Last updated: 3 August 2026
1. Who we are
AFAC is a business-to-business supplier of high temperature masking systems: rubber mouldings, extrusions, and self-adhesive solutions for precision manufacturing and metal finishing. The data controller is AFAC Ltd, a company registered in England and Wales (company number 03949446). Registered office: Unit 20 Ptarmigan Place, Attleborough Fields Industrial Estate, Nuneaton, CV11 6RX, United Kingdom.
For anything in this policy, contact privacy@afac.co.uk. We respond to rights requests within one month. We process personal data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. What we collect and why
Enquiries. Your name, business contact details, and whatever you tell us about what you need. Legal basis: our legitimate interest in responding to people who contact us.
Orders and accounts. Business contact details, delivery addresses, order history, and invoicing records, processed to perform the contract with you or your company.
Website checkout. Name, delivery and billing address, and order details, entered at checkout. Payment card details are handled directly by our payment processor, Stripe — we do not see or store your full card number.
Email updates. Your email address, only if you opted in. Every email includes a working unsubscribe link.
We deal business to business. We do not run consumer marketing lists, we do not buy contact data, and we do not use AI tools to make decisions about you.
3. Who else touches the data
- Stripe · payment processing for website orders. We never see or store your full card number.
- Mailchimp (Intuit) · email delivery for the list you opted into.
- Xero · accounting and invoicing records.
- Our website hosting and email providers, who process data only as needed to run those services.
Each processor works under a data processing agreement. We do not sell personal data, and we disclose it beyond this list only if the law compels us to.
4. How long we keep it
Enquiry records that go nowhere are deleted within 24 months. Customer and invoicing records are kept for the duration of the trading relationship plus the six years UK tax law requires, then deleted.
5. Your rights
Under UK GDPR you can ask for access to your data, correction, deletion, a portable copy, restriction of processing, and you can object to processing based on legitimate interest. Email privacy@afac.co.uk and we will act within one month.
If you think we have handled your data badly, you can complain to the Information Commissioner’s Office at ico.org.uk.
6. International transfers
Where a processor stores data outside the UK, notably Stripe and Mailchimp in the United States, transfers rely on the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement and addendum, as applicable to that provider.
7. Cookies
This site uses only the cookies needed to make it work and to process checkout. No advertising cookies, no analytics that track you across sites.
8. Changes and contact
When this policy changes, the date at the top changes with it. For any data protection query: AFAC Ltd, Unit 20 Ptarmigan Place, Attleborough Fields Industrial Estate, Nuneaton, CV11 6RX · privacy@afac.co.uk.
