Privacy Policy

Published: 22 October 2026. Version: 2026-10-22-r3a.

OFM4X4 UK LTD, company number 14281109, registered in England and Wales. Registered office: 84 Balmoral Road, Watford, WD24 4ET, United Kingdom. We are not VAT registered. We operate the online store OFM4x4.co.uk. Orders, cancellations and complaints: office@ofm4x4.co.uk; telephone 020 4577 0208. Privacy enquiries: privacy@ofm4x4.co.uk.

Online business: no customer visits, collections or in-person returns. Our authorised postal/courier return address is OFM4X4 UK LTD, 84 Balmoral Road, Watford, WD24 4ET, United Kingdom. Send returns by post or courier; do not attend in person. Include your order reference where available. Contact us if you need help arranging a suitable carrier; our permission is not a condition of exercising a statutory right.

1. Controller and scope

OFM4X4 UK LTD is the controller for the personal information it uses to operate OFM4x4.co.uk. This notice concerns this UK store. A separately operated website is not automatically the same controller. Contact privacy@ofm4x4.co.uk about this notice, your rights or a data-protection complaint. You can also write to our registered office or use our contact form; identify it as a privacy matter. We do not describe this contact as a formally appointed Data Protection Officer.

2. Information we use and where it comes from

Information you provide: name, email, telephone, billing and delivery addresses, account details, order instructions and communications. Vehicle model, registration or VIN information may be provided when needed to assess fitment.
Transaction records: goods, quantities, prices, delivery method, payment references, authorisation and refund status, returns and complaints. Payment providers handle payment credentials through their systems; do not send us a full card number or security code.
Website and security information: IP address, browser and device information, access logs, session identifiers and information needed to keep a basket, authenticate accounts, prevent abuse and investigate faults.
Optional information: newsletter choices, consent preferences, reviews or photographs you submit, and analytics or advertising data where you permit those technologies.
Information from others: payment and fraud-check results, carrier tracking and delivery evidence, suppliers handling fulfilment, and someone placing an order for a recipient. Only share someone else's details where you are entitled to do so.

3. Purposes and legal grounds

Purpose	Legal ground
Take steps you request before purchase, process an order, deliver goods, administer an account and provide contractual support.	Contract, where you are the contracting individual; legitimate interests in fulfilling business orders or delivering to a nominated recipient where appropriate.
Comply with tax, accounting, product-safety and consumer-rights duties and valid authority requests.	Legal obligation.
Secure the website, detect fraud, manage disputes, maintain service records and defend legal claims.	Legitimate interests in protecting customers and our business; legal obligation where a specific duty applies. We consider your interests and use proportionate information.
Send optional promotional email or other electronic marketing.	Consent where required by PECR. Contractual notices are separate. Any reliance on a statutory soft opt-in requires all its conditions; a purchase alone is not blanket permission.
Use optional analytics, advertising and support-chat technologies.	The applicable cookie or device-access consent and, where personal data is involved, the relevant consent or other applicable lawful ground explained for the activity. We operate our analytics and advertising tags on an opt-in basis.

Providing information required for a purchase is necessary to process it; without the required contact, payment or delivery information we may be unable to fulfil the order. Optional marketing, analytics, advertising or chat choices are not conditions of purchase. We do not use acceptance of a privacy notice as a substitute for a lawful ground.

4. Recipients and service providers

We disclose only information appropriate to the purpose to the following categories of recipients:

Revolut merchant payment services, our banking providers and Clearpay where selected. Their precise contracting entities and their own notices are shown by those services. Payment and fraud providers may act as independent controllers for their own regulatory and fraud purposes.
Carriers, shipping-booking services, customs agents and suppliers or manufacturers where needed for fulfilment, delivery, returns or warranty support. This may include a supplier dispatching directly to you.
Our hosting provider, hosting.com/A2 Hosting, and providers supporting email, website maintenance and security. Our store uses OpenCart and Journal software; the software name alone does not mean its developer receives your orders.
FraudLabs Pro (Hexasoft) for order fraud screening. The configured integration can send contact details, IP address, billing location, delivery address and order/payment-reference information. Results can flag an order for review or change its fraud status. Ask us for human consideration of an adverse store decision; the provider's role and applicable safeguards must be assessed for its actual processing.
ProWebSms (formerly smshare), its configured sending gateway and relevant telephone network for transactional SMS where used. This involves the recipient telephone number and necessary message/order information. New automatic review-request SMS scheduling is disabled; promotional messaging requires its own lawful basis and PECR compliance.
Professional advisers, accountants, insurers and authorities where disclosure is necessary and lawful.
Google for consented Google Analytics 4 measurement and Google Tag Manager delivery of those tags; Meta for consented advertising measurement; AnyChat if you choose to enable its support widget. Google also delivers web fonts used by the site.

Some providers are processors acting under our instructions; others are independent controllers. We do not describe all recipients as processors or analytics identifiers as inherently anonymous. We do not sell customer contact lists.

5. Marketing and communication preferences

Newsletter subscription is optional and separate from trading terms. You may unsubscribe using the link in a marketing email, manage a relevant account preference or contact us. Withdrawing marketing consent does not stop essential messages about an order, safety issue or legal obligation. A minimal suppression record may be retained to respect an objection. We do not treat a telephone number supplied for delivery as permission for promotional or review-request SMS.

6. Cookies, analytics, advertising and chat

See our Cookie Policy for the technologies, purposes and controls. Use the control to accept, reject or change optional choices. Before an optional choice, the corresponding analytics, advertising and chat scripts are not loaded by our consent controls. When you enable measurement, information can include identifiers, page and product interactions, device information and purchase-event data; we do not intentionally send names, email addresses or payment credentials as analytics event fields.

Choosing an external social-media or messaging link takes you to that service under its own notice. Optional cookie consent does not by itself subscribe you to a newsletter.

7. International transfers

Hosting, support, payment, analytics and fulfilment providers may process information outside the UK; international delivery also requires disclosure to recipients in the destination country. Where UK transfer restrictions apply, an applicable adequacy regulation or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum with the required assessment, must support the transfer, unless a specific lawful exception applies. You can ask us for information about the relevant destination and safeguards. A provider's overseas location is not by itself a guarantee of an adequate safeguard.

8. Retention

We retain personal information only for as long as needed for the purpose, including applicable accounting and tax record duties, warranty administration, product-safety obligations and legal claims. The relevant accounting period, completion of an order or complaint, applicable limitation period and any legal hold determine retention of those records. Account information is kept while needed to provide the account and related services; you can request closure, subject to records that must be retained separately.

Security logs, support correspondence, consent records and backups are assessed according to their operational, security and evidential purpose. A deleted live record may remain in a restricted backup until its normal replacement cycle, without being used for unrelated purposes. This notice does not promise automatic deletion of every inactive account after three years or every message after 24 months. Ask us for the retention criteria applicable to a particular record.

For consented Google Analytics 4, the UK property currently uses a two-month event-data retention setting and a 14-month user-data retention setting, with the user-data period reset by new activity. These controls do not govern all aggregate reports or other records, and do not replace the separate retention criteria for orders, support or legal claims. The Analytics account also enables additional Google product/service sharing, modelling/business insights, technical support and business recommendations under the applicable Google terms. Google may act as an independent controller for additional uses covered by those terms. Ask us about the settings relevant to your information; optional Analytics loading remains controlled by your cookie choice.

9. Your rights

Subject to the applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You may object to direct marketing at any time and withdraw consent without affecting earlier lawful processing. We may retain information required by law or for a legitimate legal claim. We normally respond to a rights request within one month; a lawful extension or clarification pause may apply and we will explain it. We may request proportionate identity information where reasonably needed.

Payment or fraud providers may make their own automated decisions. Contact us if a store order is refused or you need a decision reviewed; we will explain what we can and consider the circumstances. This notice does not authorise an undisclosed solely automated decision with legal or similarly significant effects.

10. Privacy complaints

You may complain by emailing privacy@ofm4x4.co.uk, by post or through our contact form. Provide enough information to understand the issue and your preferred reply method; you need not use particular wording or create an account. We will acknowledge a data-protection complaint within 30 days, make appropriate enquiries, keep you informed and explain the outcome without undue delay. Contacting us does not remove your right to complain to the Information Commissioner's Office.

We no longer invite new raffle or prize-competition entries. Information concerning an earlier entry may still be needed to deal with the original transaction, prize obligations, complaints or legal claims. Discontinuing new promotions does not retrospectively create marketing consent or remove the rights of earlier participants.

11. Security, children and changes

We use appropriate technical and organisational measures for the risks and restrict access to people who need it. No online service can promise absolute security. Report a suspected security issue privately and avoid sending unnecessary sensitive information. The store is intended for adult purchasers, not a service directed at children. If a child's information is provided accidentally, contact us so we can assess it. Material changes to this notice will be explained appropriately; publishing an update does not retroactively create consent.

Legal Centre | Sales Terms | Privacy Policy | Cookie Policy