Privacy Policy

Last updated: 16 July 2026

1. Who we are

SurplusLink & Co Ltd ("SurplusLink", "we", "us") is registered in England and Wales. This policy explains how we collect, use, and protect personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What data we collect

Contact details you submit through our contact form, training bookings, or newsletter signup (name, email, phone number).
Business information shared during consultations or onboarding.
Website usage data collected via Google Analytics 4 and Microsoft Clarity (cookies apply, see our Cookie Policy).
Payment and invoicing details processed via Stripe for clients.

3. How we use your data

To respond to enquiries and deliver the services you request.
To send marketing communications, only where you have given double opt-in consent via Brevo.
To improve our website and services through aggregated, anonymised analytics.
To meet our legal and accounting obligations.

4. Legal basis for processing

We rely on consent (marketing communications), contract (service delivery and invoicing), and legitimate interest (website analytics and security) as our legal bases for processing personal data.

5. Data sharing

We share data with the processors needed to deliver our service: Brevo (email), Stripe (payments), and Google (analytics). We do not sell personal data to third parties.

6. Data retention

We retain contact and client data for as long as necessary to deliver services and meet legal obligations, and delete it securely afterwards unless you request earlier deletion.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, or port your data, and to withdraw consent at any time. Contact our Data Protection Officer to exercise these rights.

8. Contact us

Data Protection Officer: info@surpluslink.co.uk
ICO Registration:

This policy is a working template and should be reviewed by a qualified solicitor before relying on it for a live, public-facing website.