Updated: 7 October 2026.
Who is responsible
Cadenmere Supply Ltd is the controller of the personal information it uses for its business. Our company details are set out alongside this notice. For privacy questions or requests, email sales@cadenmere.co.uk. You do not need to use a particular subject line.
Information we use
We use names, business roles and contact details, correspondence, goods specifications or website requirements, quotations, order and delivery details, payment references and related business records. Information comes from you, your organisation, relevant suppliers or delivery contacts, and public business sources such as company websites and registers.
Our Contact and Website services pages use email links, not web forms. Opening a link does not send anything: you choose whether to send from your email service. Please include only what is needed for the enquiry. We may need to ask for further details before preparing a goods or website quotation.
Why we use it
- To answer organisational enquiries about goods or website services, prepare quotations and manage business relationships, orders and agreed projects, we rely on our legitimate interests in running our sourcing, supply and website services. This includes checking supply options, proportionate research into relevant business contacts and suppliers, and using relevant correspondence to prepare drafts and replies.
- Where you contract with us personally, including as a sole trader, we use necessary information to take steps you request before a contract and to fulfil that contract. This basis does not automatically apply to an employee acting for their employer.
- We keep required accounting and tax records, respond to privacy requests and meet other applicable legal obligations.
- We use necessary information to handle complaints, establish or defend legal claims, and keep our website and business systems secure. We rely on legitimate interests unless a specific legal obligation applies.
Any direct marketing is separate from handling an enquiry. We use relevant business contact details only where the applicable marketing rules allow it, relying on legitimate interests or consent as appropriate. You can object to direct marketing at any time by emailing us; we will stop and keep only the details needed to respect your choice.
Sharing and services
We use Google Workspace, including Gmail and Drive, for business email and records. We share only necessary information with suppliers or manufacturers to obtain a quotation or fulfil an order, couriers to arrange delivery, and professional advisers or authorities where needed. A product specification need not include personal contact details unless the task requires them.
Cloudflare provides website delivery and security. It processes visitor information such as IP addresses and request or traffic data. Its own network-security processing is described in Cloudflare’s privacy policy; processing on our behalf is governed by its data-processing terms. The website code adds no analytics, advertising trackers or cookies. Hosting and security processing still take place.
We use OpenAI services to assist with business research and correspondence, including reviewing relevant emails and documents and preparing drafts. This can involve your name, business contact details, information in correspondence and relevant publicly available professional information. Relevant information from our connected Gmail and Google Drive accounts is processed by OpenAI to provide this assistance. OpenAI also describes its own use of personal information in its privacy policy. We do not make decisions with legal or similarly significant effects about you solely by automated means.
Information may be processed outside the UK as these providers operate internationally. The following Google and Cloudflare arrangements relate to those providers. Our Google Workspace provider is Google Cloud EMEA Limited in Ireland, which is covered by UK adequacy regulations. For relevant US transfers, Google uses the UK Extension to the EU–US Data Privacy Framework. For restricted UK transfers where contractual safeguards are required, Cloudflare’s terms provide Standard Contractual Clauses with the UK Addendum. You can ask us for details or copies of the relevant safeguards.
OpenAI’s privacy policy describes processing in the United States and other countries, and reliance on adequacy decisions or Standard Contractual Clauses with the UK Addendum where applicable. It explains how to request copies of its safeguards.
How long we keep it
The following periods describe the business records we retain. We normally keep unconverted enquiries for 12 months after the last substantive exchange, and unsuccessful quotations for 12 months after expiry or closure, whichever is later. Active relationship details are reviewed at least annually and when roles change. We remove information sooner when it is no longer needed.
Essential contract and delivery evidence is normally kept for six years after completion. Accounting and tax records are kept for at least six years from the end of the relevant company financial year, with longer periods where tax rules or an open enquiry require them. Specific contract, warranty, dispute or legal requirements may also justify a longer, limited record.
Supplier checks are kept while needed, with superseded personal evidence normally removed within 24 months. Minimal privacy-request, complaint and incident records are normally kept for three years after closure. Objection records last while needed to prevent unwanted contact. Service-provider logs and recovery copies follow their applicable purposes, legal requirements and deletion cycles, rather than one period for all data.
OpenAI’s retention depends on the service, the information, account settings and deletion actions, as well as security and legal requirements. Its privacy policy explains those criteria. These provider retention criteria are separate from the business-record periods above.
Your rights
Depending on the circumstances, you can ask to access or correct your information, have it erased, restrict its use or receive a portable copy. You can object to processing based on legitimate interests, and withdraw consent where we rely on it, without affecting earlier lawful processing. The right to object to direct marketing is unconditional.
Send a request or privacy complaint to sales@cadenmere.co.uk. We may ask for information needed to identify you or understand the request. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.