Privacy policy
About this policy
This policy explains how we collect and use personal data when you apply for a trade account, place an order, contact us or visit our website, and what rights you have over it. We sell to businesses only, so most of the personal data we hold relates to people acting in a business capacity, such as the named contact at a trade customer. Data protection law still applies to it.
Who we are
Stock Manor is the trading name of Bentu Ltd, a company registered in England and Wales under company number 11314697, with its registered office at Unit C1/C2 Manor Farm, Meppershall Road, Upper Stondon, Henlow, England, SG16 6LJ. Our VAT number is 302443450. Bentu Ltd is the controller of the personal data described in this policy.
For anything relating to personal data, including a request to exercise your rights, write to privacy@stockmanor.co.uk. For general enquiries, write to info@stockmanor.co.uk or to the registered office address above.
The personal data we collect
Depending on how you deal with us, we may collect:
- Trade account application data. Your name, the business you represent, its trading and registered address, email address, telephone number, company registration and VAT numbers, and the nature of your business.
- Account and order data. Your login credentials, order history, products and quantities ordered, prices, invoices and delivery addresses.
- Delivery data. The name, address and contact details of the person receiving the goods.
- Payment data. Confirmation that a payment succeeded or failed, the method used, and a partial reference such as the last digits of a card. We do not receive or store complete card numbers.
- Correspondence. Emails, contact form messages and notes of telephone calls.
- Technical data. Your IP address, device and browser information, and the pages you view, collected through cookies and similar technologies.
- Marketing preferences. Whether you have asked to receive, or to stop receiving, updates from us.
We collect this directly from you in almost all cases. Technical data is generated automatically when you use the site, and we may check company or VAT details against public sources such as Companies House when we review an application.
Why we use personal data, and our lawful bases
| What we use it for | Lawful basis |
|---|---|
| Reviewing a trade account application, including checking that the applicant is a genuine business | Our legitimate interests in selling only to trade customers and preventing fraud |
| Setting up and administering your account | Performance of a contract, or steps taken at your request before entering one |
| Processing orders, taking payment, arranging delivery and handling returns | Performance of a contract |
| Answering questions and dealing with complaints | Our legitimate interests in running the business and supporting customers |
| Keeping accounting, VAT and other business records | Compliance with our legal obligations |
| Keeping the website secure and preventing fraud and misuse | Our legitimate interests in protecting the business and our customers |
| Sending trade updates and offers by email | Our legitimate interests in marketing to business customers, or consent where it is required |
| Defending or bringing legal claims | Our legitimate interests in protecting our legal position |
Marketing
If we send you trade updates or offers, every message includes a way to unsubscribe, and you can ask us to stop at any time by writing to privacy@stockmanor.co.uk. That does not affect messages we have to send about an order or an account.
Cookies
Our website uses cookies and similar technologies to keep the site working, to remember your session and basket, and to understand how the site is used. Where cookies are not strictly necessary we ask for your consent first, and you can change your choice later through the cookie settings on the site or through your browser.
Who we share personal data with
- Shopify. Our shop runs on Shopify, which hosts the store and our product and account data, and processes orders and payments on our behalf.
- Payment providers. Payments are handled by the providers behind the methods we accept: Visa, Mastercard, PayPal, Apple Pay and Google Pay. They act as controllers of that data in their own right.
- Delivery carriers. We pass the delivery name, address and contact details to the carrier handling your consignment.
- Professional advisers. Our accountants and, where needed, legal advisers, acting under a duty of confidentiality.
- Authorities. HM Revenue and Customs, regulators, courts or law enforcement, where the law requires it or we need to defend legal claims.
We do not sell personal data.
Transfers outside the United Kingdom
Our store is hosted by Shopify, and some providers we rely on operate internationally, so personal data may be processed outside the United Kingdom. Where it is, we rely on the transfer mechanisms available under UK data protection law, such as the UK government's adequacy regulations for the receiving country, or the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses. You can ask us about the arrangements for a particular transfer.
How long we keep personal data
We keep personal data for as long as we need it for the purpose we collected it for, and then for as long as the law requires or a possible legal claim makes necessary. Records supporting our accounts and VAT returns are kept for the periods required by tax law. Where an application is unsuccessful or an account becomes inactive, we keep only what we need to show how the decision was made and to meet our record keeping obligations.
Security
Our website is served over an encrypted connection, store accounts are protected by individual login credentials, and access to customer and order data is limited to the people who need it for their work. Card details are handled by our payment providers rather than by us. No method of transmitting or storing information is completely secure, so we cannot guarantee absolute security.
Your rights
Under UK data protection law you have the following rights, which apply in the circumstances the law sets out:
- Access. To be told whether we hold personal data about you and to receive a copy.
- Rectification. To have inaccurate data corrected and incomplete data completed.
- Erasure. To ask us to delete data where we no longer have a good reason to keep it.
- Restriction. To ask us to limit how we use it, for example while its accuracy is checked.
- Portability. To receive data you gave us in a structured, commonly used, machine readable format, or to have it sent to another controller, where we process it by automated means on the basis of consent or a contract.
- Objection. To object where we rely on legitimate interests, and to object at any time to direct marketing.
- Automated decision-making. Not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you. We do not make decisions of that kind, and trade account applications are reviewed manually.
- Withdrawing consent. Where we rely on consent, to withdraw it at any time, without affecting what we did beforehand.
To exercise any of these rights, write to privacy@stockmanor.co.uk. We may ask for information to confirm your identity. We do not charge unless a request is manifestly unfounded or excessive, and we respond within the time limits set by law.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at privacy@stockmanor.co.uk so that we can try to put it right.
You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at https://ico.org.uk/make-a-complaint/.
Individuals in the European Economic Area
We are established in the United Kingdom, have no establishment in the European Economic Area, and currently sell and ship within the United Kingdom.
Where the EU General Data Protection Regulation applies to something we do, individuals in the EEA may complain to the supervisory authority in the country where they live, where they work, or where the matter took place. The Information Commissioner's Office is not the supervisory authority for activities governed by the EU GDPR.
If and when we begin offering goods or services to individuals in the EEA, we will appoint a representative in the EEA under Article 27 of the EU GDPR where we are required to do so, and we will publish that representative's name and contact details in this policy.
Changes to this policy
We may update this policy as the business changes or as the law requires. The current version is the one published on our website, and the date below shows when it last changed.
Last updated: 17 September 2026