records

Records of cookie choices may be retained for up to 24 months, or for the period reasonably necessary to demonstrate and respect the visitor’s preferences.

Data protection requests and complaints

Records relating to data protection requests or complaints will normally be retained for up to three years after the matter is concluded.

A longer period may apply where there is an ongoing dispute, investigation or legal requirement.

When information is no longer required, it will be securely deleted, anonymised or placed beyond use.

How we protect personal information

We use reasonable technical and organisational measures to protect personal information against:

unauthorised access;
accidental loss;
misuse;
alteration;
inappropriate disclosure; and
destruction.

Measures may include:

user access controls;
individual account credentials;
multi-factor authentication where available;
appropriate system permissions;
secure passwords;
malware and security protection;
software and plugin updates;
backups;
staff and contractor confidentiality obligations;
secure system administration; and
the restriction of access to authorised personnel.

Access is limited to people and service providers who reasonably need the information to perform their duties.

No method of transmitting or storing information is completely secure. However, we take proportionate steps to reduce the risk of unauthorised access or loss.

Your data protection rights

Depending on the circumstances and lawful basis used, you may have the right to:

ask whether we process your personal information;
request a copy of the information we hold about you;
ask us to correct inaccurate or incomplete information;
ask us to delete your information;
ask us to restrict how we use your information;
object to certain uses of your information;
request the transfer of information you provided to
us in a structured and commonly used format;
withdraw consent where processing is based on consent; and
complain about how we have handled your information.

These rights are not absolute and may be subject to legal exceptions.

Your right to object

You have the right to object to our use of your personal information where we rely on legitimate interests.
Where you object, we will stop the relevant processing unless we have compelling legitimate grounds to continue or the information is needed to establish, exercise or defend a legal claim.

To exercise a right, contact:
Email: [email protected]
Telephone: 0333 577 6681

We may ask for information to confirm your identity before responding.

We do not normally charge a fee. A reasonable fee may be charged, or a request may be refused, where the law permits this because a request is manifestly unfounded or excessive.

Data protection complaints

You can complain to us about how we have collected, used, disclosed, retained or otherwise handled your personal information.

Complaints can be made using:
Email: [email protected]
Telephone: 0333 577 6681
Post:
Steel Traders (Midlands) Limited
13 Vansittart Estate
Windsor
Berkshire
SL4 1SE
United Kingdom

We will:

provide a clear way for you to raise your complaint;
acknowledge the complaint within 30 days of receiving it;
take appropriate steps to investigate it without undue delay;
keep you appropriately informed during the investigation; and
tell you the outcome of the complaint.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

We would appreciate the opportunity to investigate and address your concerns directly before you approach the Information Commissioner’s Office.

Automated decision-making

We do not use personal information collected through our website to make decisions producing legal or similarly significant effects through solely automated processing.

Children’s information

Our website and services are intended for business and commercial users.

We do not knowingly seek to collect personal information from children through the website.

Cookies and website technologies

Our website uses cookies and similar technologies.

Our Cookie Policy explains:

the technologies we use;
their purposes;
which technologies require consent;
how to accept or reject optional technologies; and
how to change your preferences.

External websites

Our website may link to websites operated by other organisations.

We are not responsible for the privacy practices, content or security of external websites. You should read the privacy information provided by the relevant website before submitting personal information.

Changes to this Privacy Notice

We may update this Privacy Notice where:

our business activities change;
we introduce new systems or providers;
our website or analytics arrangements change;
our supply-chain processes change; or
legal or regulatory requirements change.

The latest version will be published on our website with its revision date.