- General
CLS UK Ltd is committed to safeguarding your privacy. CLS UK Ltd and all of its subsidiaries (hereinafter referred to as “the CLS Group”) respect your rights regarding the privacy and protection of your personal data.
The purpose of this “Personal Data Protection Policy” (hereinafter the “Policy”) is to inform all individuals (natural persons) concerned (hereinafter referred to as “You” or “Your”) about the way in which the CLS Group collects, uses and discloses your personal data and about the rights you have regarding this data.
This privacy notice policy contains information about how we collect and process personal data in accordance with our legal obligations under the Data Protection Act 2018 and the Data (Use and Access) Act 2025, based on the General Data Protection Regulation (GDPR) underpinned by our ISO27001 certification.
This version of the Policy reflects the latest legal and factual developments known on the date of its entry into force. This Policy complies with the General Data Protection Regulation (Regulation EC 679/2016 – “GDPR”) and Law No. 78-17 of 6 January 1978 relating to information technology, files and freedoms.
Any mention of the term “CLS Group” refers to the CLS entity and its subsidiaries that act as a controller or processor of your information.
- Who are we and how to contact us
We, CLS UK ltd, are part of the CLS Group. CLS UK Ltd registration number: 06635456, place of registration in England & Wales.
Registered address – Wellesley House, Duke of Wellington Avenue, Royal Arsenal London SE8 6SS
You can contact us at any time through or engage with UK office using
Our UK Head Office and postal address is:
3 Park Mews, Park Lane, Hornchurch RM11 1BB
Tel:+ 44 1708 788 400
- Scope
This Policy applies to the CLS products and services, marketing websites operated by CLS UK Ltd (hereinafter referred to as the “Media”, which includes all CLS Group “Shopify” marketing sites). Consequently, this Policy does not apply to the websites of third parties, including those that may be mentioned on our Media via a web link.
“Personal Data” corresponds to any information relating to an identified or identifiable natural person, directly or indirectly, and which is protected by the GDPR and all regulations applicable to its protection.
“Processing” means any operation, or set of operations, relating to such Data, regardless of the process used (collection, recording, organization, storage, adaptation, modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, alignment or interconnection, blocking, erasure or destruction, etc.).
- Personal data
In the provision of our services, whether or not you become a customer, you may be asked you to provide personal data as describe hereunder. This data is used primarily to allow us to provide our key services to you or to be able to support our customers. If contracts are formed, further information will be required to support our due diligence processes.
Personal Data is collected solely for the purposes of the operation of services and of the media and their respective functionalities.
More specifically, the CLS Group and the Shopify company collect and use your Personal Data for the following purposes:
- To enable you to acquire CLS products and services;
- To allow you to create a user account;
- To enable you to request and obtain information about the CLS Group, our products and services;
- To allow you an interactive and personalized use of the media;
- To allow you to get in touch with the CLS Group;
- To enable the CLS Group to manage its commercial relations;
- To allow Shopify to administer the sale of CLS products and services on behalf of CLS
If you require equipment or delivery of documentation, only your delivery details will be sent to the courier company to service efficiency of the delivery.
If you supply any card information to us for billing to pay by credit card, this is done through a third party (WORLDPAY). All information regarding personal data processing by WORLDPAY is described here : WORLDPAY PRIVACY CENTER.
If you are not the account holder, you must have the authority of the account holder and provide to them with this policy.
CLS UK may collect and process the following categories of Personal Data:
| Category | Types of Personal Data | Source |
| Identification data | First name, surname, username/login credentials | Provided directly by you
|
| Contact data | Postal address, email address, telephone number | Provided directly by you
|
| Professional data | Job title, company name, organisation details | Provided directly by you
|
| Account data | Account login details, password (encrypted), account preferences | Provided during account creation
|
| Transactional data | Order history, purchase details, delivery information | Generated through services
|
| Payment data | Cardholder name, billing address, payment details (processed securely by Worldpay) | Provided at payment stage
|
| Technical / Metadata |
IP address, device identifiers (e.g. MAC where applicable), browser type, operating system, session logs, time zone, geolocation (approximate)
|
Collected automatically
|
| Usage data | Website interactions, pages visited, clicks, navigation behaviour | Collected via cookies/analytics
|
| Communications data | Emails, enquiries, support requests, call records | Provided directly by you |
Personal Data collected is limited to what is strictly necessary for the purposes described in this Policy, in accordance with the data minimisation principle under GDPR.
We do not:
- i) collect any special category information of personal data, such as race, ethnicity, religion, philosophical beliefs, health, sexuality orientation or biometric information, or political.
- ii) collect sensitive personal data, which is not required in the provision of our services.
iii) Use automated decision-making or AI
- iv) Send promotional material unless you have opted in to be kept in formed.
What we use your information for
We will use your personal data to provide our services that you have requested from us. Data is collected and used on a lawful basis only which is outlined below. You are free to withdraw your consent at any time, or you may request that we cease processing your data. However, this may result in us not being able to provide a full service and support for you.
When you use our media, we may collect and process some or all of the following data:
Support navigation
- Cookies
- Logs
- IP address
- Localization
- Time zone
User account
- First and last name
- Email address
- Phone Number(s)
Purchase and delivery
- Banking information
- Physical address(es): billing and/or delivery
- Geolocation
- Orders history
The collection of this collected Personal Data is always limited to the data necessary for the purposes set out below.
ATTENTION: Please note that certain functionalities and characteristics of the media can only be used if you provide certain Personal Data. You are free to provide or not provide all or part of Your Personal Data. However, if You choose not to provide them, such a decision may prevent the achievement or satisfactory achievement of certain purposes described below. For these reasons, the completion of a sale cannot be done without the processing of some of your personal data.
Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to support and meet your requirements.
We will only use your personal data for the purpose for which it is collected or when the law allows us to, following GDPR, this will be in the following circumstances.
If we need to use your personal data for an unrelated purpose, we will notify and explain full details to why we have used your personal data.
| Personal data | Lawful basis | Purpose |
| First Name, Surname, contact information (Address, phone number), email | To provide a service (contract) | To take steps at your request prior to entering into a contract to decide whether to enter into a contract
To manage and perform the contract To ensure our records remain relevant |
| First Name, Surname, email, job role
Metadata |
Our legitimate interest | For good governance, accounting, managing and auditing our business operations for market research, analysis and developing statistics
To send you marketing communications with your consent To improve the use of our website experience |
| First Name, Surname, contact information (Address, phone number), email | Legal obligation | When you exercise your rights under data protection law and make requests for compliance with legal, regulatory requirements and related disclosures
For establishment and defence of legal rights For activities relating to the prevention, detection and investigation of crime To verify your identity, engage in fraud prevention and anti-money laundering checks |
| First Name, Surname, contact information (Address, phone number), email
|
Your consent | To send you marketing communications where we have asked for your consent to do so |
- Collecting personal Data
When you visit our website, we collect personal data;
Provided directly by you – when completing website registration order forms, calling for help, applying for a job, emailing for support.
Personal data relating to payment is only collected and processed by service provider Worldpay.
Collected automatically – Information and metadata such as IP addresses and pages visited, and links clicked on, will be automatically picked up by SEO software such as google analytics to enable us to provide a better service and experience to our customers.
Why do we collect this metadata?
Metadata allows us to:
- To improve the performance and security of our website.
- To analyse the audience and use of our site in order to optimise the user experience.
- Detect and prevent possible fraud, abuse, or malicious activity.
- Personalize content and services based on user preferences.
Metadata sharing and retention
The metadata collected is mainly used internally and may be shared with technical service providers (e.g. analytical tools) in compliance with the regulations in force. It is kept for a period of time in accordance with legal requirements and defined purposes, generally 6 to 13 months for analytical data.
Information from other parties – when we receive a request to contact you from a Government Administration party to allow us to support their contractual requirements.
Protection of minors’ data
Our media are not directed to minors under the age of 18. We do not intentionally collect personal data from minors without the verifiable consent of a parent or legal guardian.
If you are a parent or guardian and you find that your child has provided us with personal information without your permission, please contact us. We will take steps to remove such information from our systems.
- Data retention period
CLS UK retains Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements.
Retention periods are determined based on:
- Legal obligations
- Contractual requirements
- Business needs
- Nature and sensitivity of the data
Once retention periods expire, data is securely deleted or anonymised.
You are able to request your data to be deleted as one of your rights set out below.
Retention Schedule
| Type of Data | Retention Period | Justification |
| Customer and contact data | Up to 6 years after end of relationship | Legal obligation (UK Companies Act, tax requirements) |
| Contractual and transactional data | Up to 6 years | Legal and audit requirements |
| Account data | Duration of account + up to 2 years after inactivity | Service provision and dispute resolution |
| Marketing data | Until consent is withdrawn or after 3 years inactivity | GDPR consent rules |
| Metadata / analytics data | 6 to 13 months | CNIL/ICO guidance for analytics cookies |
| Cookies | Maximum 13 months | Regulatory compliance |
| Communication records | Up to 3 years | Business and complaint handling |
| Payment data | Managed by Worldpay (see their policy) | Third-party processor responsibility |
- Data Protection and security
We have in place measures and controls to protect the confidentiality, integrity and availability of your personal data. This is also backed up our ISO 27001 certification and Cyber Essentials. We are a responsible supplier and at all costs, we prevent your personal data from being lost or stolen, used or accessed in an unauthorised manner, or altered in anyway. Access to your data is only given subject to the duty and requirements of those involved.
In the event of a breach, we shall notify you and any applicable regulator where legally required to do so. This is intended to be within 72hrs of becoming aware of the breach.
Regarding payment data please refer to the information provided by Worldpay on their Privacy Centre.
- Links to third parties’ websites (not controlled by the CLS UK)
This Policy applies only to CLS UK’s technologies and services. Our website may include links to websites and online services that are operated by other companies that are not under the control or direction of CLS UK. If you provide or submit personal information to these websites or online services, the privacy policies of those websites or online services apply to your personal information. We encourage you to carefully read the privacy policies of any website you visit.
- Your rights
Under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
GDPR addresses the main principles of data protection and the potential export of personal data outside the EU and EEA. The GDPR aims primarily to give control to citizens and residents over their personal data, this includes:
- The right to be informed about how your data is being used
- The right of access your personal data
- The right of rectification if data is incorrect
- The right of erasure record or data
- The right to restrict or stop processing of your data
- The right to data portability (allowing you to get and reuse your data for different services)
- The right to object to how your data is processed in certain circumstances
- Rights in relation to automated decision making and profiling
You also have rights when an organisation is using your personal data for:
- automated decision-making processes (without human involvement)
- profiling, for example to predict your behaviour or interests
If you’re concerned about how we handle your personal data, contact the ICO for advice
ICO
Telephone: 0303 123 1113
Textphone: 18001 0303 123 1113
Monday to Friday, 9am to 5pm
Find out about call charges
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
If you would like further information about data protection you can visit the Information Commissioner’s Office (ICO) at ico.org.uk. The ICO is the UK’s independent authority set up to uphold information rights in the public interest and data privacy for individuals. We comply with all ICO regulatory and statutory requirements. You have the right to make a complaint to the ICO regarding the handling of your data.
- Sharing your information
We will not sell, share, or rent your information to any third party for marketing or commercial purposes. Exceptions will be third party data processing information on our behalf such as couriers, Flag administrations or Credit card transactions – World pay who are used to assist in the services we offer. However, in the event of the sale of the Company or its assets, your personal details may be disclosed to the purchaser of the Company or the purchaser of its assets. Our website may contain links to other sites. CLS UK is not responsible for the privacy practices or the content of other websites.
- Third Party Processors
CLS UK uses carefully selected third-party service providers (“processors”) to support the delivery of its services. These processors act on our behalf and are contractually bound to protect Personal Data.
We ensure all processors:
- Only process data on our instructions
- Implement appropriate security measures
- Comply with GDPR and applicable laws
| Processor | Purpose | Data Processed | Location |
| Worldpay | Payment processing | Payment details, billing information, contact data | UK / USA (see Worldpay policy) |
| DHL | Delivery services | Name, delivery address, contact details | UK / International |
| APC Overnight | Delivery services | Name, delivery address, contact details | UK |
| Shopify | Website hosting / e-commerce platform | Account data, transaction data, technical data | Canada / USA |
| Google Analytics | Website analytics | IP address (anonymised), usage data | USA / EU |
| Microsoft (e.g. 365) | Email, document storage, CRM | Contact and communication data | EU / Global |
A current list of sub processors may be requested at any time by contacting the Data Protection Officer.
- International transfers
Our services are primarily handled in the UK. However, your personal data may be transferred outside the UK and the European Economic Area. When it is required additional support from our subsidiaries and partners who adhere to protecting your data. In the event countries do not have adequate protections for personal data under applicable laws we will take all necessary steps to safeguard your personal data.
- Opting out of marketing communication
Please be aware that we do sometimes send marketing communications that promote our products and services and those of our strategic partners. We will respect your choice as to what communications you wish to receive and how these are sent. You are free to opt out of receiving all communications from us and our strategic partners at any time by contacting us.
- Use of cookies
Our website uses cookies. A cookie is a piece of data stored on your computer’s hard drive that identifies your computer while you are using our site. Once you shut down your browser software, the cookie simply terminates until you re-enter the site. Cookies have a number of uses. For example, cookies are part of the mechanism that allows you to log in and out of our website rather than having to enter your password repeatedly during a session. Cookies can be used for analytics purposes to estimate the number of users to our site. Once you are logged in, cookies can be used to enable us to track and target your interests to enhance your experience on our site. They may also be used for other purposes, such as to maintain the security of the site and provide information on what we need to do to provide administration support to the site. We provide specific details about the cookies we use and the reasons for using these cookies in our Cookie Policy to enable site visitors to make an informed decision and thus provide informed consent.
- Reviewing, correcting or updating your personal data
If any of your details are recorded incorrectly and need to be changed, please contact us on: + 441708 788 400 with details of the required changes and the reasons for the change. Proof of change of address may be needed.
Customer Services opening times: Monday to Friday 9:00am – 5:00pm
Alternatively, you can write to the Data Protection Officer (DPO) regarding accessing your personal data or any part of this privacy policy by writing to CLS UK, 3 Park Mews, 15 Park Lane, Hornchurch, RM11 1BB or emailing .
- DSAR (Data Subject Access Request)
You have the right to request access to the personal data we hold about you. To submit a Data Subject Access Request (DSAR), please contact us.
We will respond within one month of receiving your request. For complex or multiple requests, this period may be extended by up to two additional months, and we will inform you of any extension.
We apply a reasonable and proportionate search standard, meaning we will make reasonable efforts to locate your personal data without incurring disproportionate costs or burdens.
If your request is considered vexatious or excessive, we may refuse to act on it or charge a reasonable fee. We will explain our decision in writing.
If we require clarification to process your request, we may pause the response time (“stop the clock”) until you provide the necessary information.
If you are dissatisfied with our response, you may use our internal complaint process before contacting the Information Commissioner’s Office (ICO).
CLS UK may ask evidence in order to control the identity of the Data Subject.
- Changes to the Privacy Policy
We may amend this privacy policy from time to time. Laws, regulations and industry standards evolve, which may necessitate such amendments, or we may make changes to our business. We will post these changes on this page and encourage you to review our Privacy Policy to stay informed. If we make changes that significantly alter your rights and our policies, we will notify you by email or via the website. If you do not agree with the changes made to this Privacy Policy, please contact us if you wish to request the deletion of your Personal Data.
Date effected from: 24/09/2018
Latest review date: 30/07/2026
Version: 1.4