Privacy Policy

Version 1: September 2026

1. Who we are

This privacy policy explains how Tolbest Limited (“Tolbest”, “we”, “us” or “our”), a company registered in England and Wales under company number 02354044, with its registered office at 8 Aston Court, Kingsland Grange, Warrington, WA1 4SG, collects, uses, shares and protects personal information when you visit our website, contact us, apply for a job with us, or do business with us as a customer or supplier contact.

We are the data controller for the personal information described in this policy. If you have any questions about this policy or how we handle your information, see “How to contact us” at the end of this document.

This policy applies to visitors and users wherever they are based, including in the UK, the EU and elsewhere. Where UK GDPR and EU GDPR both apply to your information, we aim to meet the higher of the two standards.

2. Information we collect

We collect different information depending on how you interact with us.

2.1. Visitors to our website

When you browse tolbest.co.uk (or any Tolbest website), we automatically collect certain technical information via cookies and similar technologies, including:

  • Your IP address and approximate location
  • Device, browser type and operating system
  • Pages viewed, time on site, referring website, and general browsing behaviour
  • Cookie identifiers used to recognise repeat visits

See section 3 (Cookies) for full detail and how to control this.

2.2. Enquiries submitted through our contact form

When you submit an enquiry, request a quote, or otherwise get in touch through our website, we collect:

  • Your name
  • Email address and/or phone number
  • Company name and job title, where provided
  • The content of your message and any details you choose to share

2.3. Job applicants

If you apply for a role with us, whether through our careers page or by emailing us directly, we collect:

  • Your name and contact details
  • Your CV, covering letter and any application form responses
  • Employment history, qualifications and references
  • Interview notes and, where relevant to the role, any right-to-work information

We only collect special category data (such as information about a disability, to arrange interview adjustments) where you volunteer it, and only use it for that purpose.

2.4. Customers, suppliers and other business contacts

Where we do business with your organisation, or you’re a contact at a customer, supplier or partner, we hold business contact details (name, job title, work email/phone, company) and a record of our dealings with you — correspondence, orders, meeting notes and similar — in our customer relationship management (CRM) system.

3. Cookies and similar technologies

4. How we use your information, and our legal basis

UK GDPR requires us to have a valid legal basis for each way we use your personal information. The list below summarises this.

Purpose
Typical data used
Legal basis
Respond to your enquiry or quote request
Contact details, message content
Legitimate interests (responding to enquiries) / taking steps at your request before a contract
Manage the customer or supplier relationship
Business contact details, correspondence, CRM records
Legitimate interests (managing our business relationships) or performance of a contract
Analyse and improve the website
Analytics/cookie data
Consent (or the narrow statistical-purposes exemption, where genuinely met)
Send marketing communications
Contact details, marketing preferences
Consent, or legitimate interests for existing customers (soft opt-in), with an opt-out on every message
Recruit for open roles
Application, CV, interview information
Steps taken at your request prior to a contract; legal obligation (e.g. right-to-work checks)
Meet legal and regulatory obligations
Varies
Legal obligation
Prevent fraud and keep our systems secure
Technical/security logs
Legitimate interests

Where we rely on consent (for example, for marketing emails or non-essential cookies), you can withdraw it at any time, and this won’t affect anything we did before you withdrew it.

5. Who we share your information with

We don’t sell personal information. We share it only where necessary, with:

  • Our CRM system, which hosts our customer records
  • Our website hosting and IT support providers
  • Analytics providers (Google Analytics), where you’ve consented
  • Referees and right-to-work verification services
  • Professional advisers (lawyers, accountants, auditors) where necessary
  • Regulators, law enforcement or other parties where we’re legally required to
  • A buyer or successor, if we sell or reorganise all or part of our business

All third parties who process personal information on our behalf are required to protect it in line with our instructions and this policy, under a written data processing agreement.

6. International transfers

Some of the providers listed above may store or access personal information outside the UK, including in the United States or European Economic Area. Where this happens, we put safeguards in place required by UK data protection law — for example, relying on the UK’s International Data Transfer Agreement (IDTA), an EU-UK adequacy decision, or the UK Addendum to the EU Standard Contractual Clauses — to ensure your information receives an equivalent standard of protection wherever it’s processed.

7. How long we keep your information

We keep personal information only as long as necessary for the purposes it was collected for, including to meet legal, accounting or reporting requirements. As a guide:

  • Website enquiries: up to 24 months from your last contact with us, unless a customer relationship develops.
  • Job applications: up to 6 months after the recruitment process ends, unless you agree we can keep your details for future roles.
  • Customer/supplier CRM records: for the duration of the relationship, plus 6 years afterwards (in line with standard limitation periods for contract-related claims).
  • Analytics data: up to 26 months.

8. How we protect your information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse or alteration, including access controls, encryption where appropriate, and staff training. No method of transmission or storage is completely secure, but we work to protect your information to industry standards.

9. Your rights

Under UK GDPR, you have the right to:

  • Ask for a copy of the personal information we hold about you
  • Ask us to correct inaccurate or incomplete information
  • Ask us to delete your information, in certain circumstances
  • Ask us to restrict how we use your information
  • Ask us to move your information to another organisation (data portability), where technically feasible
  • Object to us using your information for direct marketing, or on legitimate interests grounds
  • Withdraw consent at any time, where we rely on consent
  • Not be subject to decisions based solely on automated processing that have a significant effect on you, other than in limited circumstances permitted by law

To exercise any of these rights, contact us using the details below. We aim to respond within one month, carrying out reasonable and proportionate searches to locate your information. There’s no charge for most requests, though we may charge a reasonable fee or decline a request that’s clearly unfounded or excessive.

If you’re unhappy with how we’ve handled your information, you can complain to us first (see “How to contact us” — we provide an electronic way to raise a complaint and will acknowledge it within 30 days), or complain directly to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113. If you’re based in the EU, you may also have the right to complain to your local supervisory authority.

10. Children’s privacy

Our website is intended for business audiences and is not directed at children. We don’t knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time, for example to reflect changes in the law or how we use your information. We’ll post any updated version here with a new “last updated” date, and where changes are significant, we’ll make this clearer on our website. Last updated: 7 September 2026.

12. How to contact us

If you have questions about this policy, want to exercise your rights, or want to raise a complaint, contact us at: