Website Privacy Notice

1. Who we are

ToroMobile Ltd (company number 17362782) is the controller of the personal information described in this notice. We are registered in England and Wales and our registered office is Agents House, Main Street, Denton, Grantham, England, NG32 1JW.

Email: hello@toromobile.co.uk

Website: toromobile.co.uk

Registered office: Agents House, Main Street, Denton, Grantham, England, NG32 1JW

2. Who and what this notice covers

This notice applies to business contacts, suppliers, prospective suppliers, website visitors and people who contact us. Our services are intended for organisations and business users, not consumers acting wholly outside a trade or profession.

ToroMobile purchases devices outright. We do not currently offer a separate managed data-processing or data-erasure service on a customer’s behalf.

3. Personal information we collect

• Identity and business-contact details, such as name, organisation, role, work email address, telephone number and business address.

• Enquiry and correspondence information, including the information entered into our website forms and records of our communications.

• Transaction information, such as quotations, contracts, collection details, invoices, payment records and bank details where needed to pay a supplier.

• Device and asset information, such as make, model, serial number or IMEI, condition, ownership information, valuation, inspection findings, images and processing records.

• Website and technical information made available by your browser or our website provider, such as pages visited, approximate location, device or browser type, referral information, security logs and similar technical events.

• Due-diligence information where necessary, including evidence of authority to sell, fraud-prevention checks and information obtained from public registers.

4. Where information comes from

We receive information directly from you or your organisation, from the devices and asset lists supplied to us, from our website and service providers, from logistics partners, and from public sources such as Companies House. If another person at your organisation gives us your details, they should ensure that you are aware of this notice.

We do not intentionally collect personal content stored on purchased devices. If residual personal data is encountered, the device is restricted and handled under our security and release controls while the data is removed, the device is returned, or another lawful outcome is agreed.

5. Why we use information and our lawful bases

6. Our legitimate interests

Where we rely on legitimate interests, we consider the need for the processing, its likely impact and the reasonable expectations of the people involved. Our interests include operating a lawful device-purchase business, responding to enquiries, protecting assets and systems, preventing fraud, maintaining records, improving our services and communicating with relevant business contacts. You may object where the law gives you that right.

7. Who we share information with

We share information only where reasonably necessary, including with:

• our authorised personnel and professional advisers, including accountants, insurers and lawyers;

• website, hosting, communications, IT-security and document-management providers;

• collection, delivery, inspection and approved data-erasure providers where those services are operational and contractually controlled;

• banks, payment providers and fraud-prevention providers;

• regulators, law-enforcement bodies, courts and other authorities where required or permitted by law; and

• a purchaser, investor or adviser involved in a proposed business reorganisation, subject to appropriate confidentiality safeguards.

We do not sell personal information.

8. International transfers

Some service providers may process information outside the United Kingdom. Where this involves a restricted transfer, we use an available lawful safeguard, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with appropriate security checks. Contact us if you would like more information about the safeguard used for a particular transfer.

9. How long we keep information

We keep personal information only for as long as reasonably needed for the purpose collected, legal obligations and the establishment, exercise or defence of claims. Our standard periods are:

• Website enquiries that do not become a transaction: 12 months after the last meaningful contact.

• Customer, supplier and contract records: 6 years after the relationship or relevant contract ends.

• Device reports, IMEI or serial records and certificates: 6 years after the relevant transaction or service.

• Accounting and tax records: 6 years after the end of the relevant financial year, or longer if lawfully required.

• Routine security and access logs: normally 12 months, unless needed to investigate an incident.

• Complaints and related correspondence: 6 years after the complaint is closed.

We may keep a record longer where a legal hold, dispute or regulatory requirement applies. Records are deleted, anonymised or securely destroyed when no longer required.

10. When information is required

Certain information is required so that we can provide a quotation, verify authority to sell, collect devices, enter into a contract or make payment. If the required information is not provided, we may be unable to proceed. Optional website-form fields may be left blank.

11. Your rights

Depending on the circumstances, you may have rights to access, correct or erase personal information; restrict or object to its use; receive certain information in a portable format; and withdraw consent. These rights are not absolute. We may need to verify your identity and will explain any lawful limitation. Contact us using the details above to exercise a right.

Your right to object

You have an absolute right to object to direct marketing. You may also object to processing based on legitimate interests; we will stop unless we have compelling legitimate grounds or need the information for legal claims.

12. Automated decisions

We do not make decisions about people based solely on automated processing, including profiling, that produce legal or similarly significant effects.

13. Security

We use proportionate technical and organisational measures designed to protect personal information, including access controls, supplier controls, secure handling procedures and incident management. No internet service is completely secure, so please avoid sending sensitive information through general enquiry forms unless requested through an appropriate channel.

14. Complaints

Please contact us first at hello@toromobile.co.uk. We will acknowledge a data-protection complaint within 30 days, investigate it and explain the outcome.

You may also complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator: ico.org.uk/make-a-complaint

15. Changes to this notice

We may update this notice to reflect changes in law, technology or our services. The current version will be posted on our website with its effective date. Material changes will be highlighted where appropriate.