PRIVACY POLICY
Last updated: 4 August 2026
1. Introduction
RS Machinery Ltd ("RS Machinery", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.
This Privacy Policy explains how we collect, use, store, disclose and protect your personal data when you:
• visit our website at rsmachinery.eu;
• contact us by telephone, email, website enquiry form or other communication channel;
• enquire about machinery, equipment, hire, sales, finance, export or related services;
• purchase, sell, hire or enquire about machinery or equipment;
• visit one of our depots;
• communicate or otherwise do business with us.
This Privacy Policy also explains your rights under UK data protection law and how you can exercise them.
We process personal data in accordance with applicable UK data protection and privacy legislation, including:
• the UK General Data Protection Regulation ("UK GDPR");
• the Data Protection Act 2018 ("DPA 2018");
• the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR"); and
• the Data (Use and Access) Act 2025 ("DUAA"), to the extent its relevant provisions are in force.
These laws require, among other things, that personal data is processed lawfully, fairly and transparently and that individuals receive appropriate information about how their information is used.
2. Who We Are
For the purposes of UK data protection law, the controller responsible for the personal data covered by this Privacy Policy is:
RS MACHINERY LTD
Company number: 07272500
Registered office:
Stratton Business Park
Lancaster Way
Biggleswade
England
SG18 8YL
RS Machinery Ltd was incorporated in England and Wales on 3 June 2010.
Our operational locations include:
Biggleswade Depot
RS MACHINERY LTD
Lancaster Way
Stratton Business Park
Biggleswade
SG18 8YL
United Kingdom
Luton Depot
RS HIRE MACHINERY LTD
Unit 2 Progress Way
Luton
LU4 9TR
United Kingdom
You can contact us regarding privacy and data protection matters at:
Email: info@rsmachinery.eu
Telephone: +44 (0) 172 774 3118
Where RS Hire Machinery Ltd separately determines the purposes and means of processing personal data in connection with its activities, it may act as a separate data controller.
3. What Personal Data We Collect
The personal data we collect depends on how you interact with us.
We may collect and process the following categories of information.
Identity Data
This may include:
• first name;
• last name;
• job title;
• company name;
• customer or supplier details.
Contact Data
This may include:
• business or residential address;
• email address;
• telephone or mobile number;
• other contact information you provide to us.
Enquiry and Communication Data
This may include:
• information submitted through our website;
• machinery or equipment enquiries;
• requests for quotations;
• email correspondence;
• telephone enquiries;
• messages and other communications with our staff;
• records relating to customer support;
• information provided when enquiring about buying, selling, hiring, financing or exporting machinery.
Transaction and Commercial Data
Where you buy, sell or hire machinery or otherwise enter into a commercial relationship with us, this may include:
• details of machinery or equipment;
• quotation information;
• order information;
• invoices;
• payment and transaction records;
• delivery and collection information;
• warranty or service information;
• details of previous transactions;
• information necessary to administer our commercial relationship.
Financial Data
Where necessary for a transaction, we may process financial information such as:
• payment information;
• bank account details;
• billing details;
• payment status;
• credit or finance-related information.
Payment information may also be processed directly by banks, payment providers or finance providers.
Export and Delivery Data
Where machinery is delivered or exported, we may process:
• delivery address;
• collection details;
• shipping information;
• consignee information;
• customs or export documentation;
• information required by freight forwarders, shipping companies or regulatory authorities.
Technical and Usage Data
When you use our website, certain technical information may be collected automatically, including:
• Internet Protocol (IP) address;
• browser type and version;
• device type;
• operating system;
• approximate location derived from IP address;
• pages visited;
• date and time of visits;
• referring website;
• interaction with our website;
• cookie and similar technology identifiers.
The extent of this information depends on the technologies enabled on our website and your cookie choices.
4. How We Collect Personal Data
We collect personal data in a number of ways.
Information you provide directly
For example, when you:
• complete an enquiry form;
• telephone us;
• email us;
• request a quotation;
• enquire about machinery;
• buy or sell machinery;
• arrange hire;
• request finance information;
• arrange delivery or export;
• visit one of our depots;
• communicate with our employees.
Information collected automatically
Certain technical information may be collected when you access our website through cookies, server logs and similar technologies.
For more information, please see the Cookies and Similar Technologies section below and our separate Cookie Policy where applicable.
Information received from third parties
We may receive personal data from:
• business partners;
• machinery marketplaces;
• finance providers;
• logistics and shipping companies;
• suppliers;
• customers;
• publicly available business sources;
• analytics or advertising providers, where legally permitted.
Where UK GDPR requires us to provide privacy information after obtaining personal data from another source, we will do so within the applicable period. ICO guidance states that this will generally be within a reasonable period and no later than one month, subject to applicable exceptions.
5. How and Why We Use Your Personal Data
We will only use personal data where we have a lawful basis for doing so.
Depending on the circumstances, we may rely upon:
Contract – where processing is necessary to enter into or perform a contract with you.
Legitimate interests – where processing is necessary for our legitimate business interests or those of a third party and those interests are not overridden by your rights and freedoms.
Legal obligation – where processing is necessary for us to comply with a legal or regulatory requirement.
Consent – where you have provided valid consent to particular processing.
Where consent is the basis for processing, you may withdraw that consent at any time.
The DUAA 2025 has also amended the UK framework for legitimate interests, including expressly identifying certain activities such as direct marketing and network and information-system security as examples that may constitute legitimate interests. This does not remove the need to assess the applicable lawful basis in the circumstances.
6. Purposes for Which We Use Personal Data
We may process personal data for the following purposes.
Responding to enquiries
We use your contact and enquiry information to respond to questions, provide machinery information, availability, specifications, photographs, videos, prices and quotations.
Our lawful basis will generally be steps taken at your request before entering into a contract and/or our legitimate interests in operating our business and responding to potential customers.
Machinery sales and purchases
We process information necessary to:
• sell machinery;
• purchase machinery from customers or suppliers;
• issue quotations;
• prepare invoices;
• process transactions;
• arrange collection or delivery;
• maintain transaction records.
Our lawful bases will generally be contract, steps before entering into a contract, legitimate interests and applicable legal obligations.
Machinery hire
Where applicable, personal data may be used to administer machinery hire, including enquiries, quotations, contracts, collection, delivery, invoicing and customer support.
Finance enquiries
If you ask us about finance, we may use or disclose information as necessary to respond to your request or introduce you to an appropriate finance provider.
Finance providers will normally process personal data in accordance with their own privacy notices.
Delivery and export
We may process and disclose information to arrange:
• UK delivery;
• international shipping;
• freight forwarding;
• customs clearance;
• export documentation;
• collection and delivery of machinery.
Accounting and legal compliance
We process information where necessary for:
• bookkeeping;
• invoicing;
• taxation;
• financial reporting;
• fraud prevention;
• establishment or defence of legal claims;
• compliance with legal or regulatory obligations.
Website operation and security
We may process technical data to:
• operate our website;
• diagnose technical problems;
• protect our website and systems;
• prevent fraud and misuse;
• maintain network and information security.
Improving our services
Where appropriate, we may analyse aggregated or appropriately de-identified information to understand how customers use our website and services and to improve our business.
7. Direct Marketing
We may contact existing or prospective business customers regarding machinery, new stock, services or offers where permitted by law.
Direct electronic marketing is governed by both data protection legislation and PECR.
The rules differ depending on the recipient.
For example, under PECR, marketing emails may generally be sent to corporate subscribers, such as limited companies and LLPs, without prior consent. However, the sender must not conceal its identity and must provide a valid means of opting out.
Different requirements apply to individuals, sole traders and certain partnerships, where consent or the statutory "soft opt-in" may be required.
Where personal data belonging to an identifiable business contact is used for B2B marketing, UK data protection legislation still applies even where PECR does not require consent.
Where we rely on legitimate interests for marketing, we consider whether our interests are necessary and appropriately balanced against your rights and freedoms.
You can ask us to stop using your personal data for direct marketing at any time.
You may do this by:
• using an unsubscribe link contained in a marketing email, where provided; or
• contacting us at info@rsmachinery.eu.
We will respect valid objections to direct marketing.
8. Cookies and Similar Technologies
Our website may use cookies and other storage or access technologies to operate, remember preferences, understand website usage, improve performance and, where applicable, support advertising.
These technologies may include:
• cookies;
• pixels;
• tags;
• local storage;
• scripts;
• similar storage and access technologies.
The ICO's current guidance expressly covers cookies as well as technologies such as tracking pixels and device fingerprinting under PECR and, where relevant, UK GDPR.
Some technologies are strictly necessary for our website to function and may be used without consent where the applicable statutory requirements are met.
Other technologies may require your consent before being placed or accessed.
Where consent is required, such technologies should not be activated until the required consent has been obtained.
You can manage available choices through our cookie consent mechanism and, where applicable, through your browser.
Important: The precise cookies and third-party technologies used by rsmachinery.eu should be listed in our Cookie Policy or cookie preference centre.
9. Sharing Your Personal Data
We do not sell personal data.
However, where necessary for the purposes described in this Privacy Policy, we may disclose personal data to appropriate third parties including:
• IT and hosting providers;
• website service providers;
• professional advisers;
• accountants;
• insurers;
• banks and payment providers;
• finance providers;
• logistics providers;
• freight forwarders;
• couriers;
• shipping companies;
• customs agents;
• machinery manufacturers or suppliers;
• service and repair providers;
• fraud prevention services;
• regulators;
• government authorities;
• law enforcement authorities;
• other parties where required by law.
We expect service providers processing personal data on our behalf to protect that information and use it only in accordance with our instructions and applicable law.
We may also disclose personal data in connection with a sale, purchase, restructuring or transfer of all or part of our business, subject to appropriate safeguards.
10. International Transfers
Due to the international nature of the machinery industry, some transactions may involve customers, suppliers, logistics providers or other organisations outside the United Kingdom.
Some technology providers we use may also process information outside the UK.
Where the disclosure or processing constitutes a restricted transfer under UK data protection law, we will ensure that an appropriate transfer mechanism is used.
Depending on the destination and circumstances, this may include:
• UK adequacy regulations;
• the UK International Data Transfer Agreement (IDTA);
• the UK Addendum to the EU Standard Contractual Clauses;
• another safeguard recognised under UK law; or
• a relevant statutory exception.
The UK international-transfer framework has been amended by the Data (Use and Access) Act 2025. Current ICO guidance continues to recognise mechanisms including the IDTA and UK Addendum where appropriate.
You may contact us if you would like further information about safeguards relevant to your personal data.
11. How Long We Keep Personal Data
We do not retain personal data for longer than reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting, tax, regulatory and reporting requirements.
The appropriate retention period depends upon factors including:
• the nature of the information;
• the reason it was collected;
• whether we have an ongoing business relationship;
• legal or contractual requirements;
• potential legal claims;
• applicable statutory retention periods.
For example, certain accounting and transaction records will normally need to be retained for the period required under applicable UK tax and company law.
Enquiry data that does not result in a transaction may be retained for a shorter period where there is no longer a legitimate business need for it.
Where information is no longer required, we will delete it, securely destroy it or anonymise it where appropriate.
UK GDPR transparency requirements include telling individuals the relevant retention period or the criteria used to determine it.
12. Data Security
We take appropriate technical and organisational measures designed to protect personal data against:
• unauthorised access;
• unlawful processing;
• accidental loss;
• destruction;
• alteration;
• unauthorised disclosure.
Measures may include, as appropriate:
• access controls;
• authentication measures;
• secure communications;
• encryption;
• security updates;
• backups;
• appropriate restrictions on employee and contractor access;
• security monitoring;
• appropriate contractual protections for service providers.
Access to personal data is limited to persons who have a legitimate business need to access it.
13. Your Rights
Depending on the circumstances and applicable exemptions, UK data protection law gives you a number of rights concerning your personal data.
These include:
Right to be informed
You have the right to receive information about how your personal data is collected and used.
Right of access
You may request a copy of personal data we hold about you.
Right to rectification
You may ask us to correct inaccurate personal data or complete incomplete information.
Right to erasure
In certain circumstances, you may ask us to delete your personal data.
Right to restriction of processing
In certain circumstances, you may ask us to restrict the way we process your personal data.
Right to data portability
In certain circumstances, you may be entitled to receive personal data you provided to us in a structured, commonly used and machine-readable format or have it transmitted to another organisation.
Right to object
You may have the right to object to processing based on legitimate interests.
You have an absolute right to object to the use of your personal data for direct marketing.
Rights relating to automated decision-making
You have protections under UK data protection legislation concerning certain decisions made solely by automated means that produce legal or similarly significant effects.
These rights are not all absolute and their application depends on the circumstances and lawful basis involved.
14. Exercising Your Rights
To exercise your data protection rights, contact:
RS Machinery Ltd
Email: info@rsmachinery.eu
Telephone: +44 (0) 172 774 3118
Postal address:
RS Machinery Ltd
Lancaster Way
Stratton Business Park
Biggleswade
SG18 8YL
United Kingdom
We may need to request sufficient information to verify your identity before acting on a request.
We will respond within the time limits required by applicable data protection legislation.
There is normally no fee for exercising your data protection rights. However, applicable legislation permits organisations to deal differently with certain manifestly unfounded or excessive requests.
15. Data Protection Complaints
If you have concerns about the way we collect, use, store or otherwise process your personal data, we encourage you to contact us first so that we can investigate.
You can submit a data protection complaint by emailing:
or writing to:
RS Machinery Ltd
Lancaster Way
Stratton Business Park
Biggleswade
SG18 8YL
United Kingdom
Under the current requirements introduced by the Data (Use and Access) Act 2025, organisations handling personal data must provide a way for individuals to make data protection complaints.
We will:
• acknowledge receipt of a data protection complaint within 30 days;
• take appropriate steps to investigate the complaint;
• keep you appropriately informed where necessary; and
• communicate the outcome without undue delay.
These requirements have applied to organisations since 19 June 2026.
16. Complaints to the Information Commissioner's Office
You also have the right to raise a concern with the UK's independent data protection regulator:
Information Commissioner's Office (ICO)
Information Commissioner's Office
We would appreciate the opportunity to address your concerns first, but this does not affect your right to contact the ICO.
17. Automated Decision-Making
We do not currently intend to make decisions about website users solely by automated means where those decisions produce legal or similarly significant effects.
If this changes, we will provide the information and safeguards required by applicable UK data protection law.
The Data (Use and Access) Act 2025 amended the UK's rules concerning automated decision-making, while retaining protections for individuals, particularly in relation to special category personal data.
18. Special Category Data
We do not normally seek to collect special category personal data through this website.
Special category data includes certain particularly sensitive information, such as information concerning health, racial or ethnic origin, religious or philosophical beliefs, trade union membership, biometric or genetic data used for identification, sex life or sexual orientation.
Please avoid providing such information through general enquiry forms unless it is genuinely necessary.
Where we are required to process special category personal data, we will only do so where an appropriate lawful basis and additional condition under applicable data protection legislation applies.
19. Children's Privacy
Our website and services are intended for business customers and adults.
We do not knowingly seek to collect personal data from children through this website.
If we become aware that personal data relating to a child has been provided to us in circumstances where it should not have been collected, we will take appropriate steps to address this.
20. Third-Party Websites
Our website may contain links to websites operated by third parties, including manufacturers, finance providers, marketplaces, social networks or other service providers.
We do not control those websites and this Privacy Policy does not apply to their processing of personal data.
We recommend reviewing the privacy information provided by the relevant third party before providing personal information to them.
21. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect:
• changes to our business;
• changes to our website or services;
• changes to the technologies we use;
• regulatory guidance; or
• changes in applicable law.
The latest version will be published on this website and the "Last updated" date at the top of this Privacy Policy will be amended accordingly.
Where required by law, we will bring material changes or new uses of personal data to the attention of affected individuals.
ICO guidance specifically states that privacy information should be regularly reviewed and updated where necessary, and new uses should be brought to people's attention before the new processing begins.
22. Contact Us
For questions about this Privacy Policy, our use of personal data, your data protection rights or to make a data protection complaint, please contact:
RS MACHINERY LTD
Company number: 07272500
Lancaster Way
Stratton Business Park
Biggleswade
SG18 8YL
United Kingdom
Telephone: +44 (0) 172 774 3118
Email: info@rsmachinery.eu