This privacy notice is intended to provide you with information about how we process your personal data in our interactions with you.

UP.Direct is a Data Controller and is part of Ultimate Products UK Limited, which is a company under the group Ultimate Products PLC (we’ or ‘us’ or ‘our’).

If you have any concerns or outstanding questions after reviewing this statement, then we encourage you to contact us by Ultimate Products UK Limited, Compliance Department, Manor Mill, Victoria Street, Manchester, OL9 0DD. UNITED KINGDOM or emailing data-protection@upplc.com

Our Commitment to You

We are committed to protecting your personal data in line with the UK Data Protection Act (2018) and the UK GDPR. In doing so we will ensure that personal data is:

• Used lawfully, fairly and in a transparent way.
• Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
• Relevant to the purposes we have told you about and limited only to those purposes.
• Accurate and kept up to date.
• Kept only as long as necessary for the purposes we have told you about.
• Kept securely.

We process personal data in several ways, and this privacy statement outlines what data we collect, why we collect it and how we treat it whilst we are holding it. Please review the section which details how we might interact with you.

You are included in our marketing promotions

We may process personal information when you interact with our website, on social media or through marketing mailing campaigns. This may include:

• Information such as your IP address may be collected, with your consent when you visit our websites. Your IP address is a unique identifier for your computer or other access device; this helps us to understand where customers originate from and helps us to understand where to focus our future product marketing.

This helps us to understand:

• The country you access our website from
• How you use our website including which products you view

You can find out more about the tracking that we might undertake by viewing our cookie policy on our website.

It may also include:

• Social Media profile information including your content which contains our products and has been shared publicly by you
• Contact information in relation to email based enquiries or in signing up to one of our mailing lists. This may include where you have provided information as part of a potential purchase.
• Where you create an account on our website and provide us with information about yourself
• If you contact us for any enquiry we may keep a record of that correspondence.

We also sometimes run competitions and/ or giveaways on these social media channels; however, we never take your personal data from these companies, except to send you prizes. You should be aware of the privacy notices of these social media channels to see how they manage your data.

Data Sharing:

To support these services, we may share your data with or receive data from selected third parties. Where we do, we ensure that we have legally binding arrangements with them which ensures that your personal data remains protected.

Where you add your personal data to social media or where we share your data with TrustPilot, please be aware that these companies will then become the controller of your data, and they will use your data according to the information they provide within their own Privacy Notices.

We may share your data for the following purposes:

• Dot Digital and Yotpo who provide email marketing support.
• BOUTIQUE who provides support to our marketing team as a digital marketing agency.
• Gnatta who provide Webchat services
• Website analytics purposes to capture how you use and interact with our website, such as Google, Microsoft, and Facebook (and their affiliates) etc.

Lawful Basis:

Unless you have provided your explicit consent, then we may process this data for marketing purposes in our ‘legitimate interest’, which means we will assess any impacts this may have and balance these with the benefits of the processing. We always provide you with the means to opt out of any marketing in every communication that we send to you.

Where we process on the basis of Legitimate Interests, we conduct a Legitimate Interests test for necessity and balance against your rights and freedoms.

You have completed a purchase

Once you have completed a purchase and depending on the circumstances, we may collect, store, and use the following categories of personal information about you:

• Name/ Home information will be retained for the duration of the time that you hold an account with us, or for no longer than 12 months from your last order. This is necessary to enable payment, process refunds and help us monitor fraudulent activity on accounts.
• Product Registration to ensure that any guarantees can be managed effectively (applicable to end-consumers only)
• Images you may send us in managing any queries
• Legal and Insurance data in the event of any claim
• Any personal data you include in any product reviews you leave for us
• Address - without this we won’t know where or whom to send your order to. We also use this information to identify whether we can deliver to you, at what cost and via which partner route.
• Email – to send a confirmation of your orders via email, as well as other service-related communication and may also respond this way if you have a general enquiry. If you have agreed to receive marketing communications, these may also be sent by email.
• Telephone Number(s) - if there are any problems with your order or anything needs to be checked, we need to be able to contact you as quickly as possible.
• Financial Information – a payment card or a Paypal, Google Pay, Stripe or Klarna account is required in order to process your order. Payment card

Depending on your purchasing activity, your information may be transferred from our external third party systems into our internal management platforms. Once this happens, your account may be reviewed to determine whether you meet the criteria for further support from our Sales team. Where appropriate, and following this assessment, a member of the Sales team may contact you. Please note that this evaluation is carried out on a case by case basis and does not guarantee that a dedicated Sales Representative will be assigned.

Data Sharing:

To support these services, we may share your data with or receive data from selected third parties. Where we do, we ensure that have legally binding arrangements with them which ensures that your personal data remains protected.

We may share your data for the following purposes:

• Payment Gateway services e.g PayPal, Stripe or Klarna who process the payment services on our behalf. We do not have access to any of this data and the payment services providers are the controllers of your data in this instance
• Product Fulfilment services for using our warehousing systems to ensure that product logistics are completed
• Courier services to ensure your product is delivered to your address
• Customer Support and Management services
• Product Review Sites (TrustPilot and Google Reviews)
• Image recognition and language translation tools to support EU customer service operations
• Webchat services
• Insurance Services
• Legal Services

Lawful Basis:

We process your personal data in relation to a purchase or post-sale support in order to fulfil a contract with you.

Some of these services which are not required to directly support the purchase (such as image, translation tools, webchat and insurance) are provided in our legitimate interest, to ensure that our customer service levels remain high. Where we process on the basis of Legitimate Interests, we conduct a Legitimate Interests test for necessity and balance against your rights and freedoms.

We may obtain legal services to pursue or defend potential legal claims where necessary to meet our legal obligations.

You have purchased a product which records Health Data

Some of the products we offer are designed to support specific health conditions. Since under UK GDPR health-related data is considered special category data, we ensure that we ensure additional safeguards are in place to protect this data. While we do not actively process this data for profiling or decision-making, we may identify and store it securely within our systems to enhance data protection and prevent misuse.

If you provide health-related information during product returns or customer service interactions, this data is stored separately and subject to enhanced access controls, retention policies, and security measures in line with our obligations under the Data Protection Act 2018.

Some products may integrate with third-party mobile apps. Please refer to the privacy notices of those apps for details on how your data is processed. Where we provide such apps, we may use an app managed by a third-party, where we do so we ensure appropriate safeguards and agreements are in place.

Where we process high risk data such as financial information, we have strict security controls on access, storage and retention.

You visit one of our properties or communicate with our offices

We may process personal data when you visit one of our offices or communicate with one of our teams, for example:

• You visit our premises, and your personal data is captured via our CCTV system
• You visit our premises, and we collect your details in our visitor management (as part of Health and Safety)
• You communicate via email/telephone with any of our staff (for instance customer services), where calls may be recorded
• You approach us with Trade enquiries.

Data Sharing:

To support these services, we may share your data with or receive data from selected third parties. Where we do, we ensure that have legally binding arrangements with them which ensures that your personal data remains protected.

We may share your data for the following purposes:

• Our CCTV systems are in operation across our premises; data is retained for 30 days and is only retained for longer if there is the need to support an investigation.

Lawful Basis:

We process your personal data in relation to trade enquiries in order to fulfil a contract with you.

We process personal data in our ‘legitimate interest’ to support our security through our CCTV, communications and visitor monitoring. Where we process on the basis of Legitimate Interests, we conduct a Legitimate Interests test for necessity and balance against your rights and freedoms.

You apply for employment with us

We will process personal data when you apply for a role with us directly.

For example:

• You will provide contact details to us to help us to manage the recruitment process
• You will provide career details with us (e.g. your CV) to help us in the selection process

If you are not selected for an interview, your personal information will be deleted from our systems within 6 weeks. Should you gain an interview but not be selected for the role we will keep your details on file for 12 months.

Data Sharing:

To support these services, we will only share your personal data within our HR department.

Lawful Basis:

We process your personal data in relation to in order to enter into a contract with you.

Transfer

If you are selected to be employed by us, transfers of your data may be made to third-party partners that we use to support employment-related services, such as payment service providers. In such cases, where these partners are located outside of the EEA or UK, we have conducted due diligence to ensure your rights are protected and that your data is transferred lawfully and kept secure.

Use of Artificial Intelligence (AI) and Automated Decision Making

We work with several third party service providers that use artificial intelligence (AI) and automated tools to support the operation of our B2B website. These systems help us deliver our services, improve site functionality, enhance security, personalise content, and analyse how customers use our website.

Some of these tools may process personal data such as device information, browsing behaviour, or order details. You have the right to opt out of AI based processing at any time by emailing data-protection@upplc.com, and you may also request human review of any decisions made using automated processes.

We use AI technologies in the following areas:

• Search, product discovery, behavioural analytics and user experience optimisation – to improve website navigation, understand search intent, and analyse usage patterns. Lawful basis: Legitimate interests.
• Advertising, marketing and email personalisation – to optimise campaigns, tailor content, and predict engagement. Lawful basis: Consent (where tracking/marketing cookies apply); legitimate interests for non tracking analytics or service communications.
• Customer service and support automation – to categorise, route and respond to enquiries efficiently. Lawful basis: Legitimate interests.
• Delivery, logistics and order fulfilment – for routing, forecasting, and customer support chatbots. Lawful basis: Performance of a contract.
• Security, fraud prevention and threat detection – to detect suspicious activity and protect the website. Lawful basis: Legitimate interests.
• SEO, structured data, privacy and compliance tools – to improve the accuracy of search results and manage consent. Lawful basis: Legitimate interests or legal obligation (where tools support GDPR compliance).

We ensure all providers implement appropriate safeguards, and where AI tools process personal data, only the minimum necessary data is used. This is also applicable to all internal uses of AI and Automation.

Safeguarding Measures

Ultimate Products UK Limited takes your privacy seriously and we take every reasonable measure and precaution to protect and secure your personal data. We work hard to protect you and your information from unauthorised access, alteration, disclosure or destruction and have several layers of security measures in place, including:

• Firewall
• Encryption
• Strict Access Controls (physical and electronic)
• SSL certificates
• Full Privacy Governance structure

Consequences of Not Providing Your Data

You are not obligated to provide your personal information to Ultimate Products UK Limited, however, as this information may be required for us to provide you with our services/deliver your products/legitimate interests, we will not be able to offer some of our products or services without it.

Data retention

How Long We Keep Your Data

Ultimate Products UK Limited only ever retain personal data for as long as is necessary and we have strict review and retention policies in place to meet these obligations. We are required under UK tax law to keep your basic personal data (name, address, contact details) for a minimum of 6 years after which time it will be destroyed.

Where you have consented to us using your details for direct marketing, we regularly review consent given and will keep such data until you notify us otherwise and/or withdraw your consent.

Your Rights

Rights of access, correction, erasure, and restriction

You have the right to access any personal information that Ultimate Products UK Limited processes about you and to request information about:

• What personal data we hold about you
• The purposes of the processing
• The categories of personal data concerned
• The recipients to whom the personal data has/will be disclosed
• How long we intend to store your personal data for
• If we did not collect the data directly from you, information about the source

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• To object to the processing of your personal information if we are relying on a legitimate interest (whether ours or a third party’s) and you feel that your particular circumstances warrant such an objection. Additionally, you may object to the use of your personal information if it is being processed for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please write to us at the address below.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

In circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please write to us at the address below. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

Lodging A Complaint

Ultimate Products UK Limited only processes your personal information in compliance with this privacy notice and in accordance with the relevant UK GDPR laws. If, however, you wish to raise a complaint regarding the processing of your personal data or are unsatisfied with how we have handled your information, you have the right to lodge a complaint with the supervisory authority. We would be grateful if you would give us the opportunity to deal with any complaints in the first instance.

If you wish to exercise any of your rights listed above, please write to:

Ultimate Products UK Limited

Compliance Department

Manor Mill

Victoria Street

Manchester

OL9 0DD

UNITED KINGDOM

Email: data-protection@upplc.com

UK Data Protection Authority

Information Commissioners Office (ICO)

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 0303 123 1113

Email – via their website – www.ico.org.uk

Notification of Changes to this Notice

If we decide to change our Privacy Notice, we will post these changes on this website so that you know exactly what information we collect and how we use it. If at any point we decide to use personally identifiable information in a manner different from that stated at the time it was collected, we will tell you and you will have a choice as to whether or not we use your information in this different manner.

Feedback

We want to make sure that we’re giving you the information that you want about privacy and security – let us know what you think. If you have any feedback, questions or concerns, please email us at data-protection@upplc.com or by post to the address above.

Links

Our website may contain links to let you visit other websites of interest with ease. Once you have used these links to leave our website, you should be aware that we do not have any control over that other website. As such, we cannot be responsible for the protection and privacy of any information that you provide whilst visiting these websites, and they are not governed by this Privacy Notice. We are not responsible for any products and/or services featured on any third-party websites; you should exercise caution and look at the Privacy Notice applicable to the website in question.

Ultimate Products UK Limited is a company under the group Ultimate Products PLC.

Dated: January 2026