Legal
Privacy Policy
Aid on Assignment is committed to protecting your privacy and handling your personal data responsibly. This policy explains what we collect, why we collect it, how long we keep it, and the rights you have under UK GDPR and the Data Protection Act 2018.
Last updated: 6 October 2026
1. Who we are and how to contact us
Aid on Assignment is a sole trader business based in the United Kingdom, supplying first aid kits, refill consumables, and related safety products. Our website address is aidonassignment.co.uk. We are the data controller for the personal data we collect through this website, for the purposes of UK GDPR and the Data Protection Act 2018. For all data protection enquiries, to exercise your rights, or to raise a concern, please contact us: Email: [email protected] Phone: 07446 187504 Postal address: Aid on Assignment, United Kingdom ICO registration: as a small sole trader processing personal data only for core business purposes (order fulfilment, customer communications, and legitimate business interests), we fall within the data controller registration exemption under Schedule 2 of the Data Protection (Charges and Information) Regulations 2018. We comply fully with all UK GDPR obligations regardless of registration status.
2. What personal data we collect and why
We collect and process the following categories of personal data, with the lawful basis for each: Contact and enquiry data (name, email address, telephone number, message content): collected when you submit our contact form or contact us directly. Lawful basis: Article 6(1)(b) UK GDPR — processing necessary to take steps at your request prior to entering a contract, and Article 6(1)(f) — our legitimate interest in responding to business enquiries. Order and transaction data (products ordered, delivery address, payment confirmation, order correspondence): collected when you place an order. Lawful basis: Article 6(1)(b) — performance of a contract to which you are party. Technical and usage data (IP address, browser type, device type, pages visited, time on site): collected automatically via Google Analytics 4 when you consent to analytics cookies. Lawful basis: Article 6(1)(a) — your explicit consent via our cookie consent banner. Communications data (emails, phone call records): collected when you contact us by any means. Lawful basis: Article 6(1)(b) and Article 6(1)(f) — legitimate interest in maintaining records of business communications. We do not collect any special category data (Article 9 UK GDPR) such as health, biometric, or financial data through this website.
3. How we use your personal data
We use your personal data only for the purposes for which it was collected: — To respond to your enquiries and provide quotations. — To process and fulfil your orders, including arranging delivery and issuing invoices. — To communicate with you about your order, including updates, delays, or issues. — To comply with our legal obligations (e.g. tax record-keeping under HMRC requirements). — To improve our website and understand how visitors use it (analytics, with your consent only). — To protect our legitimate business interests, including fraud prevention. We will not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects. We will not use your data for direct marketing without your explicit consent. If you have consented to receive marketing communications, you may withdraw that consent at any time by contacting us at [email protected].
4. Cookies and analytics
Our website uses cookies — small text files stored on your device. We use two categories: Strictly necessary cookies: required for the website to function (e.g. session management, security). These are set automatically and do not require your consent under Regulation 6(4) of the Privacy and Electronic Communications Regulations 2003 (PECR). Analytics cookies (Google Analytics 4): used to understand how visitors use our website (pages visited, time on site, referral source). These cookies are only set after you give your explicit consent via our cookie consent banner. Google Analytics data is anonymised and aggregated; we do not use it to identify individual users. You can withdraw your consent to analytics cookies at any time by clicking the cookie settings link in our website footer, or by clearing cookies in your browser settings. Withdrawing consent will not affect the lawfulness of any processing carried out before withdrawal. For more information about Google Analytics and how Google processes data, see Google's Privacy Policy at policies.google.com/privacy.
5. How long we keep your data (retention periods)
We retain personal data only for as long as necessary for the purpose for which it was collected, or as required by law: Enquiry data (contact form submissions with no resulting order): retained for 12 months from the date of enquiry, then securely deleted. Order and transaction data (including invoices and correspondence): retained for 7 years from the end of the financial year in which the transaction occurred, in accordance with HMRC record-keeping requirements under the Taxes Management Act 1970. Delivery and address data: retained for the duration of the order and for 12 months thereafter to handle any returns, disputes, or warranty claims, then securely deleted. Analytics data (Google Analytics 4): data retention is set to 14 months within Google Analytics. Aggregated, anonymised reports may be retained indefinitely. Email and phone communications: retained for 2 years from the date of last contact, then securely deleted. When data is no longer required, we will securely delete or anonymise it.
6. Who we share your data with
We do not sell, rent, or trade your personal data. We may share your data with the following third parties only where necessary: Delivery providers: your name and delivery address will be shared with our chosen courier or postal service solely for the purpose of fulfilling your order. Payment processors: payment details are processed directly by our payment provider. We do not store full card details. Google LLC (Google Analytics 4): anonymised usage data is shared with Google for analytics purposes, subject to your consent. Google may process this data in the United States. This transfer is covered by Google's Standard Contractual Clauses and its compliance with the UK International Data Transfer Agreement (IDTA) framework. Legal and regulatory authorities: we may disclose your data to HMRC, law enforcement, or other regulatory bodies where required by law or to protect our legal rights. All third parties with whom we share data are required to process it in accordance with applicable data protection law.
7. International data transfers
Your personal data is primarily stored and processed within the United Kingdom. Where we use services that transfer data outside the UK (such as Google Analytics, which may process data in the United States), we ensure that appropriate safeguards are in place in accordance with Chapter V of UK GDPR. These safeguards include: — Standard Contractual Clauses (SCCs) approved by the ICO. — The UK International Data Transfer Agreement (IDTA) framework. — Adequacy decisions made by the UK Secretary of State. You may request details of the specific safeguards in place for any international transfer by contacting us at [email protected].
8. Your rights under UK GDPR
Under UK GDPR (Articles 15–22), you have the following rights in relation to your personal data: Right of access (Article 15): you have the right to request a copy of the personal data we hold about you (a Subject Access Request). We will respond within one calendar month. Right to rectification (Article 16): you have the right to ask us to correct inaccurate or incomplete personal data. Right to erasure (Article 17): you have the right to ask us to delete your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where we have no legitimate grounds to retain it. This right is subject to our legal obligations (e.g. HMRC record-keeping). Right to restrict processing (Article 18): you have the right to ask us to pause processing of your data in certain circumstances, for example while we verify its accuracy. Right to data portability (Article 20): where processing is based on your consent or a contract, you have the right to receive your data in a structured, commonly used, machine-readable format. Right to object (Article 21): you have the right to object to processing based on our legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests. Right to withdraw consent (Article 7(3)): where processing is based on your consent (e.g. analytics cookies), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Rights related to automated decision-making (Article 22): we do not carry out automated decision-making or profiling that produces legal or similarly significant effects. To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. We may need to verify your identity before processing your request. There is no charge for exercising your rights unless requests are manifestly unfounded or excessive.
9. How we keep your data secure
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration, in accordance with Article 32 UK GDPR. These measures include: — Secure, encrypted transmission of data via HTTPS (TLS). — Access controls limiting who can access personal data. — Use of reputable, GDPR-compliant third-party services. — Regular review of our data handling practices. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, in accordance with Article 33 UK GDPR. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay under Article 34 UK GDPR.
10. Children's data
Our website and services are not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at [email protected] and we will delete it promptly.
11. Links to third-party websites
Our website may contain links to third-party websites. This Privacy Policy applies only to aidonassignment.co.uk. We are not responsible for the privacy practices of any third-party sites and encourage you to read their privacy policies before providing any personal data.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. The 'last updated' date at the top of this page will be revised accordingly. We recommend you review this page periodically. Where changes are material, we will endeavour to notify you where we hold your contact details.
13. How to complain
If you are unhappy with how we have handled your personal data, please contact us in the first instance at [email protected]. We will do our best to resolve your concern promptly. If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection: Website: ico.org.uk Helpline: 0303 123 1113 Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF You also have the right to seek a judicial remedy against us or the ICO in a court of competent jurisdiction.
Questions? Email us at [email protected]
Read our Terms of Use →