Privacy Policy

This policy explains what personal data we collect when you use load-bear.co.uk (the “Site”), how we use it, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

By using the Site, placing an order, or contacting us you confirm you have read and understood this policy.

1. Personal data we collect

We collect the following categories of personal data:

• Account data: name, email address, password (stored as a secure hash), and optional phone number when you create an account.
• Order & billing data: billing and shipping address, items purchased, order total, and (where applicable) business name and VAT details. Card details are entered directly into Stripe and are not stored on our servers.
• Custom request data: dimensions, photographs and drawings you upload, plus contact details, when you submit a custom bracket request.
• Communications: messages you send via the contact form, email or phone, and our replies.
• Technical data: IP address, browser type, device information, pages visited and approximate location, collected through essential cookies and standard server logs.

2. How we use your data and our lawful bases

We process your personal data on the following lawful bases under Article 6 UK GDPR:

• Performance of a contract — to take and fulfil your order, manufacture custom items, take payment, deliver goods and provide after-sales support.
• Legal obligation — to keep accounting and tax records (HMRC requires us to retain certain records for at least 6 years) and to comply with consumer protection law.
• Legitimate interests — to operate and secure the Site, prevent fraud, respond to enquiries, and improve our products and service. We balance our interests against your rights.
• Consent — for any non-essential cookies and for marketing communications. You can withdraw consent at any time.

3. Who we share your data with

We do not sell your personal data. We share it only with trusted processors who help us run the business:

• Stripe Payments Europe Ltd — payment processing. Stripe is the controller of your card data; see Stripe’s privacy notice.
• Supabase Inc. — secure database, authentication and file storage hosting.
• Resend — transactional email delivery (order confirmations, shipping updates).
• Couriers — to deliver your order. We share your name, address and phone number only.
• HMRC and other authorities — where required by law.
• Professional advisers — accountants and legal advisers, under strict confidentiality.

All processors are bound by data processing agreements requiring appropriate security and confidentiality.

4. International transfers

Some of our processors (including Stripe, Supabase and Resend) may store or process data outside the UK, including in the EEA and the United States. Where this happens, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision.

5. How long we keep your data

• Order & invoice records: 6 years after the end of the financial year in which the order was placed (HMRC requirement).
• Account data: for as long as your account is active. You can request deletion at any time.
• Custom request submissions: up to 24 months after the last contact, then deleted unless they form part of a contract.
• Contact form messages: up to 24 months.
• Server logs: typically 30–90 days.

6. Your rights

Under UK GDPR you have the right to:

• Be informed about how we use your data (this policy).
• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected (rectification).
• Have your data deleted (the “right to be forgotten”), subject to legal retention obligations.
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email sales@load-bear.co.uk. We will respond within one month. We may need to verify your identity before releasing data.

7. Security

We use industry-standard measures to protect your data, including TLS encryption in transit, hashed passwords, role-based access controls, and Row-Level Security on our database. Card payments are handled entirely by Stripe (PCI DSS Level 1 certified) — we never see or store full card numbers.

8. Cookies

We use a small number of cookies and similar technologies to operate the Site and remember your cart. See our Cookie Policy for full details and your choices.

9. Children

The Site is not intended for under-18s and we do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can put things right. You also have the right to complain to the UK Information Commissioner’s Office (ICO):

ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF · ico.org.uk · 0303 123 1113

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top of the page reflects the latest revision. Material changes will be highlighted on the Site or notified by email where appropriate.