NCR 4 Less, GDPR & Privacy Policy
Privacy Policy
Last updated: 23 June 2026
1. Who We Are
This website is operated by NCR4Less, accessible at www.ncr4less.co.uk. We are the data controller responsible for your personal data.
If you have any questions about this policy or how we handle your data, please contact us at:
NCR4Less
Email: sales@ncr4less.co.uk
Address: Century House, 4 Millennium Drive, Leeds LS11 5BP
Phone: 0113 2000 603
2. What Data We Collect
When you use our website or place an order, we may collect the following personal data:
Identity & Contact Data: your name, email address, phone number, and billing/delivery address.
Transaction Data: details of products you have purchased from us, order history, and payment references. We do not store your full card details — payments are processed securely by a third-party provider (e.g. Stripe, PayPal).
Technical Data: your IP address, browser type and version, time zone, browser plug-in types, operating system, and other technology on the devices you use to access our site.
Usage Data: information about how you use our website, products, and services (e.g. pages visited, time spent).
Marketing & Communications Data: your preferences in receiving marketing from us and your communication preferences.
3. How We Collect Your Data
We collect data through:
- Direct interactions — when you create an account, place an order, subscribe to our newsletter, or contact us.
- Automated technologies — as you browse our site, we automatically collect Technical and Usage Data via cookies and similar technologies (see Section 9 on Cookies).
- Third parties — including payment processors, analytics providers (e.g. Google Analytics), and advertising networks.
4. How We Use Your Data
We use your personal data only where we have a lawful basis to do so. The table below sets out our purposes and the legal basis for each:
| Purpose | Lawful Basis |
|---|---|
| Processing and fulfilling your orders | Performance of a contract |
| Managing your account | Performance of a contract |
| Sending order confirmations and updates | Performance of a contract |
| Fraud prevention and security | Legitimate interests / Legal obligation |
| Improving our website and services | Legitimate interests |
| Sending marketing emails (if opted in) | Consent |
| Complying with legal and regulatory obligations | Legal obligation |
We will never sell your personal data to third parties.
5. Who We Share Your Data With
We may share your data with carefully selected third parties, including:
- Payment processors (e.g. Stripe, PayPal) to handle transactions securely.
- Delivery and logistics partners to fulfil and ship your orders.
- IT and website service providers who support the operation of our site.
- Analytics providers (e.g. Google Analytics) to help us understand how our site is used.
- Marketing platforms (e.g. Mailchimp) if you have opted in to marketing emails.
- Legal or regulatory authorities where we are required by law to do so.
All third parties are required to handle your data in accordance with applicable data protection law. Where they process data on our behalf, they do so as data processors under a data processing agreement.
6. International Transfers
Some of our third-party service providers are based outside the UK or European Economic Area (EEA). Where we transfer your data internationally, we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses (SCCs), to protect your data to the same standard required under UK GDPR.
7. How Long We Keep Your Data
We retain your personal data only for as long as necessary:
- Order and transaction records — 7 years (to comply with UK tax and accounting obligations).
- Account data — for the duration your account is active, plus 2 years after your last interaction.
- Marketing preferences — until you unsubscribe or withdraw consent.
- Technical/usage data — up to 26 months (in line with analytics best practice).
After the applicable retention period, your data is securely deleted or anonymised.
8. Your Rights Under UK GDPR
As a UK resident, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — ask us to delete your data in certain circumstances (“the right to be forgotten”).
- Right to restrict processing — ask us to pause processing your data in certain circumstances.
- Right to data portability — request your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interests or for direct marketing.
- Rights related to automated decision-making — we do not use your data for automated profiling that produces legal or significant effects.
To exercise any of these rights, please contact us at gdpr@ncr4less.co.uk. We will respond within one calendar month. There is no charge for making a request.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
Website: ico.org.uk | Phone: 0303 123 1113
9. Cookies
Our website uses cookies to improve your experience and help us understand how our site is used. Cookies are small text files placed on your device.
We use the following types of cookies:
| Cookie Type | Purpose |
|---|---|
| Strictly necessary | Essential for the site to function (e.g. your shopping basket, login session) |
| Analytics | Help us understand how visitors use our site (e.g. Google Analytics) |
| Marketing/advertising | Track your visits to show you relevant ads (only with your consent) |
On your first visit, you will be asked to consent to non-essential cookies. You can change or withdraw your cookie preferences at any time via our cookie settings, or by adjusting your browser settings.
For more information, see our [Cookie Policy].
10. Data Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. These include SSL/TLS encryption on all data transmissions, restricted access to personal data, and regular security reviews.
However, no internet transmission is completely secure. If you suspect any misuse of your data, please contact us immediately.
11. Children’s Privacy
Our website and services are not directed at children under the age of 13, and we do not knowingly collect personal data from children. If you believe a child has provided us with their data, please contact us and we will delete it promptly.
12. Links to Third-Party Sites
Our website may contain links to third-party websites. This policy does not apply to those sites. We encourage you to read the privacy policies of any third-party sites you visit.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law or our practices. When we do, we will update the date at the top of this page. For significant changes, we will notify you by email or a notice on our website.
14. Contact Us
For any questions, concerns, or to exercise your rights, please reach out to us:
NCR4Less
Email: sales@ncr4less.co.uk
Address: Century House, 4 Millennium Drive, Leeds LS11 5BP
Phone: 0113 2000 603