Privacy Policy

How is your personal data collected?

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email, visiting branch or otherwise. This includes personal data you provide when you:
  • purchase our products or services on a website or in branch;
  • create an account on our sandabm.co.uk website;
  • agree that marketing can be sent to you;
  • enter a competition, promotion or survey;
  • interact with us on social media; or
  • give us feedback or contact us.
• Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. Please see our cookie policy for sandabm.co.uk
• Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:
• Technical Data from the following parties:
  • analytics providers;
  • advertising networks; and
  • search information providers
• Contact, Financial and Transaction Data from providers of technical, payment and delivery services.
• Identity and Contact Data from publicly available sources such as Companies House

How we use your personal data

We will only use your personal data when the law allows us to. We only collect, keep, use or share your information for genuine business purposes in our legitimate interests, when you’ve approved us to do so or when we’re legally obliged to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you (for example when you’re buying products).
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal obligation.
• In limited circumstances, we may request your consent to process your personal data.

Lawful Basis

For S&A Builders Merchants LTD to be allowed to process your personal data, we must have a legal basis for the processing. The data protection legislation sets out what these bases are. We have described below the different bases that we rely on and provided examples of the processing.

• Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us. If you do not want us to process any of the personal data we have listed as being processed for legitimate interests, you have the right to object. For more information see the section below relating to your rights. Please note that if you object, we may still continue to process your personal data in certain circumstances.

Please also remember that if we can’t process your personal data for these purposes your customer experience may not be as enjoyable.

• Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. For example, when you buy a product or service on our site, it creates a contract between us. We need to process your personal data that you provide in the order to fulfil our part of the contract and deliver the products to you. If you do not provide your details, we won’t be able to complete your order.
• Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to. For example, if you buy a product which is an age restricted item (such as knives) or if there is a product recall.
• Consent means processing your personal data where you have explicitly told us that you will allow us to do so. In some cases, we will ask whether you would like us to process your personal data. For example, when an item is out of stock and you provide your telephone number for us to call to discuss available alternatives or notify you when the out-of-stock item becomes available. If you provide us with consent, you may withdraw it at any time by contacting us.

Purposes for which we will use your personal data

We have set out below, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are, where appropriate.
Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/Activity
To register you as a new customer (or set up an account on the website) and maintain such records
Type of data
(a) Identity
(b) Contact
Lawful basis for processing including basis of legitimate interest
(a) Performance of a contract with you
(b) Consent (if account not used) – you may withdraw your consent at any time by contacting us
To retain a record of your purchases made in branch
Type of data
(a) Identity
(b) Contact
(c) Financial Data
(d) Transaction Data
Lawful basis for processing including basis of legitimate interest
(a) Performance of a contract with you
(b) Consent - you may withdraw your consent at any time by contacting us
When we communicate with you about any enquiry or order by any method (including telephone or email) or when you engage with us on social media
Type of data
(a) Identity
(b) Contact
(c) Financial Data
(d) Transaction Data
(e) Profile
(f) Marketing and Communications
(g) Technical
Lawful basis for processing including basis of legitimate interest
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to analyse any customer interactions)

To process and deliver your order including: (a) Manage payments, fees and charges (b) Collect and recover money owed to us (c) Credit status approval (d) Assess credit risk
Type of data
(a) Identity
(b) Contact
(c) Financial
(d) Transaction
(e) Marketing and Communications
(f) Technical data
Lawful basis for processing including basis of legitimate interest
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to recover debts due to us or to assess credit risk)
To manage our relationship with you which will include: (a) Verifying your identity if you contact us (b) Notifying you about changes to our terms or privacy policy (c) Asking you to leave a review or take a survey (and the results of such review or survey)
Type of data
(a) Identity
(b) Contact
(c) Profile
(d) Marketing and Communications
Lawful basis for processing including basis of legitimate interest
(a) Performance of a contract with you
(b) Necessary to comply with a legal obligation
(c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services and provide other consumers with information about our products or services)
To enable you to partake in a prize draw, competition or complete a survey
Type of data
(a) Identity
(b) Contact
(c) Profile
(d) Usage
(e) Marketing and Communications
Lawful basis for processing including basis of legitimate interest
(a) Performance of a contract with you
(b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business)

To administer and protect our business and our websites (including troubleshooting, testing, data analysis, testing, system maintenance, support, reporting, hosting of data, research, and risk management)
Type of data
(a) Identity
(b) Contact
(c) Technical
Lawful basis for processing including basis of legitimate interest
(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security.)
(b) Necessary to comply with a legal obligation
To deliver relevant website content (including pop ups) and advertisements to you and measure or understand the effectiveness of the advertising we serve to you. Such processing includes matching and aggregating of your personal data with internal and external sources
Type of data
(a) Identity
(b) Contact
(c) Profile
(d) Usage
(e) Marketing and Communications
(f) Technical
Lawful basis for processing including basis of legitimate interest
(a) Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
(b) Consent (where such use involves cookies), you may withdraw your consent at any time
To use data analytics including which parts of our website you visit to improve our website, products/services, marketing, customer relationships and experiences
Type of data
(a) Technical
(b) Usage
Lawful basis for processing including basis of legitimate interest
(a) Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
(b) Consent (where such use involves cookies) you may withdraw your consent at any time

To make suggestions and recommendations to you about goods or services (marketing communications) that may be of interest to you on the website (or elsewhere on the internet including on social media platforms) or (if you have previously purchased from us) by email, SMS, telephone, social media or post
Type of data
(a) Identity
(b) Contact
(c) Technical
(d) Usage
(e) Profile
(f) Marketing and Communications
Lawful basis for processing including basis of legitimate interest
(a) Necessary for our legitimate interests (to develop our products/services and grow our business)
(b) Consent (where such use involves cookies) or where you have made a purchase in branch that is not being delivered, you may withdraw your consent at any time
To call you on the telephone to discuss your delivery
Type of data
(a) Identity
(b) Contact
(c) Financial Data
(d) Transaction Data
(e) Profile
(f) Marketing and Communications
Lawful basis for processing including basis of legitimate interest
Necessary for our legitimate interests to ensure that we have all the relevant details to provide you with a smooth delivery and to grow our business
To contact you where you have asked us to including: (a) to notify you when an out of stock item becomes available by email, SMS or call to discuss alternative (b) information about new product releases (c) if you are not a customer and have registered to receive marketing communications
Type of data
(a) Identity
(b) Contact
(c) Marketing and Communications
Lawful basis for processing including basis of legitimate interest
Consent, you may withdraw this consent at any time
To comply with legal obligations and prevent crime including: (a) crime and fraud prevention purposes; (b) to verify your age when purchasing age restricted items; (c) to conduct anti money laundering checks
Type of data
(a) Identity
(b) Contact
(c) Financial
(d) Technical
(e) Usage
(f) Profile
Lawful basis for processing including basis of legitimate interest
(a) Necessary to perform the contract with you
(b) Necessary for our legitimate interests (to prevent fraudulent purchases on our websites)
To improve our service quality including: (a) providing training for our employees to ensure that we provide you with the best possible service; (b) call recording for training, compliance and legal or regulatory reasons
Type of data
(a) Identity
(b) Contact
(c) Financial
(d) Transaction
Lawful basis for processing including basis of legitimate interest
(a) Necessary for our legitimate interests (to improve service quality and compliance)
(b) To comply with a legal obligation
We may change our privacy policy from time to time. This policy was last updated on 3rd January 2023, version 1.0