Privacy policy
PRIVACY POLICY
Last updated: 17 August 2026
1. ABOUT US
SG Paintwork Ltd, trading as CDL Tools (“CDL Tools”, “we”, “us” and “our”), operates this website and online store.
SG Paintwork Ltd is registered in England and Wales under company number 14455086 and is the data controller responsible for the personal information described in this Privacy Policy.
Our store is powered by Shopify, which enables us to provide our online store, checkout and related services.
This Privacy Policy explains how we collect, use, retain and disclose personal information when you:
• Visit or use our website;
• Create an account;
• Purchase, return or enquire about a product;
• Use Ask Geoff, the Job Tool Finder or another interactive feature;
• Join our mailing list;
• Contact us by telephone, email, online form or another method; or
• Otherwise interact with CDL Tools.
“Personal information” means information that identifies you or can reasonably be linked to you. It does not include information that has been anonymised so that you can no longer be identified.
2. PERSONAL INFORMATION WE COLLECT
Depending on how you interact with us, we may collect the following categories of personal information:
Contact information
This may include your name, billing address, delivery address, email address and telephone number.
Account information
This may include your username, password, account preferences, settings and purchase history.
Order and transaction information
This may include products viewed, placed in your basket, ordered, returned, exchanged or cancelled; order values; discounts; invoices; delivery details; payment status and previous transactions.
Payment information
Payments are processed by Shopify and the payment providers displayed during checkout. CDL Tools does not normally receive or store your complete payment-card number.
We may receive limited payment information such as the payment method, confirmation of payment, card type, the last digits of a card and information required for refunds, fraud prevention and accounting.
Communications
This includes information contained in emails, telephone calls, customer-support enquiries, product reviews, photographs, online forms and other communications with us.
Ask Geoff and Job Tool Finder information
If you use Ask Geoff, the Job Tool Finder or a similar service, we may collect information about:
• Your vehicle, including its make, model, year, engine or registration details;
• The repair, maintenance task or job you intend to undertake;
• Tools or equipment you already own;
• Questions, photographs or supporting information you provide; and
• Your contact details if you ask us to respond.
Device and usage information
This may include your IP address, browser, device type, network information, cookie identifiers, pages viewed, searches, links selected, session information and how you interact with our website.
Marketing information
This may include your marketing preferences, whether you opened or interacted with a communication and products or categories in which you have shown an interest.
Fraud-prevention and security information
This may include information used to authenticate an account, protect payments, detect fraud and secure our website and Services.
3. HOW WE COLLECT PERSONAL INFORMATION
We may collect personal information:
• Directly from you when you create an account, place an order, contact us, use an interactive feature or otherwise provide information;
• Automatically through our website, cookies and similar technologies;
• From Shopify, payment providers, couriers, suppliers and service providers;
• From marketing, analytics and advertising providers where legally permitted;
• From social-media platforms when you interact with our pages or use a social-media feature; and
• From publicly available sources or fraud-prevention services where appropriate.
4. HOW WE USE PERSONAL INFORMATION
We may use your information to:
Provide our Services
This includes operating our website, processing payments, accepting and fulfilling orders, arranging delivery, maintaining accounts, providing invoices, processing returns and refunds and remembering your preferences.
Provide customer service
This includes responding to questions, handling complaints, helping identify products and communicating about orders, deliveries, warranties and returns.
Provide tool guidance
We may use the information supplied through Ask Geoff, the Job Tool Finder or another enquiry to recommend potentially relevant tools or equipment.
These recommendations provide general preparation guidance. Vehicle specifications, production changes and repair procedures vary. Customers should confirm procedures, tool sizes, torque settings and technical requirements against reliable vehicle-manufacturer information before beginning work.
Improve and personalise our Services
We may analyse how customers use the website to improve navigation, product information, recommendations, customer service and website performance.
Marketing and advertising
Where legally permitted, we may send information about products, services, promotions and events that may interest you.
You can unsubscribe from marketing emails using the link in the email or by contacting us. Opting out of marketing will not prevent us from sending necessary communications about your account or orders.
Security and fraud prevention
We may use information to authenticate accounts, protect customers, secure payments and identify, investigate or prevent fraudulent, illegal, unsafe or malicious activity.
Legal and regulatory purposes
We may use information to comply with tax, accounting, consumer-protection and other legal obligations; respond to lawful requests; resolve disputes; enforce our terms; and establish, exercise or defend legal claims.
5. OUR LAWFUL BASES
UK data protection law requires us to have a lawful basis for processing personal information. Depending on the circumstances, we rely on:
Contract
We process information where necessary to take steps at your request or perform a contract with you. This includes processing orders and payments, delivering products, managing accounts and handling returns.
Legal obligation
We process information where necessary to comply with legal obligations, including accounting, VAT, fraud-prevention, product-safety and consumer-protection requirements.
Legitimate interests
We may process information where necessary for our legitimate interests or those of another organisation, provided those interests are not overridden by your rights.
Our legitimate interests may include:
• Operating and improving our business and website;
• Providing customer service and relevant tool guidance;
• Maintaining network, account and payment security;
• Preventing fraud and misuse;
• Understanding demand and website performance;
• Recovering debts and defending legal claims; and
• Promoting relevant products to existing customers where legally permitted.
We consider the purpose, necessity and potential effect on your rights before relying on legitimate interests.
Consent
We rely on consent where required, including for certain marketing communications, non-essential cookies and personalised advertising.
You may withdraw consent at any time. Withdrawal does not affect processing that took place lawfully before consent was withdrawn.
6. MARKETING
We may send electronic marketing where:
• You have consented;
• You have previously purchased or enquired about similar products and the applicable “soft opt-in” requirements are satisfied; or
• Another lawful basis permits the communication.
Every marketing email will provide a straightforward method of unsubscribing.
We will stop using your information for direct marketing when you object or withdraw consent. We may retain limited suppression information to ensure that we continue to honour your request.
7. COOKIES AND SIMILAR TECHNOLOGIES
Our website and service providers may use cookies, pixels, local storage and similar technologies to:
• Operate essential website and checkout functions;
• Remember account and basket information;
• Maintain security and prevent fraud;
• Measure website performance;
• Understand how customers use the website; and
• Provide advertising or personalisation where consent has been given.
Where required, non-essential cookies will not be used until you provide consent through our cookie or privacy settings.
You can change your choices using the privacy settings available on our website. You may also control cookies through your browser, although blocking essential cookies may prevent parts of the website or checkout from working correctly.
8. HOW WE DISCLOSE PERSONAL INFORMATION
We may disclose relevant personal information to:
Shopify
Our store is hosted by Shopify, which processes information to provide and improve the ecommerce, account and checkout services used by our store.
Payment providers
Payment providers process payments, refunds and fraud checks.
Delivery companies and suppliers
We may provide necessary order and delivery information to couriers and fulfilment or dropshipping suppliers, including Sealey and other suppliers dispatching products directly to customers.
Technology and professional service providers
This may include website hosting, IT support, email, data storage, analytics, accounting, customer support, marketing, legal and professional advisers.
Business and marketing partners
Where legally permitted, information may be used with service providers to measure or provide marketing. Such providers must process information according to applicable law and their own privacy notices.
Public authorities and other organisations
We may disclose information where required by law, a court order or a valid request from a regulator, law-enforcement body or public authority.
Business transactions
Information may be disclosed in connection with a proposed or completed sale, restructuring, merger, financing, administration or transfer of all or part of our business.
We do not sell personal information for money.
9. SHOPIFY
Shopify processes personal information about access to and use of our store to provide and improve its services.
Information supplied through our store may be transmitted to Shopify and service providers located in countries other than the United Kingdom.
Shopify may use information obtained through interactions with our store, other merchants and Shopify services to provide enhanced features for which Shopify is responsible.
Further information is available in the Shopify Consumer Privacy Policy:
https://www.shopify.com/legal/privacy/app-users
Shopify privacy requests can be made through:
https://privacy.shopify.com/en
10. INTERNATIONAL TRANSFERS
Some service providers may process personal information outside the United Kingdom.
Where information is transferred to a country that does not have an applicable UK adequacy decision, we or our service providers will use an appropriate safeguard recognised under UK data protection law. This may include the UK International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses or another recognised transfer mechanism.
11. RETENTION
We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.
Our usual retention periods or criteria include:
• Order, invoice, VAT and transaction records: normally six years after the relevant transaction or accounting period;
• Customer-account information: while the account remains active and for a reasonable period after closure;
• Customer-service enquiries: normally up to two years after resolution, unless connected with an order, dispute or legal obligation requiring longer retention;
• Tool Finder and Ask Geoff enquiries: normally up to two years after resolution, unless the information forms part of an order or ongoing customer relationship;
• Marketing records: until you unsubscribe or withdraw consent;
• Marketing suppression information: for as long as reasonably necessary to honour an opt-out;
• Website and analytics information: according to the applicable cookie duration and privacy settings; and
• Fraud-prevention and security records: for as long as reasonably required to investigate threats and protect customers and our Services.
We may retain information for longer where necessary to comply with law, resolve a dispute or establish, exercise or defend a legal claim.
When information is no longer needed, it will be deleted or anonymised.
12. SECURITY
We use reasonable organisational and technical measures intended to protect personal information against unauthorised access, disclosure, alteration, loss and misuse.
No internet transmission or storage system is completely secure. You should not send sensitive or confidential information through an unsecured communication channel.
If you create an account, you are responsible for keeping your login information secure and should not share your password with another person.
13. AUTOMATED DECISION-MAKING
CDL Tools does not ordinarily make decisions producing legal or similarly significant effects solely through automated processing.
Shopify, payment providers and fraud-prevention providers may use automated systems to identify potentially fraudulent or unauthorised activity. Further information about such processing may be available in their privacy notices.
14. THIRD-PARTY WEBSITES
Our Services may contain links to websites, social-media services or other platforms operated by third parties.
We do not control and are not responsible for the privacy, security, content or accuracy of third-party websites. You should review their privacy policies before providing personal information.
The presence of a link does not necessarily mean that CDL Tools endorses the third party or its content.
15. CHILDREN
Our Services are not directed at children, and we do not knowingly collect personal information from children.
If you are a parent or guardian and believe that a child has provided personal information to us, please contact us so that we can investigate and, where appropriate, delete it.
16. YOUR RIGHTS
Subject to applicable exceptions, UK data protection law may give you the right to:
Access
Request confirmation of whether we process your personal information and obtain a copy.
Correction
Ask us to correct inaccurate or incomplete personal information.
Deletion
Ask us to delete personal information in certain circumstances.
Restriction
Ask us to restrict how personal information is processed in certain circumstances.
Objection
Object to processing based on legitimate interests.
You have an absolute right to object to the use of your personal information for direct marketing.
Portability
Receive certain information in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation where applicable.
Withdraw consent
Withdraw consent where processing relies upon it.
Automated decisions
Ask for information about, or request human intervention in relation to, certain solely automated decisions where applicable.
You may exercise these rights by emailing sales@cdltools.co.uk.
We may request reasonable information to confirm your identity. We normally respond within one month, although the law permits additional time for particularly complex requests.
These rights are not absolute, and we may refuse or limit a request where permitted by law. If we do so, we will explain the reason.
17. COMPLAINTS
Please contact us first if you have concerns about how we process personal information. We will try to resolve your concern promptly.
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website:
https://ico.org.uk/make-a-complaint/
18. CHANGES TO THIS PRIVACY POLICY
We may update this Privacy Policy to reflect changes in our business, Services, technology or legal obligations.
We will publish the revised policy on our website, update the “Last updated” date and provide any additional notice required by law.
19. CONTACT US
For questions about this Privacy Policy, our use of personal information or the exercise of your data-protection rights, contact:
SG Paintwork Ltd trading as CDL Tools
Company number: 14455086
Unit 10 Larch Court
Elm Road
North Shields
NE29 8SG
United Kingdom
Email: sales@cdltools.co.uk
Telephone: 07401254454
SG Paintwork Ltd is the data controller for the purposes of applicable UK data protection law.
