Privacy Policy

1. Who we are

DIYTools.com is a trading name of The Tool & Gauge Company (UK) Limited. We are the controller of your personal information, which means we decide how and why it's used and we're responsible for looking after it.

• Registered in England and Wales, company number 07992768
• Registered office: Unit 4 Alpha Trading Estate, Clayton Road, Hayes, Middlesex UB3 1BB
• Registered with the Information Commission (ICO), registration number ZA404451

We're a small family-run business and we don't have a Data Protection Officer. For anything about your personal information, please contact us:

• Email: sales@diytools.com
• Post: Data Protection, The Tool & Gauge Company (UK) Limited, Unit 4 Alpha Trading Estate, Clayton Road, Hayes, Middlesex UB3 1BB
• Phone: 020 7372 1973 (Monday to Friday, 9:30am to 5:30pm)

This policy is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

2. The information we collect

Depending on how you deal with us, we may collect:

• Contact details: your name, billing and delivery addresses, email address and phone number.
• Order information: what you've bought, your order history, deliveries, returns, refunds and warranty claims.
• Account details: your login email and password (stored securely by our store platform) and your saved preferences.
• Communications: emails, messages and notes of phone calls with us. We don't record phone calls.
• Limited payment information: see Payments. We never receive your full card number.
• Trade account and credit information: business details, the names and contact details of directors, partners, owners and purchasing and accounts contacts, trade references, credit limits, payment history, and the results of credit checks (see Credit checks).
• Age checks: confirmation that you're 18 or over if you buy a bladed item in person at our premises.
• CCTV images: if you visit our Hayes premises, for example for Click & Collect (see CCTV).
• Reviews: product reviews you submit, including the name you choose to show.
• Mailing list: your email address if you join our mailing list.
• Website usage data: your IP address, device and browser type, pages viewed and how you use the site, collected through cookies. Analytics cookies are only used if you accept them (see our Cookie Policy).
• Job applications: your CV, cover letter and any notes from interviews (see Job applicants).
• Supplier contacts: names and work contact details of people at suppliers and potential suppliers (see Supplier contacts).

When you collect an order, or buy a bladed item in person, we may look at your photo ID to check it matches. We look at it, we don't copy it.

3. Where it comes from

Most of the information we hold comes directly from you, when you place an order, create an account, apply for a trade account, contact us, leave a review or apply for a job. We also receive some information from:

• Payment providers (Stripe, PayPal and Google Pay): confirmation of whether your payment was approved, plus the limited card details described in Payments.
• Credit reference agencies (Experian and Creditsafe): credit reports when you apply for a trade account.
• Couriers (such as DPD and Royal Mail): delivery updates and proof of delivery.
• Your employer or business, if they give us your details as their purchasing, accounts or supplier contact.
• Our website and analytics tools: usage data collected through cookies.

4. How we use it and our lawful basis

The law says we must have a lawful basis for each way we use your information. Here's what we use it for and why we're allowed to.

Where we rely on consent, you can withdraw it at any time. This doesn't affect anything we did before you withdrew it.

5. Our legitimate interests and your right to object

Where we rely on legitimate interests, those interests are:

• running a secure and efficient online shop;
• answering questions from people who aren't customers yet;
• preventing fraud and crime;
• assessing credit risk before giving a trade account credit;
• keeping our premises secure;
• recruiting the right people;
• sourcing products and working with suppliers; and
• publishing genuine product reviews so other customers can make informed choices.

We use analytics cookies only with your consent, not on the basis of legitimate interests.

We only rely on legitimate interests where we've weighed them against your rights and we're satisfied they're not outweighed. You have the right to object to any use based on legitimate interests. Email sales@diytools.com and we'll stop unless we have compelling grounds to continue, or we need the information for a legal claim.

6. Payments

Card payments are processed by Stripe. You can also pay with PayPal or Google Pay. Your card details go straight to the payment provider. We never see or store your full card number.

We only receive limited payment information: the card type, the last 4 digits, the expiry date, your billing address and whether the payment was approved. We use this to match payments to orders, process refunds and help prevent fraud.

When you pay with PayPal or Google Pay, they also use your information under their own privacy policies. If you pay by bank transfer, we see the details shown on our bank statement, such as the account name and payment reference.

7. Our mailing list

You can join our mailing list using the signup box at the bottom of our website. It's for occasional trade tips, new products and offers. We'll only use the email address you give us there for our mailing list.

• We only add you if you sign up yourself. Your consent is our lawful basis.
• Every mailing list email has an unsubscribe link. You can also email sales@diytools.com to be taken off.
• We keep your email on the list until you unsubscribe.

8. Who we share it with

We only share your information where we need to, and only what's needed. We don't sell or rent your data to anyone.

• BigCommerce, which hosts our online store and stores your account and order details on our behalf.
• Stripe, PayPal and Google, to take payments (including Google Pay) and, for Google, to provide Google Analytics if you accept analytics cookies.
• Couriers, including DPD, Royal Mail and other carriers for large or heavy items, so they can deliver your order. They get the details they need to deliver it, such as your name, delivery address and phone number.
• Suppliers who deliver some orders direct to you. They only get your name, delivery address and phone number, so they can deliver your order.
• Credit reference agencies (Experian and Creditsafe), when you apply for a trade account.
• Our accountants and IT providers, who help us run the business and keep our systems working.
• The police, HM Revenue & Customs and regulators, where the law requires us to, or to help prevent or detect crime.

If you message us on WhatsApp, WhatsApp also handles that message under its own privacy policy.

Companies that process information for us must keep it secure and only use it on our instructions. Where a company decides for itself how it uses your information (for example PayPal, Google Pay or a credit reference agency), its own privacy policy also applies.

9. International transfers

Some of our service providers, including BigCommerce, Google, Stripe and PayPal, may process your information in the USA or elsewhere outside the UK. When this happens, it's protected either because the UK Government has approved that country's data protection standards (including the UK-US Data Bridge for companies certified under it), or by the International Data Transfer Agreement or Addendum approved under UK law. Contact us if you'd like more details about these safeguards.

10. How long we keep it

We only keep your information for as long as we need it. After that we securely delete it or make it anonymous.

11. CCTV at our premises

We use CCTV at our Hayes premises for security and to prevent crime. Footage is normally overwritten after about 30 days, unless we need it to investigate an incident. There are signs on site so you know where cameras are in use. We rely on our legitimate interests in keeping our premises, staff and visitors safe. We'd only share footage where it's needed, for example with the police to deal with an incident.

12. Credit checks for trade accounts

When you apply for a trade account, we carry out credit checks with credit reference agencies, currently Experian and Creditsafe. We do this to check your identity and to assess whether we can offer credit and how much.

• For sole traders, partners, directors and anyone giving a personal guarantee, the check may include your personal credit history.
• The agency may keep a record of the search, which other organisations may see when they carry out their own searches.

Experian explains how it uses and shares personal information, how long it keeps it and your rights, in the Credit Reference Agency Information Notice (CRAIN). Creditsafe explains how it uses personal information in its privacy notice at creditsafe.com. Our lawful basis for credit checks is our legitimate interest in assessing credit risk.

13. Automated decisions

Our payment providers use automated fraud checks, which may decline a payment without a person looking at it. These checks look at things like the card, the billing and delivery details and how the payment is made, to spot signs of fraud. If a check flags a risk, the payment may be declined and the order won't go through. If this happens and you think it's wrong, contact us and we'll arrange for a person to review it. You can also give us your point of view and challenge the decision.

We don't make any other decisions about you using only automated means.

14. Your rights

You have the right to:

• Access your information and get a copy of it.
• Correct information that's wrong or incomplete.
• Delete your information, in some circumstances.
• Restrict how we use it, in some circumstances.
• Object to how we use it where we rely on legitimate interests. You have an absolute right to object to direct marketing: if you object, we'll stop.
• Data portability: receive information you gave us in a commonly used electronic format, or ask us to send it to someone else.
• Withdraw consent at any time where we rely on it, for example for our mailing list or analytics cookies.
• Safeguards for automated decisions: if a decision that significantly affects you is made only by automated means, you can be told about it, give us your point of view, ask for a person to review it and challenge it.

How to use your rights

1. Get in touchEmail sales@diytools.com, call us or write to us at the address in section 1. Tell us what you'd like us to do.
2. We may check your IDIf we need to confirm who you are, we'll ask. The time limit starts once we have what we need.
3. We reply within one monthIt's free. If your request is complex or you've made several, we can extend this by up to two more months, and we'll tell you within the first month if we need to.

15. Complaints

If you're unhappy with how we've handled your personal information, please tell us first so we can put it right. Email sales@diytools.com or write to us at the address in section 1.

• We'll acknowledge your complaint within 2 working days (the law allows us 30 days).
• We'll investigate it without undue delay and keep you updated.
• We'll tell you the outcome in plain English, normally within one month and in any case within three months.

You can also complain to the regulator, the Information Commission (ICO), at ico.org.uk or on 0303 123 1113.

16. Do you have to give us your data?

• Orders: we need your name, address and contact details to process and deliver your order. Without them we can't sell to you.
• Trade accounts: if you apply for a trade account, you must give us your company and credit information. Without it we can't consider your application.
• Bladed items: proof of age is a legal requirement. If we can't verify you're 18 or over, we can't supply the item.
• Everything else is optional, such as joining our mailing list, leaving a review or accepting analytics cookies.

17. Job applicants

If you send us your CV, we use it to consider you for current or future roles. The details, including how long we keep your application, are in the candidate privacy notice on our Join Our Team page. In short, we delete applications 6 months after the decision unless you agree we can keep them longer. Please don't include health or other sensitive information unless you need a reasonable adjustment.

18. Supplier contacts

If you contact us as a supplier or potential supplier, we use your name and work contact details to deal with your enquiry and, if we trade together, to manage our relationship. We rely on our legitimate interest in sourcing products. Enquiries that don't go ahead are kept for 12 months. Active supplier records are kept while we trade, plus 6 years. See our Become a Supplier page for more.

19. Children

Our products are for adults and you must be 18 or over to buy from us. We don't knowingly collect personal information from children. If you think a child has given us their information, please contact us and we'll delete it.

20. Security

We use security measures that are proportionate to the information we hold, to protect it against loss, misuse and unauthorised access. Our website uses TLS encryption, so information you send us is encrypted in transit. Our payment providers are certified to the Payment Card Industry Data Security Standard (PCI DSS). Only people who need your information to do their job can access it.

Our bank details never change by email. If you get an email saying they have, please call us on 020 7372 1973 to check before you pay.

21. Cookies

We use cookies that our website needs to work, payment cookies to help prevent fraud, and Google Analytics cookies only if you accept them. We don't use advertising cookies. You can change your choice at any time using the cookie settings link at the bottom of every page. See our Cookie Policy for the full list.

22. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with a new "last updated" date. If we make significant changes, we'll also email you where we have your email address.

Last updated: 25 October 2026.