Your bag is empty.
Privacy Policy
At CM40UK, we respect your privacy and take the protection of your personal information seriously.
This Privacy Policy explains what personal information we may collect, why we use it, who we may share it with and the rights you have regarding your information.
Who We Are
CM40UK is an independent UK online retailer selling new, pre-loved, upcycled, surplus, discontinued and personalised products.
CM40UK is responsible for the personal information we collect and use in connection with our business.
If you have any questions about this Privacy Policy or how we use your personal information, please contact us using the contact information provided on our website.
Information We May Collect
Depending on how you interact with CM40UK, we may collect information including:
Your name
Billing and delivery address
Email address
Telephone number
Order and purchase information
Information you provide when contacting us
Personalisation details supplied for customised products
Reviews or feedback you choose to provide
Information relating to returns, refunds or customer service enquiries
Technical information relating to your use of our website, such as device, browser and cookie information
We only collect information that is reasonably necessary for the relevant purpose.
Payment Information
Payments are processed through the payment services available on our website.
CM40UK does not normally receive or store your complete debit or credit card details. Payment information is handled by the relevant payment provider in accordance with its own security and privacy arrangements.
We may receive limited information confirming your payment and transaction.
Why We Use Your Personal Information
We may use your information to:
Process and fulfil your orders
Take and confirm payments
Deliver products to you
Create personalised or custom-made products
Communicate with you about an order
Answer questions and customer service enquiries
Process cancellations, returns and refunds
Deal with complaints
Prevent fraud and protect our business
Maintain appropriate business and financial records
Improve our website, products and services
Send marketing communications where permitted
Meet our legal and regulatory obligations
We will not use your personal information for purposes that are incompatible with the reason it was collected unless permitted or required by law.
Our Lawful Bases for Using Your Information
UK data protection law requires us to have a lawful basis for processing personal information.
Depending on the circumstances, CM40UK may rely on:
Contract
We need certain information to fulfil our contract with you.
For example, we need your name and delivery address to send your order and may need personalisation information to create a customised product.
Legal Obligation
We may need to retain or use certain information to comply with legal obligations, including tax, accounting and consumer protection requirements.
Legitimate Interests
We may process information where it is reasonably necessary for the legitimate operation and protection of CM40UK, provided those interests do not override your rights and freedoms.
This may include fraud prevention, website security, responding to enquiries and improving our services.
Consent
Where consent is required, such as for certain types of marketing or non-essential cookies, we will ask for your permission.
Where we rely on consent, you can withdraw it at any time.
Personalised Products
If you order a personalised product, we may need to process information such as a name, date, photograph, message, logo or other design information supplied by you.
We will use this information to create and fulfil your order.
Please make sure you have permission to provide personal information relating to another person where necessary.
Who We Share Information With
We do not sell your personal information.
We may share relevant information with trusted organisations that help us operate CM40UK and fulfil your order.
These may include:
Website and ecommerce service providers
Payment processors
Royal Mail
Evri
DPD
Yodel
Other delivery or courier providers where necessary
Email and communications providers
IT, hosting and website service providers
Accounting or professional service providers
Government, regulatory or law enforcement bodies where legally required
We only provide information that is reasonably necessary for the service being performed.
For example, a delivery provider may need your name, delivery address and relevant contact information in order to deliver your parcel.
International Transfers
Some of the service providers used to operate our website, communications or other business systems may process information outside the UK.
Where personal information is transferred internationally, we take reasonable steps to ensure appropriate safeguards are in place as required by UK data protection law.
How Long We Keep Your Information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet our legal, accounting and regulatory obligations.
Different types of information may be retained for different periods.
For example, information relating to orders and financial transactions may need to be retained for several years for tax and accounting purposes.
Information that is no longer required will be securely deleted, anonymised or otherwise disposed of where appropriate.
Marketing
If you choose to receive marketing communications from CM40UK, we may use your contact information to send you information about products, offers or other CM40UK news.
You can unsubscribe from marketing communications at any time using the unsubscribe option provided or by contacting us.
Stopping marketing communications will not prevent us from sending essential communications relating to an order you have placed.
Cookies
Our website may use cookies and similar technologies.
Some cookies are necessary for the website and online shop to function correctly. Others may help us understand how visitors use our website, remember preferences or support marketing and analytics.
Where required, we will ask for your consent before placing non-essential cookies.
You can also control cookies through your browser settings.
[LINK: Cookie Policy → Cookie information/policy if available]
Social Media
CM40UK uses social media platforms to communicate with customers and promote our products and business.
If you contact or interact with CM40UK through a social media platform, that platform may also process your information according to its own privacy policy.
Please remember that information you choose to post publicly on social media may be visible to other users.
Reviews
If you choose to leave a product or business review, the information you provide may be displayed publicly depending on the review service being used.
Please avoid including personal information in a public review that you do not want others to see.
Keeping Your Information Secure
We take reasonable organisational and technical measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
However, no online service or method of electronic storage can be guaranteed to be completely secure.
Your Data Protection Rights
Depending on the circumstances, UK data protection law gives you rights over your personal information.
These may include the right to:
Ask for access to the personal information we hold about you
Ask us to correct inaccurate or incomplete information
Ask us to delete your information in certain circumstances
Ask us to restrict how we use your information
Object to certain uses of your information
Request transfer of certain information where applicable
Withdraw consent where we rely on consent
Not every right applies in every situation.
If you wish to exercise one of your rights, please contact CM40UK.
We may need to confirm your identity before responding to a request.
Data Protection Complaints
If you have concerns about how CM40UK has collected, used or handled your personal information, please contact us so that we can investigate your concerns.
We will provide a clear way for you to raise a data protection complaint.
We will acknowledge a data protection complaint within 30 days and will investigate and respond without undue delay in accordance with applicable UK data protection law.
If you remain dissatisfied, you also have the right to raise your concerns with the Information Commissioner’s Office (ICO), the UK’s data protection regulator.
Changes to This Privacy Policy
We may update this Privacy Policy occasionally to reflect changes to CM40UK, our website, the services we use or applicable law.
The latest version will be published on our website.
We recommend checking this page periodically if you would like to see whether it has changed.
Contact CM40UK
If you have any questions about this Privacy Policy, would like to exercise your data protection rights or wish to make a data protection complaint, please contact CM40UK using the contact information provided on our website.
Last updated: July 2026