Home \ Privacy Policy

Privacy Policy

PRIVACY POLICY (ISSUE 2)

Effective Date: [30.04.2026]
Last Updated: [30.04.2026]

CONTENTS

  1. Definitions and Interpretation
  2. Introduction
  3. Data Controller
  4. Categories of Personal Data
  5. How Data is Collected
  6. Lawful Basis for Processing
  7. Systems and Data Storage
  8. Data Sharing
  9. Payment Processing (Stripe)
  10. Subcontractors and Project Delivery
  11. International Data Transfers
  12. Data Retention
  13. Security Measures
  14. Your Rights
  15. Complaints
  16. Changes to this Policy
  17. Cookies and Website Tracking
  18. Automated Decision-Making

1. DEFINITIONS AND INTERPRETATION

“Company” means Atlantis Tanks Group Ltd.
“Customer” means any business or individual engaging with the Company.
“Personal Data” has the meaning given under UK GDPR.
“Processing” means any operation performed on Personal Data.
“Controller” means the entity determining the purposes and means of processing.
“Processor” means a party processing data on behalf of the Controller.

2. INTRODUCTION

This Privacy Policy sets out how Atlantis Tanks Group Ltd collects, processes, stores, and protects personal data in accordance with UK GDPR and the Data Protection Act 2018.

3. DATA CONTROLLER

Atlantis Tanks Group Ltd is the Data Controller.

Email: [email protected]
Telephone: 0330 999 1100
Address: 48 Leyton Avenue, Mildenhall, IP28 7BL

4. CATEGORIES OF PERSONAL DATA

We process:

  • Identity Data
  • Contact Data
  • Financial Data
  • Transaction Data
  • Technical Data
  • Project & Engineering Data
  • Marketing Data
  • Operational Delivery Data

5. HOW DATA IS COLLECTED

  • Website forms
  • Email / phone
  • Contracts and orders
  • CRM (Odoo)
  • Marketing platforms
  • Cookies and analytics
  • Third-party partners

We may also receive personal data indirectly from third parties, including:

  • Referrals from customers or business partners
  • Publicly available sources (e.g. company websites or directories)
  • Subcontractors or suppliers involved in project delivery

6. LAWFUL BASIS FOR PROCESSING

We rely on:

Contract:

  • Order fulfilment
  • Project delivery
  • Quote preparation and contract negotiation
  • After-sales support

Legitimate Interests:

  • CRM management
  • Business development and sales pipeline management
  • Fraud prevention and security
  • Customer relationship management

Legal Obligation:

  • HMRC compliance
  • Financial record keeping
  • Health & safety compliance

Consent:

  • Marketing communications
  • Use of certain cookies

7. SYSTEMS AND DATA STORAGE

We store data within:

  • Odoo.sh ERP/CRM
  • Google Workspace
  • Website hosting infrastructure

8. DATA SHARING

We share personal data only where necessary for the performance of contracts, delivery of services, compliance with legal obligations, or for legitimate business operations.

This may include:

  • Odoo (ERP/CRM)
  • Google (Workspace services)
  • Brevo (marketing)
  • Stripe (payments)
  • Logistics providers
  • Subcontractors and engineers
  • Credit reference agencies

9. PAYMENT PROCESSING (STRIPE)

We use Stripe to process payments securely.

Stripe may collect:

  • Payment details
  • Transaction data
  • Device and usage data

Stripe uses this for:

  • Payment processing
  • Fraud detection
  • Service improvement

Stripe acts as a separate Data Controller.

We do not store full payment card details on our systems.

10. SUBCONTRACTORS AND PROJECT DELIVERY

Personal data may be shared with subcontractors, suppliers, and operational partners where necessary for the purpose of:

  • fulfilling contractual obligations; and
  • carrying out legitimate business and operational activities, including project delivery, installation, logistics, and after-sales support.

All such parties are required to process personal data only to the extent necessary and in accordance with applicable data protection laws.

11. INTERNATIONAL DATA TRANSFERS

Some of our third-party service providers (including cloud-based systems such as Odoo.sh, Google Workspace, Stripe and marketing platforms) may process personal data outside of the United Kingdom.

Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR.

These safeguards may include:

  • The use of UK-approved Standard Contractual Clauses (SCCs)
  • Transfers to countries deemed to provide an adequate level of protection
  • Reliance on reputable providers who maintain appropriate data protection certifications and compliance frameworks

We take reasonable steps to ensure that personal data is treated securely and in accordance with this Privacy Policy.

12. DATA RETENTION

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and reporting requirements.

In practice:

  • Financial and transactional records are typically retained for up to 7 years to comply with legal obligations, although they may be retained for longer where necessary for legitimate business, legal, or audit purposes
  • Enquiry data is retained for up to 24 months for business development purposes
  • Marketing data is retained until consent is withdrawn or the individual opts out
  • Project and operational data is retained for the duration of the business relationship and for a reasonable period thereafter for support, warranty, and record-keeping purposes

While we do not routinely delete all historical data from our systems, we ensure that personal data is not retained or used beyond what is necessary for legitimate business and legal purposes.

13. SECURITY MEASURES

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or disclosure.

These include:

  • Role-based access controls
  • Secure cloud infrastructure
  • Staff training and awareness
  • Data minimisation practices

14. YOUR RIGHTS

You have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request erasure (where applicable)
  • Restrict processing
  • Object to processing
  • Data portability

To exercise any of these rights, please contact us using the details set out above.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

We aim to respond to all legitimate requests within one month.

15. COMPLAINTS

If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner’s Office (ICO):

Website: https://www.ico.org.uk
Phone: 0303 123 1113

16. CHANGES

We may update this Privacy Policy from time to time. Updates will be published on our website.

17. COOKIES AND WEBSITE TRACKING

Our website uses cookies and similar technologies to distinguish you from other users and to improve your experience.

Cookies may be used for:

  • Essential website functionality
  • Performance and analytics (e.g. understanding how visitors use our website)
  • Improving website performance and user experience

We may use third-party analytics tools (such as Google Analytics or similar) which collect anonymised usage data, including IP address, browser type, and pages visited.

You can control or disable cookies through your browser settings.

Where required, we will obtain your consent before placing non-essential cookies.

18. AUTOMATED DECISION-MAKING

We do not carry out automated decision-making or profiling which produces legal or similarly significant effects on individuals.