Last reviewed October 2026.Draft awaiting legal review
1. Who is responsible for your information
Gyros City Wholesalers F&B Ltd (company number 15801851, VAT number GB 478483732), trading as Gyros City Wholesalers, of 100 Tyburn Road, Erdington, Birmingham B24 8LA, registered in England and Wales, is the controller of the personal information described here. We do not need a Data Protection Officer, but you can reach our data contact at support@gyroscitywholesalers.co.uk or write to us at Unit 12 & 13, Baltimore Trading Estate, Perry Barr, Birmingham B42 1DR.
We pay the data protection fee to the Information Commissioner's Office (ICO) as the law requires.
2. What we collect
- Enquiries, messages and trade applications: your name, business name, phone, email, postcode and address, anything you write to us, the products and quantities you ask about, and for applications your business type, company number and VAT number.
- Customer and account records: your orders, quotes, invoices, payments and credit terms, delivery details and the name (and signature) of the person who received a delivery, plus notes our staff make about your account.
- The app: your name, email, phone and business, your sign-in details (your password is stored scrambled, never in readable form), your push-notification token if you allow notifications, favourites, saved addresses, reward points and, for retail orders, order and delivery details. We never store full card numbers; payments are handled by our payment provider.
- Messages and problem reports: chat messages with our sales team and any problem you report about an order, including up to three photos you choose to attach. Please do not include people in photos.
- Technical and security data: your IP address and basic request details, sign-in attempts and, in the app, crash reports. Crash reports do not contain your name or contact details.
- Staff: our staff's name, work email, role and sign-in security information.
We get most information from you. For trade applications we may also look up public company details (for example from Companies House) using the company number you give us.
We do not knowingly collect information about children, and our services are for adults. We do not make decisions about you using only automated processing.
3. Why we use it, and the lawful basis
Reply to enquiries, prepare quotes, agree and deliver orders
- Information used
- Contact and business details, products, delivery address
- Lawful basis
- Contract, or steps you ask us to take before one (Art 6(1)(b))
Open and run a trade account, set credit terms and limits
- Information used
- Business details, company and VAT number, order and payment history
- Lawful basis
- Contract (Art 6(1)(b)); our legitimate interest in managing credit risk (Art 6(1)(f))
Invoice, take payment, chase late payment, keep accounts and tax records
- Information used
- Invoices, payments, contact details
- Lawful basis
- Contract; legal obligation (Art 6(1)(c)); legitimate interest in recovering debts
Deliver goods and keep proof of delivery
- Information used
- Name, address, phone, name and signature of the person receiving
- Lawful basis
- Contract; legitimate interest in proving delivery
App account, sign-in, order tracking and order notifications
- Information used
- Account details, order data, push token
- Lawful basis
- Contract (Art 6(1)(b))
Chat and problem reports, including photos
- Information used
- Messages, photos, order details
- Lawful basis
- Contract; legitimate interest in resolving problems and disputes
Security, preventing fraud and spam, fixing app errors
- Information used
- IP address, sign-in attempts, crash reports
- Lawful basis
- Legitimate interests (Art 6(1)(f)) in keeping our systems safe and working
Marketing emails and offers
- Information used
- Name and email
- Lawful basis
- Your consent (Art 6(1)(a)); you can withdraw it at any time. Where the law allows us to contact business customers about similar products we still offer an unsubscribe.
Push notifications about offers
- Information used
- Push token
- Lawful basis
- Your consent: the permission you give on your phone, which you can change in the app or phone settings
Staff accounts and access control
- Information used
- Name, work email, role, security information
- Lawful basis
- Legitimate interests; contract with our staff
Legal claims and requests from authorities
- Information used
- Any relevant record
- Lawful basis
- Legal obligation; legitimate interests
5. Transfers outside the UK
Some of our providers are based outside the UK, mainly in the United States. Where that happens we rely on UK adequacy arrangements (including the UK–US data bridge for certified companies) or the ICO's International Data Transfer Agreement or Addendum, so your information keeps a UK standard of protection.
6. How long we keep it
Enquiries that do not lead to an order
- How long
- 24 months after we last spoke
Customer records, orders, quotes, invoices, payments and credit notes
- How long
- 6 years after the end of the financial year they relate to (accounting and tax rules)
Chat messages
- How long
- 24 months after the last message
Problem reports and their photos
- How long
- 24 months after they are resolved, longer if needed for a claim
App account details
- How long
- Until you delete your account (in the app or by asking us). We may remove accounts not used for 3 years
Marketing preferences
- How long
- While you are subscribed, plus a record of your consent or unsubscribe for 3 years
App crash reports
- How long
- 90 days
Sign-in attempts and rate-limit counters
- How long
- No more than 30 days
Staff accounts
- How long
- While the person works with us and for 12 months after
Audit log of changes in our systems
- How long
- 6 years
If you delete your app account we remove your login and personal details. We keep invoices and order records that we are legally required to hold, with the personal information limited to what the records need.
7. Your rights
- Access: to be told whether we use your information and to get a copy.
- Rectification: to have wrong or incomplete information corrected.
- Erasure: to have information deleted where we no longer have a reason to keep it.
- Restriction and objection: to ask us to pause or stop using your information in certain ways, including objecting to anything based on our legitimate interests.
- Portability: to receive the information you gave us in a common electronic format.
- To withdraw consent for marketing or notifications at any time, with no effect on anything we did before.
To use any right, use our Your data page or contact support@gyroscitywholesalers.co.uk. We may ask you to prove who you are. We reply within one month, free of charge.
8. Complaints about our use of your information
Please tell us first at support@gyroscitywholesalers.co.uk so we can put it right. We acknowledge data complaints within 5 working days and tell you the outcome within 30 days. See our Complaints procedure.
You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to complain to us first, but the ICO may ask whether you have.
9. Keeping it safe
Connections to our website and app are encrypted. Passwords are stored scrambled with a modern one-way method. Staff sign in individually, can switch on two-factor sign-in, and only see what their role allows. Changes in our systems are logged, the database is backed up, and the app keeps your sign-in in your phone's secure storage.
If a personal data breach puts people at risk we report it to the ICO within 72 hours and tell the people affected where required.
11. Changes
We will update this notice if what we do changes and show the date it was last reviewed. For important changes we will tell app users in the app.