Privacy Policy

  1. DATA CONTROLLER AND GENERAL INFORMATION

1.1 Data Controller
CB PLANT & SALES LTD (“we”, “us”, “our”) is the data controller responsible for your personal data collected through this website.

1.2 Business & Contact Details
Company Name: CB PLANT & SALES LTD
Registered Office Address: 59a Drumlish Road, Dromore, Omagh, United Kingdom, BT78 3ER
Telephone Number: +44 28 8289 3728
Email Address: hire@cbplanthire.com

1.3 Applicable Legal Framework
We process personal data in full compliance with the UK General Data Protection Regulation (UK GDPR), the UK Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR) (Regulation (EU) 2016/679), as applicable to European contractors and commercial entities booking equipment for projects within Northern Ireland and supported UK locations.

  1. PERSONAL DATA WE COLLECT AND PROCESS

We collect personal data that you provide directly to us when using our website, submitting equipment hire quotation forms, or engaging in hire agreements.

2.1 Identification and Contact Information

  • Full name, commercial entity name, and job title.
  • Business billing address and project delivery address.
  • Email address and telephone number.

2.2 Transaction and Payment Information

  • Details regarding equipment reservations, hire initial deposit payments, agreed hire fees, delivery and collection fees, and hire extension charges.
  • Payment transactions are securely processed by our third-party payment service provider, Stripe. When you submit payment for initial deposits or agreed hire fees, your credit or debit card details, account information, and transaction metadata are collected and processed directly by Stripe under their privacy policy and applicable regulatory protocols.

2.3 Technical and Usage Data

  • IP address, browser type and version, time zone setting, operating system, and basic analytics regarding your interaction with our website forms.
  1. PURPOSES AND LEGAL BASES FOR PROCESSING

We process your personal data under the following legal bases:

3.1 Performance of a Contract (Article 6(1)(b) UK/EU GDPR)

  • Processing website form enquiries, issuing tailored equipment hire quotations, managing equipment availability, accepting initial deposits, and executing hire agreements for project sites in Northern Ireland and supported UK areas.

3.2 Compliance with Legal Obligations (Article 6(1)(c) UK/EU GDPR)

  • Maintaining business accounting records, tax filings, anti-money laundering verification where required, and regulatory compliance under United Kingdom and European Union law.

3.3 Legitimate Interests (Article 6(1)(f) UK/EU GDPR)

  • Managing customer communications, improving website functionality, protecting our fleet assets, and handling general commercial enquiries, provided such interests are not overridden by your fundamental privacy rights.
  1. DATA SHARING AND RECIPIENTS

We do not sell, rent, or trade your personal data. Personal data is disclosed only to specific categories of service providers necessary for operating our business:

4.1 Payment Processor

  • We explicitly share transaction-related personal data with our third-party payment processor, Stripe, to facilitate secure online payment of hire deposits, agreed rental fees, transport costs, and extensions. Stripe operates as an independent data controller for certain processing activities in connection with payment security, fraud prevention, and compliance with statutory financial regulations.

4.2 Professional Advisers and Logistics Operators

  • Transport and logistics personnel required to perform equipment delivery and collection at designated project locations.
  • Accounting, legal, and auditing professionals assisting with statutory business requirements within the United Kingdom.

4.3 Regulatory and Law Enforcement Authorities

  • Governmental or regulatory bodies when mandated by United Kingdom or applicable European law.
  1. INTERNATIONAL DATA TRANSFERS

5.1 Transfers Outside the UK and EEA
Where personal data is transferred across borders—including data processing by Stripe or cloud software infrastructure providers located outside the UK or European Economic Area (EEA)—we ensure adequate safeguards are implemented.

5.2 Transfer Mechanisms
Transfers rely on official legal mechanisms such as European Commission Adequacy Decisions, UK International Data Transfer Agreements (IDTA), or Standard Contractual Clauses (SCCs) to maintain data protection standards equivalent to those within the UK and EU.

  1. DATA RETENTION AND STORAGE PERIODS

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements.

6.1 Equipment Hire and Financial Transaction Records

  • In accordance with United Kingdom tax and commercial legislation (including statutory requirements enforced by HM Revenue & data are retained for a standard period of seven (7) years following the end of the relevant tax year.

6.2 Quotation and General Enquiries

  • Unconverted quotation requests and general correspondence data are retained for up to two (2) years from the date of last communication, after which they are securely deleted or anonymised.

6.3 Legal and Regulatory Retention

  • Personal data related to active disputes, equipment damage claims, or statutory obligations may be retained beyond standard periods until the matter is formally concluded and statutory limitation periods under relevant laws have expired.
  1. DATA SECURITY MEASURES

We implement technical and organizational measures designed to protect your personal data against unauthorized access, loss, alteration, or disclosure. These controls include encrypted server infrastructure, restricted internal access controls, and secure data transmission protocols. While we apply standard industry controls to safeguard your data, transmission of information via the internet carries inherent security risks, and absolute protection cannot be guaranteed.

  1. YOUR STATUTORY DATA PROTECTION RIGHTS

Under UK GDPR and EU GDPR, you have specific rights regarding your personal data:

8.1 Right of Access

  • You have the right to request access to the personal data we hold about you and receive a copy of that data.

8.2 Right to Rectification

  • You have the right to request the correction of inaccurate or incomplete personal data.

8.3 Right to Erasure (‘Right to be Forgotten’)

  • You may request the erasure of your personal data where there is no legal justification or overriding legitimate basis for continued processing.

8.4 Right to Restrict Processing

  • You have the right to request that we restrict processing activities under specific legal circumstances (e.g., while data accuracy is being verified).

8.5 Right to Data Portability

  • You may request the transfer of structured, commonly used machine-readable data to yourself or another controller.

8.6 Right to Object

  • You have the right to object to processing based on legitimate interests or for direct marketing purposes.

To exercise any of these rights, please contact us using the details provided in Section 1.2. We will respond to valid requests within one (1) calendar month.

  1. COMPLAINTS AND REGULATORY AUTHORITIES

If you believe our processing of your personal data infringes applicable data protection laws, you have the right to lodge a complaint with the supervisory authority:

  • United Kingdom: Information Commissioner’s Office (ICO)
    Website: https://ico.org.uk | Telephone: +44 303 123 1113
  • European Union: You may also contact your local competent EU Data Protection Authority in the member state of your habitual residence or place of work.

Customs), financial records, hire agreements, invoice details, and associated transaction