Privacy Policy
Last updated: 29 October 2026
1. Who we are
RackFoundry is a trading name of Lloyd Byatt, a sole trader based in England. In this policy, "RackFoundry", "we", "us" and "our" mean Lloyd Byatt trading as RackFoundry.
We are the data controller for the personal data described in this policy.
- Trading address: 6 Bittern Drive, Biggleswade, Bedfordshire, SG18 8DU, United Kingdom
- Email: [email protected]
If you have any questions about this policy or your data, email [email protected].
2. The personal data we collect
| Type of data | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, phone number, company name | You, when you order, request a quote or contact us |
| Delivery | Delivery address, delivery instructions | You, at checkout |
| Order and transaction | Items bought, order value, order and delivery status, refunds | Our website and Stripe |
| Payment | Payment confirmation and the last four digits and type of card. We never see or store your full card details; Stripe handles them | Stripe |
| Business buyer details | Company name, purchase order number, VAT number (if you have one) | You |
| Communications | Emails and messages you send us, quote requests | You |
| Technical | IP address, browser type, device information, security and bot-check signals | Your browser, Cloudflare |
We do not knowingly collect data from children under 13, and we do not collect special category data.
3. How and why we use your data (lawful bases)
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Taking and processing your order, arranging delivery with our suppliers and couriers, handling returns and refunds | Contract (Article 6(1)(b)) |
| Sending order confirmations, dispatch notices and service emails | Contract |
| Answering quote requests and enquiries | Contract (steps before entering a contract) or legitimate interests |
| Keeping accounting and tax records | Legal obligation (Article 6(1)(c)) |
| Preventing fraud, spam and abuse of our website, keeping it secure | Legitimate interests (Article 6(1)(f)) |
| Handling complaints and legal claims | Legitimate interests |
| Sending marketing emails (only if you opt in) | Consent (Article 6(1)(a)); you can withdraw at any time |
We do not use automated decision-making that has legal or similarly significant effects on you. Stripe may use automated fraud screening on payments; see Stripe's privacy notice.
4. Who we share your data with
We only share what is needed for each purpose.
Service providers (processors) acting on our instructions:
| Provider | What they do | Location / safeguards |
|---|---|---|
| Stripe Payments Europe Ltd / Stripe, Inc. | Payment processing and checkout | Stripe also acts as an independent controller for some purposes, such as fraud prevention and regulatory compliance. International transfers covered by Stripe's UK transfer safeguards |
| Resend (Plus Five Five, Inc.) | Sending order, quote and service emails | USA. Transfers protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where applicable |
| Cloudflare, Inc. | Website hosting (Cloudflare Pages), content delivery, security, bot protection (Turnstile) and email routing for our @rackfoundry.co.uk addresses | Global network. Transfers protected by Cloudflare's Data Processing Addendum, including UK transfer safeguards |
| Google (Gmail) | Our business mailbox, which stores the emails we receive for sales@ and accounts@ (delivered via Cloudflare Email Routing) | USA / EU. Transfers protected by Google's data processing terms, including UK transfer safeguards |
Supply and delivery partners: RackFoundry works mainly on a dropship model, so most orders are dispatched directly to you by our UK trade suppliers (currently Kenable Ltd, Comms Express, The Pi Hut, Server Case UK (exeo.io Ltd) and Penn Elcom). Some items are sent by us from our own stock. We pass them your name, delivery address, phone number and order details so they can send your goods. They and their couriers (such as DPD, pallet networks or manufacturer delivery services) use this data to deliver your order.
Accounting: we keep order records in our own accounting records and spreadsheets for 6 years for HMRC purposes. We do not use a third-party accounting provider for this.
Others: our professional advisers (such as an accountant), HMRC and other authorities where the law requires it, and anyone who buys the business in future (you would be told).
We never sell your personal data.
5. International transfers
Some of our providers process data outside the UK. Where they do, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum. You can ask us for details.
6. How long we keep your data
| Data | How long |
|---|---|
| Orders, invoices and transaction records | 6 years after the end of the tax year they relate to (HMRC requirement) |
| Quote requests that do not lead to an order | 12 months |
| General enquiries and emails | Up to 2 years |
| Marketing preferences | Until you unsubscribe, plus a suppression record so we do not email you again |
| Security and server logs | As set by Cloudflare, typically a short period |
7. Your rights
Under UK GDPR you have the right to:
- access a copy of your data;
- have inaccurate data corrected;
- have your data erased in some circumstances;
- restrict or object to some processing, including any direct marketing;
- data portability for data you gave us under contract or consent;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email [email protected]. We will reply within one month. There is normally no charge.
8. Cookies
See our Cookie Policy.
9. Security
The website is served over HTTPS. Card payments are handled by Stripe, which is certified to PCI DSS Level 1. Access to our systems is protected by strong passwords and two-factor authentication.
10. Complaints
If you are unhappy with how we use your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113.
11. Changes to this policy
We may update this policy. The latest version will always be on this page, with the date at the top.