Privacy Policy

At IBT, we are committed to make sure that your privacy is protected at all times. We ensure that we comply with the data protection laws of the UK. This policy sets out the basis on which any personal data we collect from you; that you provide us or that we receive from others about you will be processed by us.

It includes data that we hold electronically and in paper files. If you give personal information, it will only be used in accordance with this Privacy Statement. Your information will be held by Innes Building & Timber Merchants Ltd (IBT).

The information we collect

We collect information about you when you open an account, register with the website, place an order, become an employee, supply us goods or request further information from us.

The type of information that may be collected includes (but is not an exhaustive list):

• Personal identifiable information such as: your name and job title, your contact and postal information including email address, demographic information, preferences and web interests D.O.B.
• Financial
• Restricted / Sensitive
• Confidential
• IP Addresses

This can be collected in various ways, examples of which are below (but is not an exhaustive list):

• By you sending us email, text or multimedia messages via a device or printed information through the post
• By filling in fields on our website
• By interacting through our social media platforms such as Twitter, Facebook & Google
• By verbal communication in branch or on the telephone
• By filling in forms, for example when you enquire or ask questions via our website.
• By asking questions or providing comments to any of our websites.
• By answering questions during an employment induction process.

We require this information for internal record keeping, to process and manage your order (if applicable), to improve our products and services to you and for other legitimate business interests.

Who has access and why?

Data will be held and processed for the purpose of providing the service that we are contracted under our Terms of Conditions; or where you have provided your information via our website, telephone communication or at a company location. Only the staff at IBT that have a legitimate need to access data will be authorised to do so. We may also be required to share your data with some third parties. However, where this is necessary, we only disclose the information that is required and we have contracts in place that requires them to keep your information secure and not to use for their own purposes.

How long we retain your personal data?

To meet our legal data protection and privacy obligations, we only hold on to your information for as long as we need it and for the purposes we acquired it for in the first place.

We will collect personal data and retain for as long as required under current legislation as detailed in our Terms of Conditions.

Where you have submitted your data via our website, verbally, in writing or other marketing channels, we shall keep your personal information on our database, subject to an individual’s right to unsubscribe or be forgotten at any time.

Controlling your personal information

By providing us with your information you are consenting to us using your information as set out in this notice. You may choose to restrict the collection or use of your personal information at any time and you have a right to access your information. If you would like to request a copy of your information or would like to change the information we hold about you please contact us at enquiries@ibtmerchants.co.uk

You may choose to restrict the collection or use of your personal information in the following ways:

• Whenever you are asked to fill in a form on one of our websites, look for the box that you can click to indicate that you want the information to be used by us for direct marketing purposes.
• If you have previously agreed to us using your personal information for direct marketing purposes, you may change your mind at any time by writing to or emailing us as per the above information.

We will not sell, distribute or lease your personal information to third parties unless we have your permission or are required by law to do so. We never use staff or suppliers data for marketing purposes.  We may use your personal information to send you promotional information about third parties which we think you may find interesting if you tell us that you wish this to happen.

You may request details of personal information which we hold about you under the Data Protection Act 1998. A small fee may be payable and this would be advised at the time of the request. If you would like a copy of the information held on you please write to: Gerry Carney, Managing Director, IBT Building & Timber (Merchants) Ltd., Wood Street, Grangemouth FK3 8LH.

If you believe that any information we are holding on you is incorrect or incomplete, please write to or email us as soon as possible, at the above address. We will promptly correct any information found to be incorrect.

Security and Web Links

At all times, we ensure that your information is secure. We have suitable physical, electronic and managerial procedures in place to safeguard and secure the information we collect online to prevent unauthorised access or disclosure.

Our website may contain links to other websites. We have no control over them and they are not governed by our privacy statement. If you use these links to leave our site we are not responsible for the protection and privacy of any information you provide while visiting other sites.

We may disclose your information to third parties where you have consented for us to do so or where we are under a legal, regulatory or professional obligation to do so. This, on certain occasions, may be needed to fulfil our obligations to you when supplying you goods or services.

Cookies

Please refer to our Cookie Policy which can be found in the same section as this Privacy Policy.

Marketing information

Using the email and postal address provided by you, we may periodically send you promotional information about new products, special offers or other information, which we think you may find interesting. We may also customise our website according to your interests. From time to time we may also use your information to contact you by email, phone or mail for market research purposes. We only retain information for a limited period, as long as it is required for our purposes.

We would only send this to staff and suppliers for the purpose of sharing information from IBT and not to market in any way.

If you prefer not to receive Marketing Information from IBT, please contact us on 01324 474755 or email at enquiries@ibtmerchants.co.uk

Complaints

At IBT, we would try our utmost to deal with any and all complaints about how we handle personal information but if you feel the need to take further, you can also lodge a complaint with the Information Commissioner’s Office, whose contact details are as follows:

Information Commissioner’s Office (ICO)

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Your Rights

You have a number of rights under GDPR 2016/679:

Right of Access

You have the right, subject to a number of exceptions, to know what information we hold about you.

Right to Rectification

You have the right to have any information we hold about you corrected if inaccurate or incomplete.

Right to Erasure

You have the right to ask us to delete personal information about you where:

• We are using that information with your consent and you have withdrawn your consent – see Withdrawing consent .
• You have validly objected to our use of your personal information – see Right to Object.
• Our use of your personal information is contrary to law or our other legal obligations.

Right to Object

You have the right to object our processing of your personal data on the basis of legitimate interest, for direct marketing or for processing event bookings.

We will stop processing your data on the basis of legitimate interest unless there are compelling legitimate grounds for us to continue.

We will stop any processing of your data for direct marketing as soon as we receive an objection.

Right to Restrict Processing

You have the right to request that we limit how we use your personal data in certain circumstances.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine readable format, and to request that we transfer it to another organisation where technically feasible.

Automatic Processing

We will not make any decision regarding you by purely automated means.

Withdrawing consent using your information

Where we use your personal information with your consent you may withdraw that consent at any time and we will stop using your personal information for the purpose(s) for which consent was given.

The right to lodge a complaint with the Information Commissioner’s Office (ICO) or another supervisory authority.

You have the right to complain to the UK Information Commissioner’s Office (ICO) or another relevant data protection authority if you are dissatisfied with how we manage your personal data.

Provision of Personal Data

Is the provision of personal data statutory or contractual? 

The provision of certain personal data is primarily contractual and, in some circumstances, required to meet legal and regulatory obligations. 

Personal data is required to: 

• enter into and perform contracts with customers, suppliers, or business partners. 

• process orders, manage accounts, and deliver goods and services. 

• verify identity and prevent fraud; and 

• comply with applicable legal, regulatory, accounting, and tax obligations. 

What are the consequences of not providing personal data? 

If you choose not to provide the personal data, we request: 

• we may be unable to enter into a contract with you. 

• we may be unable to fulfil orders, supply goods, or provide services. 

• we may be unable to conduct necessary verification, compliance, or fraud prevention checks; and 

• as a result, our services may be delayed, restricted, or declined. 

Where personal data is requested for optional purposes, such as marketing communications, providing this data is not mandatory, and you may withdraw your consent at any time without affecting your ability to receive goods or services from us. 

Non automated decision making and profiling

We may use automated systems and tools to support certain business processes, such as risk assessment, fraud prevention, affordability checks, identity verification, or record management. 

These tools may analyse personal data using predefined criteria or rules to generate indicators, scores, or recommendations. However, we do not make decisions that have a legal or similarly significant effect on individuals based solely on automated processing. Any such decisions are subject to meaningful human review. 

The use of these tools may influence the speed or level of review applied to an application or request, but individuals will not be subject to automatic rejection or adverse decisions without human involvement. 

Credit Reference and Affordability Checks

To help us assess applications, prevent fraud, and meet our legal and regulatory obligations, we may obtain information about you from credit reference agencies (CRAs).

We obtain this information via Creditsafe, which uses its data partner TransUnion to supply consumer credit and identity data.

• Creditsafe Business Solutions Limited is authorised and regulated by the Financial Conduct Authority FCA Firm Reference Number: 742313

• TransUnion International UK Limited is authorised and regulated by the Financial Conduct Authority FCA Firm Reference Number: 805757

The information we receive may include data relating to your identity, credit commitments, payment history, and public record information. This data is used solely for legitimate business purposes, including creditworthiness assessment, identity verification, and fraud prevention, in accordance with applicable data protection laws.

Further information about how Creditsafe and TransUnion process your personal data can be found in their respective privacy notices:

• Creditsafe Privacy / Transparency Notice

• TransUnion CRAIN (Credit Reference Agency Information Notice)

• TransUnion Bureau Privacy Notice

Identity and contact details of the data controller

• Organisation : IBT Building & Timber (Merchants) Ltd 

• Registered address : 65 Northumberland Street, Edinburgh EH3 6JQ

• Contact email : gerry.carney@ibtmerchants.co.uk

• Company registration number : SC229110 

• ICO registration number : ZA495623 

Contact details of the Data Protection Officer (DPO)

Gerard Carney – 01324 474 755 – gerry.carney@ibtmerchants.co.uk

Details of any international data transfers outside the UK/EU and the safeguards in place

We may transfer personal data to recipients or service providers located outside the UK and/or European Economic Area (EEA). 

Where such transfers take place, we ensure appropriate safeguards are in place to protect personal data in accordance with applicable data protection laws. These safeguards may include the use of approved standard contractual clauses, international data transfer agreements, or transfers to countries that have been recognised as providing an adequate level of data protection. 

Changes to our privacy policy

Any changes we may make to our privacy policy in the future will be posted on this page and emailed to you if appropriate to do so. We would ask you to check this section regularly for any changes to our policy.