01Who we are
ONEPUBS PLATFORM LTD, trading as ONEPUBS, is the data controller for the personal data described in this policy.
01978 356983
02The personal data we collect
We collect the following categories of personal data:
- Account and contact data — your name, job title, business name, business address, email address and telephone number.
- Trade account data — licence details, trading references, and where credit is applied for, the information needed to assess it.
- Order and transaction data — the goods and services you order, delivery addresses and instructions, invoices, and payment status.
- Payment data — the last four digits and card type, the payment reference, and the outcome of the transaction. See section 4.
- Correspondence — emails, portal messages, venue review notes and records of telephone calls with us.
- Technical data — IP address, browser type and version, and how you use this website and the order portal.
We do not intentionally collect special category data. Please do not send us health, biometric or similar data unless we have specifically asked for it.
03How and why we use your data
We use personal data for the purposes below, on the lawful bases shown:
- To open and administer your trade account — performance of a contract, and our legitimate interests in verifying who we trade with.
- To take orders, deliver goods and take payment — performance of a contract.
- To assess creditworthiness where credit terms are requested — our legitimate interests in managing credit risk.
- To provide support and handle queries, claims and refunds — performance of a contract and our legitimate interests.
- To meet our legal obligations — including tax, VAT, accounting, licensing and anti-money-laundering requirements.
- To detect and prevent fraud and to keep our systems secure — our legitimate interests and our legal obligations.
- To send service messages such as delivery notifications, price-list updates and changes to these policies — performance of a contract and our legitimate interests.
- To send marketing about our products and services — our legitimate interests in promoting our business to trade contacts, or your consent where required. You can opt out at any time using the unsubscribe link in any marketing email or by emailing us.
04Card payment data
Card payments are processed by Dojo, our payment service provider. Card details are entered directly into Dojo's own secure, encrypted payment page. Your full card number, expiry date and security code are never transmitted to, seen by, or stored on ONEPUBS systems.
What we receive back from Dojo and store against your order is limited to the transaction reference, the amount, the card type, the last four digits of the card, and whether the payment succeeded or failed. We keep this so that we can reconcile payments, answer queries, process refunds and meet our accounting obligations.
Dojo is a separate data controller in respect of the card data it collects and processes. Its own privacy notice governs that processing and is available on the Dojo website.
06International transfers
We aim to keep personal data within the UK and the European Economic Area. Where a service provider processes data outside the UK, we make sure an appropriate safeguard is in place — UK adequacy regulations, the International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard used for a particular transfer.
Shopify, which hosts our order portal, is headquartered outside the UK and processes data internationally under its own data processing addendum and the standard contractual clauses.
07How long we keep your data
We keep personal data only for as long as we need it.
- Transaction, invoice and VAT records — six years from the end of the accounting period, to meet HMRC requirements.
- Trade account records — for the life of the account and two years after it closes.
- Correspondence and support records — two years from the date of the last contact.
- Marketing contact data — until you opt out, and then only a minimal suppression record so that we do not contact you again.
When we no longer need personal data we delete it securely or anonymise it.
08Your rights
Under the UK GDPR you have the right to ask us to: give you a copy of the personal data we hold about you; correct data that is inaccurate or incomplete; delete data where there is no good reason for us to keep processing it; restrict our processing while a concern is investigated; transfer your data to you or another provider in a machine-readable format; and stop processing that relies on our legitimate interests. You also have the right to object to direct marketing at any time.
There is no charge for exercising these rights. We will respond within one month. We may need to verify your identity first. Some rights are qualified — for example we cannot delete records we are legally required to keep, such as invoices.
To exercise any of these rights, email hello@onepubsuk.com.
10Changes to this policy
We may update this policy from time to time. The date at the top of this page shows when it was last changed. Where a change is significant we will tell account holders by email. This version was published on 27 July 2026.
11Complaints
If you are unhappy with how we have handled your personal data, please contact us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113.
12How to contact us
Data protection enquiries: hello@onepubsuk.com
Telephone: 01978 356983
By post: Data Protection, ONEPUBS PLATFORM LTD, Plas Acton Garage, 282 Chester Road, Wrexham, LL12 8DU.