Privacy policy

Last updated 23 October 2026.

This policy explains what personal data we collect through this website, why we collect it, how long we keep it and what rights you have over it. It applies to spinnerdeburring.co.uk, including the online shop.

Who we are

This website is operated by ATM Machine Tools Ltd, a company registered in England and Wales (company number 02716112), whose registered office is Unit 4 Molly Millar’s Bridge, Wokingham, Berkshire, RG41 2WY, United Kingdom. Trading as Spinner Deburring, we are the data controller for the personal data described here.

For any question about this policy or your personal data, email [email protected], call 0118 977 0099, or write to us at the address above.

What we collect and why

Enquiries

If you use a contact form on this site, we collect the name, email address and message you submit. The form sends your message to us by email; its contents are not stored in the website’s database. If you contact us directly by email or telephone instead, we hold whatever you choose to tell us in that correspondence.

We use this to answer you, to discuss your application and, where relevant, to prepare a quotation or arrange a sample trial. Our lawful basis is our legitimate interest in responding to business enquiries, and the performance of a contract where one follows.

Orders and accounts in the shop

If you place an order, we collect your name, billing and delivery address, email address, telephone number, the items ordered and the amounts paid. If you create an account, we also hold your username, the email address you registered, a securely hashed password, and your saved addresses, order history and any wishlist you build.

We use this to take and fulfil your order, to arrange delivery, to handle returns, warranty questions and support, to keep the accounting records the law requires us to keep, and to give you access to your own order history. Our lawful bases are the performance of our contract with you, compliance with our legal obligations for tax and accounting records, and our legitimate interest in administering and securing your account.

Card payments are handled by our payment provider. We do not receive or store your full card details.

Website analytics

We use our own analytics, held on this website’s own server rather than by a third-party advertising network. For each page view it records the page address, the referring address, a device type, the browser name, your screen dimensions, a randomly generated session identifier held in your browser, and periodic signals indicating that a page is still open and that the visit appears to come from a person rather than an automated crawler.

The session identifier is a random value. It is not derived from your name, email address or device identity, and we do not use it to build an advertising profile or to follow you across other websites. We use these records to understand which pages are useful and how the site is performing. Our lawful basis is our legitimate interest in measuring and improving our own website.

Security and spam prevention

Our forms, account pages and checkout are protected by Cloudflare Turnstile, which checks that a submission comes from a real browser rather than an automated script. To do that, Cloudflare receives your IP address and technical information about your browser. Cloudflare acts as our processor for this check and does not use the data to profile you for advertising. See Cloudflare’s privacy policy.

Our forms also include a hidden field that automated scripts tend to fill in, and a short rate limit based on a one-way hash of the connecting network address. Our hosting provider’s server logs record the IP address, the request and the browser identification string for requests to the site, as is standard for web hosting.

Our lawful basis for all of this is our legitimate interest in keeping the website, its forms and our customers’ accounts secure.

Comments

Where comments are enabled on an article and you leave one, WordPress stores the comment, the name and email address you give, and the IP address and browser identification string of the submission, so that we can moderate it and reply.

Cookies and browser storage

Some items are stored by your browser when you use this site. We do not use advertising or cross-site tracking cookies, and we do not embed third-party social media or advertising scripts.

• Basket and checkout (woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*) — essential. Remembers the contents of your basket and links your browser to your basket and checkout session.
• Logging in (wordpress_logged_in_*, wp-settings-*) — essential. Set only if you log in, to keep you logged in and to remember your screen preferences.
• Order attribution (sbjs_*) — records how you arrived at the site: the referring site, any campaign parameters, the landing page and the browser identification string, so that an order can be attributed to a source.
• Analytics (browser local storage: session-id, expiry-ts, session-start-ts, human-verified) — groups page views into a single visit and records that the visit appears to come from a person. Expires after a period of inactivity.
• Security (Cloudflare Turnstile) — Cloudflare may store items in your browser in order to perform the check described above.

The items marked essential are needed for the basket, checkout and login to work; the site cannot function as a shop without them. You can block or delete any of these through your browser’s settings, and private browsing mode will discard them when you close the window. Blocking the essential items will stop the basket and checkout working.

Who else sees your data

We do not sell your personal data and we do not share it for anyone else’s marketing. We share it only where it is needed to run the site and our business:

• our web hosting and email providers, who process data on our instructions in order to serve the site and deliver our mail;
• Cloudflare, for the security check described above;
• our payment provider, where you pay for an order;
• carriers and couriers, where goods are delivered to you;
• a manufacturer or supplier, where your enquiry or warranty claim has to be referred to them to be answered;
• our accountants, auditors and professional advisers, and any authority to which we are legally required to disclose.

Transfers outside the UK

Cloudflare operates a global network, so the security check described above may be carried out by servers outside the United Kingdom. Where personal data is transferred outside the UK, it is protected by the safeguards UK data protection law requires, such as the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses.

How long we keep it

• Enquiry correspondence: while we are dealing with your enquiry and for as long as there is an active prospect of business, after which we delete it or keep only what is needed as a record of what was quoted or advised.
• Orders, invoices and accounting records: at least six years from the end of the financial year they relate to, as UK tax and company law requires, and longer where a warranty claim or legal dispute remains possible.
• Account details: for as long as you keep the account. If you ask us to close it, we remove the account and retain only the order records we are required to keep.
• Analytics records: kept only for as long as they are useful for reporting on the site, and reviewed and cleared periodically.
• Server logs: kept for a short period by our hosting provider for security and diagnostics.

Marketing

We will reply to your enquiry, send you the information you asked for, and send the messages needed to process an order you have placed. We do not add you to a marketing list without your consent, and any marketing email we send includes a way to stop receiving them. You can tell us to stop at any time by replying or emailing [email protected].

Your rights

Under UK data protection law you have the right to:

• ask what personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• ask us to delete data we no longer have a reason to keep;
• ask us to restrict how we use it, or object to our use of it where we rely on legitimate interests;
• receive data you gave us in a portable electronic format;
• withdraw consent, where we relied on your consent.

To exercise any of these, email [email protected]. We will respond within one month. There is no charge, and we may ask you to confirm your identity before we release personal data.

If you are not satisfied with how we have handled your personal data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would welcome the chance to put it right first.

Children

This is an industrial website intended for business users. We do not knowingly collect personal data from children.

Links to other websites

Where we link to a manufacturer, supplier or technical document on another website, that site has its own privacy policy and we are not responsible for its content or its practices.

Changes to this policy

If we change what we collect or how we use it, we will update this page and the date at the top. The version published here is the one that applies.