Last updated:
1. Who we are and how to contact us
CCEUK Ltd is the controller responsible for the personal information described in this policy. We buy and sell commercial catering equipment and are based in Telford, UK.
Registered in England and Wales, company number 13234993. Registered office: Unit 4, Unit 4 Redland Industrial Estate, Station Hill, St Georges, Telford, Shropshire, United Kingdom, TF2 9JX. This is our registered office, not an invitation to visit; please arrange any visit directly with us.
For privacy questions or to exercise your rights, email [email protected], call 07421 022688 (international: +44 7421 022688), or write to the registered office above, marked “Privacy”.
2. Information we handle
- Enquiries and communications: your name, business name, contact details, correspondence, equipment requirements and information you choose to give us by telephone, email or other direct communication.
- Equipment offers: descriptions, condition, location, access arrangements and photographs of equipment you offer to sell. Photographs and free text may contain personal information, so please avoid including unrelated people, documents or sensitive details.
- Purchases and sales: customer, supplier and business contact details, billing or delivery information, agreed orders, invoices, payment references, amounts, payment status, collection or delivery arrangements and related correspondence.
- Website and staff security: IP addresses, request times, pages requested, browser/device information, session identifiers and security or error logs. Staff accounts also have login details and records of administrative activity.
- eBay and listing preparation: the seller account and listing information explained below, plus product source material and photographs selected by authorised staff.
We receive information from you, people acting for your business, authorised staff, eBay when access is authorised, and the operation of the website. Business contact details can still be personal information where they identify an individual.
Current website arrangements: online enquiry and equipment-offer submissions and their email notifications are disabled. Please telephone or email us directly. The website has no customer accounts, basket, checkout or online payment facility. We do not collect card details through this website. Payment and invoicing arrangements are agreed directly with CCEUK.
The prepared equipment-offer system, when enabled, is designed to store submissions and their history for authorised staff, with encrypted enquiry details and private photographs. Enabling submission or notifications requires a separate operational review; this policy does not mean those services are currently available.
3. Why we use information and our lawful bases
- Responding to enquiries and arranging purchases or sales: steps requested before a contract and performing that contract where you are the contracting individual. For business representatives and general enquiries, our legitimate interests in communicating with customers and suppliers and running the business.
- Orders, accounts and transaction records: performing contracts, meeting applicable tax and accounting obligations, and our legitimate interests in managing payments, resolving disputes and keeping reliable business records.
- Website operation, fraud prevention and security: our legitimate interests in keeping the site, staff systems and information safe and functioning properly.
- Product preparation and authorised eBay access: our legitimate interests in maintaining accurate equipment information and managing our sales channels, subject to the seller's explicit eBay authorisation.
- Privacy requests and legal matters: compliance with applicable legal obligations and, where appropriate, our legitimate interests in establishing or defending legal claims.
Where we rely on legitimate interests, we consider the effect on your rights. If we introduce optional processing that needs consent, we will explain it and obtain consent first. You can withdraw consent without affecting earlier lawful processing. Essential contact or transaction information may be needed to answer a request or fulfil an agreement.
4. Cookies and website analytics
We currently use essential first-party cookies, not advertising or third-party audience analytics tools:
- cceuk_review_session: maintains the website session, including staff sign-in and security state. Despite its historical name, it is an operational session cookie.
- XSRF-TOKEN: helps protect form and staff actions against forged requests.
Both cookies currently expire after two hours, renewed with activity. They are sent over HTTPS; the session cookie is also inaccessible to browser scripts. Staff administration uses local browser storage for sidebar display preferences. No public analytics or advertising storage was found in our current installation.
Cloudflare provides traffic delivery and security and processes connection and request information. It may set additional security or challenge cookies when required; these were not present in our ordinary browsing check. See Cloudflare's cookie information. Operational traffic statistics and security logs are distinct from advertising tracking.
You can delete or block cookies in your browser, although essential functions, including staff sign-in, may stop working. We will review this notice and any required consent arrangements before adding non-essential tracking.
5. eBay seller authorisation and account information
Our staff-only integration lets an authorised CCEUK seller connect their eBay account using eBay OAuth. Sign-in and permission approval happen with eBay; CCEUK does not ask for or store the seller's eBay password.
Once authorised, the current integration reads the seller identity and listings to compare eBay information with CCEUK inventory. This can include seller username and an account identifier, listing/item numbers, titles, descriptions, item specifics, condition, image URLs, prices, quantities, variations, SKUs, listing status and dates. Access and refresh tokens are stored to maintain the authorised connection. We also retain original CSV staging evidence supplied by staff.
The implemented seller calls are read-only. The current integration does not retrieve buyer/order information or change eBay listings, prices or stock. Listing information is private to authorised staff unless separately reviewed and deliberately published as equipment content. Tokens and retained listing snapshots are encrypted in the application; account matching uses a protected identifier. Tokens are not included in public pages.
The seller can revoke access in My eBay → Account → Sign in and security → Third-party app access. See eBay's guidance on connected apps. Revocation prevents further authorised access; it does not itself erase information already held. Contact CCEUK to request review or deletion of retained information, subject to applicable legal requirements.
We also receive signed eBay marketplace account-deletion notices containing account identifiers. These are authenticated and retained privately for authorised privacy review, to identify and address any applicable data held by CCEUK. Receipt is not a claim that erasure has already happened, and does not automatically delete equipment or financial records.
6. Service providers, AI assistance and international processing
Information is accessible to authorised CCEUK staff and website support providers where needed. Server hosting and security providers support the site; Cloudflare handles website traffic; Google handles email sent to our Gmail privacy address; and eBay handles its own marketplace services. Where needed for an agreed transaction or legal obligation, information may also be shared with payment/banking providers, professional advisers, delivery providers or public authorities. We share only what is relevant to the purpose.
Our staff listing assistant uses the OpenAI API. Staff-selected product text and photographs can be sent to OpenAI to prepare descriptions and technical suggestions. These may include personal information if it is present in the source material. Staff should avoid submitting irrelevant personal information. Requests are configured not to store a retrievable response at the API; this does not mean the provider has no security or abuse-monitoring retention. Suggestions are reviewed by staff and do not automatically change records or publish content. We do not use this feature to make solely automated decisions with legal or similarly significant effects on people.
Some providers operate internationally, including in the United States and the European Economic Area, so processing may occur outside the UK. The applicable protection depends on the provider, service and location; UK law can require an adequacy decision or appropriate contractual safeguards for restricted transfers. Contact us for details of the arrangements relevant to your information. We do not claim that all processing stays in the UK.
Further provider information: Cloudflare privacy, Google privacy, OpenAI business data privacy and eBay privacy. External websites apply their own privacy notices when you visit them.
7. How long we keep information
We have not yet adopted a separate fixed retention schedule for enquiries and website source material. Retention is determined by the purpose, whether a matter is ongoing, applicable tax/accounting requirements, disputes and the need for security or accountability:
- Enquiries and correspondence: for as long as needed to deal with the enquiry and any resulting transaction or dispute; unrelated or no-longer-needed personal information should not be kept indefinitely.
- Accounting and transaction evidence: applicable company tax rules generally require records for six years from the end of the relevant company financial year, with longer retention in some circumstances.
- Website logs and security records: according to operational and investigation needs and configured log rotation; an active incident may require longer preservation.
- eBay authorisations, source evidence and AI review history: while needed for the connection, inventory provenance, staff review, resolving queries or meeting applicable legal requirements. Unnecessary personal information is subject to deletion or anonymisation review, including following an applicable eBay deletion notice.
Recovery copies may retain information after it is removed from the active system until those copies are securely replaced or removed. They are restricted to recovery purposes. We do not represent a fixed automated deletion or off-site backup schedule as already operational.
8. Keeping information secure
Measures include HTTPS, staff authentication and access restrictions, private enquiry and unpublished media access, encryption of sensitive application records and tokens, controlled uploads and recovery copies. Public product photographs are intentionally public only when their equipment is approved for publication. No online system is completely risk-free. Please do not email payment-card details or unnecessary sensitive information.
9. Your rights and complaints
Depending on the circumstances, UK data protection law gives you rights to access your personal information, correct inaccuracies, request erasure, restrict processing, object to processing based on legitimate interests, and receive or transfer certain information in a portable format. You can withdraw consent where that is our lawful basis. These rights are not absolute; for example, required accounting records may need to be retained.
Contact us using the details above. We may need proportionate information to confirm your identity. Requests are normally free and answered within one month; the law allows extensions for complex or multiple requests, which we will explain where applicable.
You can raise a concern with us or complain to the Information Commissioner's Office (ICO), the UK data protection regulator, on 0303 123 1113. You do not have to complain to us first.
10. Changes to this policy
We will update this page when our services or data handling change. The date above identifies this version.