How we handle your data.

1. Who we are

Universal Procure Limited (“Universal Procure”, “we”, “us”, “our”) is a company registered in England and Wales. We are the data controller for personal information collected through this website at https://universalprocure.co.uk.

For any privacy enquiry, contact us at hello@universalprocure.co.uk.

2. What information we collect

We only collect personal information you choose to give us. Specifically:

• Trade enquiry form data — name, business email, phone (optional), company / property name, role, property count, pillar(s) of interest, timeline, and the free-text content of your enquiry.
• Brand partner brief data — name, business email, brand or concept name, stage, production volume, format requirements, intellectual-property status, and the brief itself.
• Waitlist data — email address when you sign up to be notified about a coming-soon brand (Gravy Guys, Kovi London).
• Technical data — anonymised analytics (page views, device class, country-level location) collected through privacy-respecting analytics. No advertising IDs, no cross-site tracking, no behavioural profiles.
• Communication content — anything you write in emails, WhatsApp messages, or other direct exchanges with our team.

We do not collect: payment information through this website, special-category data (health, religion, etc.), data about persons under 18, or data through invisible third-party trackers.

3. How we use it (and our lawful basis)

We process personal data only for the purposes set out below, and only under the lawful bases set out in Article 6 UK GDPR:

4. Who we share data with

We do not sell or rent personal data. We share data only with the limited categories of processors required to operate the business:

• Hostinger International Ltd — website hosting and Hostinger Mail (server processing of form submissions and the inbox at hello@universalprocure.co.uk).
• Analytics — first-party privacy-respecting analytics (e.g. Plausible, GA4 with IP anonymisation). No data is used for advertising.
• Algolia — catalogue search indexing. Only product data (not personal data) is indexed.
• Cloudinary — image hosting and delivery. No personal data is involved.
• Professional advisors — accountants, auditors, and legal counsel under confidentiality where required.
• Authorities — where required by law (e.g. HMRC, court orders).

Where a processor is outside the UK or EEA, transfers are governed by Standard Contractual Clauses (SCCs) or the UK's International Data Transfer Addendum.

5. How long we keep it

We retain data only for as long as is necessary:

• Enquiry data with no resulting commercial relationship: deleted after 24 months from last contact.
• Active client / trade-relationship data: retained for the duration of the relationship and for 6 years after it ends (statutory retention for UK contract law).
• Waitlist signups: until launch + 6 months, or until you unsubscribe (whichever is sooner).
• Statutory records (invoices, tax): 6 years per HMRC requirements.
• Anonymised analytics: indefinite (no personal data).

6. Your rights under UK GDPR

You have the following rights with respect to your personal data:

• Right of access — request a copy of the data we hold about you.
• Right to rectification — ask us to correct anything that's inaccurate.
• Right to erasure (“right to be forgotten”) — ask us to delete your data, subject to legal retention rules above.
• Right to restriction — ask us to stop processing your data while we investigate a complaint.
• Right to data portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on our legitimate interests.
• Right to withdraw consent — at any time, for any processing based on consent.
• Rights relating to automated decision-making — we don't use automated decision-making; this right is not applicable.

Exercise any of these by emailing hello@universalprocure.co.uk with “Privacy rights request” in the subject line. We respond within 30 days. You may need to verify your identity for security.

7. Security

We protect your data with technical and organisational measures:

• HTTPS-only delivery of all pages and form submissions (TLS 1.2+)
• Authenticated SMTP relay (Hostinger SSL on port 465) for form delivery
• Access controls on the team mailbox at hello@universalprocure.co.uk
• Honeypot fields and validation on all forms to prevent automated abuse
• Regular software updates and dependency patching

No system is 100% secure. If a personal data breach occurs that poses a risk to you, we will notify you and the ICO within 72 hours where required by law.

8. Cookies

See our dedicated Cookies Policy for a full list of cookies we use, what they do, and how to manage them.

9. Marketing & communications

We don't run advertising or remarketing campaigns. Direct communications (responses to enquiries, brand-launch announcements you opted in to) are sent only to the email address you supplied, and you can unsubscribe at any time using the link in any communication or by emailing us.

10. Children

This website is not directed at people under 18. We do not knowingly collect personal data from children. If we discover we have, we delete it.

11. Complaints

If you have a concern about how we handle your data, please contact us first at hello@universalprocure.co.uk. We'll do our best to resolve it. You also have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent revision. For material changes, we will notify clients with an active commercial relationship by email.

13. Contact

Universal Procure Limited
London, United Kingdom
Email: hello@universalprocure.co.uk
Phone: +44 7955 910 347