Privacy
& cookies.

Data Controller: Three60 Limited, trading as Ultimate Finish

Registered Office: 80 Churchill Square, Kings Hill, Kent, ME19 4YU, United Kingdom

Company Number: 03747689 (Registered in England & Wales)

VAT Number: GB 724 7953 08

ICO Registration: We are registered with the Information Commissioner’s Office (ICO) as required under UK GDPR.

As a leading UK retailer of professional car care and detailing products, we understand the importance of protecting your personal information. This policy applies to all personal data we collect through our website, email, phone and other channels.

We may collect personal information about you when you:

• Purchase products or services from us (online, by phone or by email)
• Create an account on our website
• Subscribe to our newsletter or marketing communications
• Contact us with enquiries or customer service requests
• Enter competitions or participate in promotions
• Leave reviews or provide feedback
• Apply for trade account access

Types of information we collect

• Identity Data: name, username, title
• Contact Data: billing address, delivery address, email address, telephone number
• Financial Data: payment card details (securely processed through PCI DSS compliant payment providers)
• Transaction Data: details about purchases, payments and order history
• Technical Data: IP address, browser type, device information, operating system
• Usage Data: information about how you use our website, products and services
• Marketing & Communications Data: your preferences for receiving marketing and communications

We do not collect or store full payment card details on our servers. All payment transactions are processed securely through PCI DSS Level 1 compliant payment service providers.

We use your personal information for the following purposes, all in accordance with UK GDPR:

1. Order processing & fulfilment (contractual necessity)

• Process and fulfil your orders
• Arrange delivery and communicate shipping updates
• Handle payments and prevent fraudulent transactions
• Provide customer service and support
• Process returns, refunds and warranty claims

2. Account management (contractual necessity & legitimate interest)

• Create and manage your customer account
• Maintain your order history and saved preferences
• Administer our UF Membership rewards scheme
• Manage trade accounts and credit facilities

3. Marketing & communications (consent & legitimate interest)

• Send you marketing emails about products, offers and promotions (only with your consent)
• Provide personalised product recommendations
• Send you our newsletter and blog updates (only if you’ve subscribed)
• Invite you to participate in surveys or reviews

4. Website improvement & analytics (legitimate interest)

• Understand how customers use our website
• Improve our website functionality and user experience
• Monitor website performance and troubleshoot issues
• Analyse customer behaviour to enhance our services

5. Legal & security (legal obligation & legitimate interest)

• Comply with legal and regulatory requirements
• Prevent and detect fraud or misuse of our services
• Protect our business, staff and customers
• Resolve disputes and enforce our terms and conditions

Legal basis: we will only use your personal data when the law allows us to — most commonly where we need to perform a contract with you, where it is necessary for our legitimate interests, or where we have your consent.

We take payment security extremely seriously and are fully PCI DSS compliant.

How we protect your payment information

• No card storage: we do not store complete payment card details on our servers
• Secure processing: all payment transactions are processed through PCI DSS Level 1 certified payment service providers
• SSL encryption: all payment pages use 256-bit SSL encryption
• Tokenisation: card data is tokenised to prevent unauthorised access
• Fraud prevention: we use industry-leading fraud detection and prevention systems

Supported payment methods

We accept major credit and debit cards (Visa, Mastercard, American Express) as well as PayPal. All payment methods are processed through secure, PCI-compliant gateways.

3D Secure authentication

Where required, we use 3D Secure authentication (Verified by Visa, Mastercard SecureCode) to add an extra layer of security to your transactions.

Your card details are never seen or stored by Ultimate Finish staff. They are transmitted directly to our secure payment processor using encrypted connections.

We may share your personal information with trusted third parties who help us operate our business. We require all third parties to respect the security of your personal data and treat it in accordance with UK GDPR.

Service providers we work with

• Payment processors: to securely process your payments (PCI DSS compliant)
• Courier services: DPD, DHL, Royal Mail, Evri, UPS — to deliver your orders
• Third-party logistics (3PL): International Logistics Group (ILG) — for warehouse and fulfilment services
• Email marketing platforms: to send you newsletters and marketing emails (only if you’ve consented)
• Analytics providers: Google Analytics — to understand website usage and improve our service
• Customer service tools: to provide support and respond to your enquiries
• Fraud prevention services: to protect against fraudulent transactions

When we may disclose your information

• To comply with legal obligations or court orders
• To enforce our terms and conditions or protect our rights
• To prevent fraud or protect the security of our systems
• As part of a business sale, merger or acquisition (with your consent where required)

We will never sell your personal data to third parties for their marketing purposes.

Under UK GDPR, you have the following rights regarding your personal data:

1. Right of access

You have the right to request a copy of the personal data we hold about you (a “Subject Access Request”).

2. Right to rectification

You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.

3. Right to erasure (“right to be forgotten”)

You have the right to request that we delete your personal data in certain circumstances, such as when it’s no longer necessary for the purposes we collected it.

4. Right to restriction of processing

You have the right to request that we restrict the processing of your personal data in certain circumstances.

5. Right to data portability

You have the right to request that we transfer your personal data to another organisation, or directly to you, in a commonly used machine-readable format.

6. Right to object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes.

7. Rights related to automated decision making

You have the right not to be subject to decisions based solely on automated processing that produce legal effects or significantly affect you.

How to exercise your rights

To exercise any of these rights, please contact us using the details at the bottom of this page. We will respond within one month as required by UK GDPR.

Right to complain: you have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe we have not handled your personal data properly. Visit ico.org.uk for more information.

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements.

Retention periods

• Customer accounts: until you request deletion or after 3 years of inactivity
• Order information: 7 years (for accounting and tax purposes as required by law)
• Marketing consent: until you unsubscribe or withdraw consent
• Website analytics: 26 months (Google Analytics default)
• Email communications: as long as necessary for customer service purposes
• CCTV footage (if applicable): 30 days unless required for investigation

When we no longer need your personal data, we will securely delete or anonymise it so that it can no longer identify you.

We implement appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Security measures include

• SSL/TLS encryption: all data transmitted to and from our website is encrypted using industry-standard SSL/TLS protocols
• Secure servers: our servers are protected by firewalls and security monitoring
• Access controls: strict access controls ensure only authorised personnel can access personal data
• Regular security audits: we conduct regular security reviews and penetration testing
• Staff training: all staff are trained in data protection and security best practices
• Secure payment processing: PCI DSS Level 1 compliant payment systems
• Data backups: regular encrypted backups to prevent data loss
• Incident response: procedures in place to respond to any data breaches

While we take all reasonable steps to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security but are committed to protecting your data to the highest standards.

Some of our service providers (such as email marketing platforms and analytics services) may be based outside the UK/EEA, which means your personal data may be transferred to and processed in countries outside the UK.

Where we transfer your personal data outside the UK/EEA, we ensure it is protected by implementing one or more of the following safeguards:

• Transferring data to countries with an adequacy decision from the UK government
• Using Standard Contractual Clauses (SCCs) approved by the UK government
• Ensuring the service provider is certified under a recognised data protection framework

You can request more information about the specific safeguards we use by contacting us.

We will only send you marketing communications if you have given us your consent, or where we have a legitimate interest and you have not opted out.

What we send

• Newsletters with detailing tips, product reviews and expert techniques
• New product launches and announcements
• Special offers, promotions and exclusive member deals
• UF Membership rewards and benefits updates

Unsubscribing

You can unsubscribe from marketing communications at any time by:

• Clicking the “unsubscribe” link in any marketing email
• Updating your preferences in your account settings
• Contacting us directly at info@theultimatefinish.co.uk

Note: even if you opt out of marketing, we will still send transactional emails related to your orders (order confirmations, shipping updates, etc.) as these are necessary to fulfil our contract with you.

A cookie is a small text file stored on your computer or mobile device by a website’s server. Each cookie is unique to your web browser and contains anonymous information such as a unique identifier, the site name, and some digits and numbers.

What do cookies do?

Cookies allow websites to remember your preferences and actions over time, so you don’t have to re-enter information when you return or browse from one page to another. They make your browsing faster, easier and more personalised.

Types of cookies

• Session cookies: temporary cookies that expire when you close your browser
• Persistent cookies: remain on your device for a set period or until you delete them
• First-party cookies: set by the website you are visiting
• Third-party cookies: set by other websites (e.g. analytics or advertising services)

Our website uses the following types of cookies:

1. Essential cookies (strictly necessary)

Necessary for the website to function properly — enabling core functionality such as security, network management and accessibility. You cannot opt out of these.

2. Analytics cookies (performance)

Help us understand how visitors use our website by collecting anonymous information about page views, navigation paths and errors.

3. Functional cookies (preferences)

Allow the website to remember choices you make (such as currency preference) and provide enhanced, personalised features.

4. Marketing cookies (targeting)

Track your browsing activity to show relevant advertisements and measure the effectiveness of our marketing campaigns. We only use these with your consent.

We use tracking technologies in our email and SMS communications to help us improve our services and provide you with relevant content.

Tracking pixels (email open tracking)

Our emails contain a tracking pixel — a tiny invisible image with a unique identifier. This tells us when an email has been opened, which device was used, and the approximate location (based on IP address). This helps us:

• Understand which emails are most engaging
• Improve our email content and timing
• Remove inactive email addresses from our lists

Link tracking

All links within our emails and SMS messages contain a unique tracking reference. This helps us understand which content is most interesting to you and provide more relevant recommendations.

You can prevent email tracking by disabling images in your email client or unsubscribing from our mailing list.

Our website may embed content from third-party websites (such as YouTube videos, social media feeds or product reviews). These sites may set their own cookies when you interact with their content.

Third-party services we use

• YouTube: for product demonstration videos
• Trustpilot: for customer reviews and ratings
• Facebook & Instagram: for social media integration
• Google Maps: for location and contact information

We have no control over these third-party cookies. Each service has its own cookie policy, which we encourage you to review:

• Google: policies.google.com/privacy
• Facebook: facebook.com/privacy/policy
• Trustpilot: legal.trustpilot.com

You have the right to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline them if you prefer.

Managing cookies in your browser

• Google Chrome: Settings > Privacy and security > Cookies and other site data
• Mozilla Firefox: Options > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Microsoft Edge: Settings > Privacy, search and services > Cookies and site permissions

What happens if you disable cookies?

• You may not be able to stay logged into your account
• Your shopping basket may not save items
• You may need to re-enter information on each page
• Some site features may not work as intended

Note: disabling cookies will not prevent you browsing our website, but it may affect your experience. For more information visit allaboutcookies.org.