This privacy policy sets out how ToolBuyer uses and protects any information that you give ToolBuyer when you use this website.
ToolBuyer is committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website, then you can be assured that it will only be used in accordance with this privacy statement.
ToolBuyer may change this policy from time to time by updating this page. You should check this page from time to time to ensure that you are happy with any changes.
Who we are
ToolBuyer is a trading name of First Point Midlands Ltd, registered in England & Wales (company no. 08402282), registered office Albany House, Temple Court, Temple Way, Coleshill, Warwickshire B46 1HH. We are registered with the Information Commissioner’s Office (ICO), registration number ZA921067. Contact: sales@toolbuyer.co.uk.
What we collect
We may collect the following information:
- Name and payment details
- Contact information including email address
- Delivery and billing addresses
- Your marketing choices, and what you’ve bought from us
- Proof of age, if you buy an age-restricted product (see “Proof of age” below)
What we use your information for
| Purpose | Information | Lawful basis | How long we keep it |
|---|---|---|---|
| Taking, delivering and supporting your order (including returns and faults) | Name, addresses, email, phone, order details, payment reference | Contract | Six years (tax law) |
| Accounting and tax records | Order and invoice details | Legal obligation | Six years |
| Your account (order history, saved details) | Name, email, addresses, password (stored scrambled) | Contract | Until you ask us to close it |
| Loyalty points and marketplace claims | Email, order number, delivery postcode (checked, not shown), points history | Contract (the points scheme terms) | While you have an account; unclaimed points as set out in the points terms |
| Trade account applications | Business and contact details you give us | Steps before a contract, then contract | While the account is open, then six years |
| Age checks for 18+ items | See “Proof of age” below | See “Proof of age” below | Up to three years |
| Marketing emails and product suggestions | Email, name, what you bought | Website customers: our legitimate interests, using the “soft opt-in” that UK law (PECR) allows for similar products, unless you said no at checkout. Everyone else: your consent (opt-in) | Until you unsubscribe |
| Review invitations (Trustpilot) | Name, email, order number | Legitimate interests (honest customer feedback) | As set by Trustpilot; you can opt out in their email |
| Website statistics | Cookie data | Your consent (cookie settings) | Google Analytics keeps it for 14 months from your last visit, then deletes it. How long the cookies last: see our Cookie policy |
| Keeping the website and payments secure, preventing fraud | IP address, sign-in attempts, order checks | Legitimate interests | Records of failed sign-ins, repeated checkout attempts and failed points claims: from 15 minutes up to 24 hours. Longer only if needed to deal with a specific security problem. |
Proof of age
If your basket contains an age-restricted product, such as a knife, blade or axe, you confirm that you are 18 or over in one of two ways. The first is an online check before you pay, using Didit (Didit Identity Spain S.L., Barcelona, Spain), an identity verification company that carries out the check on our behalf. You take a photo of your passport or UK photocard driving licence and a selfie in Didit’s secure page. Didit checks that the document is genuine, that it matches you, and that you are 18 or over.
What we receive: the result of the check (passed or not passed), the date, the method used and Didit’s reference for the check. We do not download or keep copies of your ID document or your selfie. Didit stores them on our behalf as our data processor for one month, so that a failed or disputed check can be looked into, then deletes them. Didit does not use them to train its systems. Didit is based in the European Economic Area, which the UK recognises as giving an adequate level of data protection. You can read Didit’s own privacy notice at didit.me.
Why: for products where the law sets a minimum age, our lawful basis is legal obligation. For products we choose to restrict for safety, it is our legitimate interest in not selling them to children. Matching your selfie to your ID uses biometric data, which is a special category of data. For that we rely on your explicit consent, which you give on Didit’s page before the check starts. You don’t have to use the online check: you can email us a photo of your ID instead (see below).
Emailing us your ID instead: if you can’t use the online check, you can email sales@toolbuyer.co.uk two photos: your passport, UK driving licence or PASS card, and you holding it. We look at them only to check your name, your date of birth, that the ID is genuine and that it is you. We do not run any automated or biometric check on them, and we do not use them for anything else. We record the result on your order (passed or not passed, the date and the type of document) and delete your email and the photos once we have checked them, and within 30 days at the latest. Our lawful basis is the same as for the online check: legal obligation, or our legitimate interest in not selling these products to children.
How long: we keep the check result with your order for up to three years, so that we can show we trade responsibly and deal with any related complaint or claim. Your rights, including the right to object, are explained in this policy.
At delivery, the carrier may also ask the person receiving the parcel for photo ID. If you collect from us, we may ask to see photo ID.
Product safety reports. If you tell us a product was unsafe, caused an injury or damaged property, we keep a short record (product, order number, what happened, what we did and who we told, such as the supplier or Trading Standards) for six years. Our lawful basis is legal obligation and our legitimate interest in keeping products safe and dealing with claims.
Who we share your information with
We only share what each service needs to do its job:
- PayPal, which processes all card, PayPal, Google Pay and Apple Pay payments. Your card details go straight to PayPal; we never see or store your full card number.
- Didit (Didit Identity Spain S.L.), for the age check described above.
- Royal Mail and our couriers, who need your name, address and sometimes phone number to deliver.
- Our hosting, email and order-processing providers (including 20i for the website and Linnworks for order handling), who store and process data on our behalf under contract.
- Trustpilot: when your website order is dispatched, we send your name, email address and order number to Trustpilot so that they can email you an invitation to review us. Leaving a review is up to you, and you can opt out of these invitations from the Trustpilot email. Our lawful basis is our legitimate interest in collecting honest customer feedback.
- Google Analytics and Microsoft Clarity receive information about visits and interactions with our website only if you accept Analytics cookies, to help us understand and improve how the website works.
- Google and Meta receive information for advertising measurement and personalised advertising only if you accept Marketing cookies, as explained under “Advertising” below.
We do not sell your personal information.
Information processed outside the UK
Providers including Google, Meta, Microsoft and PayPal may process personal information outside the UK, including in the United States. Where a transfer needs protection under UK data protection law, we use a recognised UK adequacy arrangement or appropriate contractual safeguards. For US recipients, the UK Extension to the EU–US Data Privacy Framework can apply where the recipient is certified and the transfer is covered. Otherwise, safeguards may include the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with the required transfer assessment. Contact sales@toolbuyer.co.uk for details of the safeguards relevant to your information.
Security
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.
Cookies
We use essential cookies to run the shop (for example your basket, checkout and sign-in). We only use analytics or advertising cookies if you agree to them in our cookie banner, and you can change your choice at any time using “Cookie settings” at the bottom of every page. Full details are in our Cookie policy.
Links to other websites
Our website may link to other websites. We don’t control them, so please read their own privacy notices.
Marketing and product suggestions
- Offers: If you buy from our website and have not opted out, we may email offers and new products similar to what you bought, no more than twice a month. We use the PECR soft opt-in and rely on our legitimate interests in promoting similar products. Tick “No marketing emails, including basket reminders” at checkout to stop both. You can unsubscribe at any time. Google Pay and Apple Pay buyers who skip this step are not enrolled in either; we only send them offers if they separately opt in afterwards.
- Otherwise we only send marketing emails if you have opted in, for example when creating an account or claiming points.
- Basket reminders: When you provide your email and move on to the next part of checkout, we save your email and basket unless you have opted out, even if you do not place an order. We may send one reminder per basket, about one hour after you leave, and never more than one reminder to the same email address in any seven days. Tick “No basket reminders” to stop reminders only; the marketing opt-out stops both reminders and offers. You can also unsubscribe in the reminder email. We rely on our legitimate interests in helping shoppers complete purchases and promoting our products. We delete reminder records within 30 days of collection but keep a minimal opt-out record to honour your choice.
- Every marketing email has a one-click unsubscribe link (no sign-in needed), or you can email us to stop. Once you unsubscribe, a later order will not sign you up again.
- If we may email you offers, our order emails can also include a few product suggestions and an invitation to open an account. Essential order and delivery emails are sent whatever your marketing choice.
- If we may email you offers, we may also send one email about 2 weeks after your order is dispatched, asking you to review what you bought (account holders get loyalty points for a review, whatever the rating). It has its own one-click link to stop these emails.
- We do not sell or rent your personal information.
Advertising
If you accept Marketing cookies, we share information about your visits and shopping activity with Google and Meta to measure advertising and show relevant adverts, including adverts for products you have viewed.
The Meta Pixel sends information about pages and products viewed, items added to your basket, checkout activity and purchases. This can include product codes, quantities, purchase value, currency and an order-event reference, together with your IP address, browser information and cookie identifiers. Meta may link this information to your Facebook or Instagram account and other information it holds, and use it to personalise advertising.
We rely on your consent for this advertising tracking and sharing. You can refuse it or withdraw consent through Cookie settings. Withdrawal stops future tracking through these tools on our website; it does not undo processing that was lawful before withdrawal.
Our responsibilities and Meta’s
For the collection and transmission of information through the Meta Pixel, we and the relevant Meta company share responsibility as joint controllers. This is Meta Platforms, Inc. for the UK arrangements and Meta Platforms Ireland Limited for the EEA arrangements. We are responsible for explaining our use of the Pixel and obtaining the required consent on our website. Meta’s controller arrangements explain its responsibilities, including handling requests about information it holds. You can exercise your data protection rights against either joint controller.
Meta is separately responsible for its subsequent use of the information for its own purposes. See Meta’s Privacy Policy and Meta’s Business Tools Terms, which include its UK and EEA Controller Addenda.
How long we keep your information
Our retention periods are shown in the table above. After you unsubscribe from marketing, we keep the minimum information needed to honour your choice.
Accessing and correcting your information
You can ask for a copy of the personal information we hold about you, and ask us to correct anything that is wrong, by emailing sales@toolbuyer.co.uk or writing to us. There is normally no charge.
Your rights and complaints
You also have the right to ask us to delete your information, to restrict or object to how we use it, and to receive a copy to take elsewhere. Email sales@toolbuyer.co.uk. If you are unhappy with how we have handled your information, you can complain to the ICO at ico.org.uk.