Privacy Notice

CANALLI UK LTD is the controller of the personal information described in this notice.

• Company number: 17102220
• Registered in England and Wales
• Registered office: G56 Legacy Building, 1 Viaduct Gardens, London, SW11 7EP, United Kingdom
• Data protection contact: info@canalli.co.uk

We are not required to appoint a Data Protection Officer, and have not appointed one. Data protection enquiries go to the address above.

We collect personal information when you send us an enquiry through the form on this website.

You must provide:

• Your name
• Your company
• Your email address
• Your enquiry — the message itself

Optional:

• Your phone number

Submitted alongside the form:

• The enquiry type you select from the list
• The product category, family, size or product code you were looking at, if you started the enquiry from a product page
• The page you sent the enquiry from
• The date and time you sent it

If you do not provide the required fields, the form will not submit and we will not receive your enquiry. Without a working email address we may not be able to respond to you.

We do not ask for special category data — such as health information, or information about your race, religion or political opinions — and we do not want it. Please do not include anything in your message that you would not put in an ordinary business email.

IP address. When you submit the form, our server uses the IP address your submission arrives from as a rate-limiting key, to stop the form being used for automated abuse. It is held in the server’s working memory only, for that purpose. It is not written to a database, is not included in the enquiry email we receive, and is not recorded in our error logs.

We use Vercel Web Analytics, provided by Vercel Inc., to count visits and see which pages, catalogues and traffic sources matter. We use it to improve this website and to understand interest in our products. We do not use it to identify you, to profile you, or for advertising.

Cookies and local storage. Vercel Web Analytics itself does not use cookies. This website sets no advertising, marketing or analytics cookies, and there is no advertising pixel or tag manager on it. Separately, if you choose to turn analytics off (below), we store one preference in your browser’s local storage, solely to remember that choice. We store nothing else there.

What is collected. For each page view, Vercel receives the page address (its path, without any query string), the page you came from (the referrer), your approximate location (country and region, derived from your IP address), your device type, operating system and browser, and the time. We do not send it names, email addresses, phone numbers or anything you type into the enquiry form, and we send no custom events.

How visitors are told apart. Vercel does not use a cookie. It identifies a visitor for counting purposes by a hash created from the incoming request, and its documentation says this is discarded after 24 hours. We treat that hash, and the data linked to it, as personal data. We do not receive it, we cannot see individual visitors, and we only see aggregated figures.

Retention. Vercel keeps page-view records for the reporting period of our plan, which its documentation puts at 12 months (24 with an optional add-on), and says it may keep them longer.

Your choice. You can turn analytics off in this browser at any time. This stores a small setting in your browser’s local storage, so it applies only to this browser and is lost if you clear site data.

Turn analytics offAnalytics is on in this browser.

We do not track you across other websites, and we do not build a profile of your browsing.

• To read your enquiry, assess it and respond to it — including preparing a quotation, checking availability, or answering a technical question.
• To carry on the correspondence that follows, using the contact details you gave us.
• To keep the enquiry form working and protect it from automated abuse.

If you contact us through the website, we use your details to respond to your enquiry. Sending an enquiry does not sign you up to a newsletter or a marketing list, and we do not add enquirers to one. Outbound prospecting of business contacts is covered separately, under Business contacts and direct marketing.

No automated decision-making. We do not make decisions about you by automated means, and we do not profile you. Every enquiry is read and answered by a person.

Receiving and responding to enquiries — legitimate interests. We rely on legitimate interests (Article 6(1)(f) UK GDPR). Our legitimate interest is operating a business-to-business supply business: being able to receive an enquiry about our products, assess it, and reply to the person who sent it. We use only the information you chose to give us, for the purpose you gave it for, and replying to an enquiry you sent us is what you would reasonably expect us to do with it.

Steps before a contract — where you are the contracting party. Where you are asking us to take steps towards a contract with you personally rather than with a company — a sole trader requesting a quotation in their own name, for example — we rely on Article 6(1)(b): steps taken at your request before entering into a contract.

Website analytics — legitimate interests. We rely on legitimate interests (Article 6(1)(f)) to count visits and understand how the website is used. Our interest is running and improving a business-to-business website. The analytics use only aggregated figures and no cookies. You can object by turning analytics off above. We do not ask for cookie consent for it because it sets no cookies, is used only for aggregate statistics to improve the website, and you can switch it off. If that changes, we will ask.

Protecting the form — legitimate interests. The rate limit described above relies on legitimate interests (Article 6(1)(f)): keeping the enquiry route usable for genuine enquirers, and our systems secure.

None of the processing described in this notice relies on your consent.

We do not sell your personal information, and we do not share it for anyone else’s marketing.

Handling your enquiry involves these service providers:

• Twilio SendGrid — sends the enquiry email from this website to our inbox. SendGrid processes the contents of your enquiry on our instructions in order to deliver it. Twilio also processes limited data about message sending in its own right, for service security, fraud prevention and service integrity.
• Google — our enquiry inbox is a Gmail mailbox, so once your enquiry is delivered, Google holds and handles it as our email provider.
• Our website hosting provider — runs the servers this website and its enquiry form operate on, and handles your submission in transit.
• Vercel Inc. — provides Web Analytics (see “Cookies and analytics”). It receives the page-view data described there. It is not sent anything from the enquiry form.

We may also disclose information where the law requires it, or where we need to establish, exercise or defend legal claims.

Some of the providers above process personal information outside the UK.

• Twilio SendGrid — Twilio’s and SendGrid’s primary processing facilities are in the United States, and the SendGrid service also uses data centres in other countries. Twilio’s data protection addendum applies the UK International Data Transfer Agreement to personal data transferred from the UK to a country outside it.
• Google — Google operates worldwide and processes mailbox data on servers in a number of countries, including the United States.
• Vercel — processes analytics data for us, and its primary processing facilities are in the United States. Vercel’s data processing agreement, which applies to our plan, includes the EU Standard Contractual Clauses and terms for transfers from the UK.

Where personal information is transferred outside the UK, we rely on the transfer terms in the agreements our providers make available for their services. If you want to know more about the arrangements for a particular provider, contact us and we will tell you what we can.

Enquiries. This website does not store your enquiry. Nothing you submit is saved to a database here — the form sends your enquiry as an email and keeps no copy of it.

Your enquiry therefore exists as an email in our inbox, and how long we keep it depends on what it turns into:

• General enquiries, and enquiries that do not go anywhere — kept while there is still a reason to keep them, such as an open conversation or a follow-up you asked for.
• Quotations and live commercial discussions — kept while the opportunity is live, and for a reasonable period afterwards so we can pick up an earlier discussion if you come back to us.
• Enquiries that lead to an order — kept as part of the customer and order record, for as long as we have a business relationship and for the period afterwards that our legal, accounting and tax obligations require.

We keep enquiry correspondence only while one of the reasons above applies. If you would like your enquiry deleted sooner, ask us — see your rights below.

Analytics. See “Cookies and analytics” above.

Our email and hosting providers keep their own technical and service records under their own terms, separately from the inbox itself.

Who this covers. People who work for businesses we may supply, such as panel builders, HVAC and building controls firms and electrical contractors. You may not have contacted us.

Who we are. CANALLI UK LTD, company number 17102220. Contact: info@canalli.co.uk.

What we do. We research companies using their public websites and Companies House. Companies House is used to check a company’s identity and legal form. If a company looks relevant, we may note the name, job title and business email address of a person at that company, where their employer publishes them on its own website. We may then email that person, or phone the company’s main switchboard number, to ask whether they would like to hear about our products.

How software is used. An AI service extracts business-relevance signals from public company web pages. Deterministic scoring rules, which are code and not AI, decide whether a company qualifies. An AI service also helps draft messages. We keep the personal information sent to these services to a minimum. A person reviews and, where needed, edits each message and decides whether to send it. Nothing is sent automatically. We do not make decisions about individuals solely by automated means that have legal or similarly significant effects.

What we hold. Name, job title, business email address, the company, where we found the details, and a record of our contact with you. We do not collect personal mobile numbers, home addresses or social media content.

Why, and our lawful basis. Direct marketing to business customers. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Our interest is finding business customers for our products. We have assessed whether this is balanced against your rights, and you can ask us for a copy of that assessment.

Email and phone rules. We send unsolicited marketing email only to companies that PECR allows us to email without consent, such as limited companies. If we cannot establish that, we do not send. Before a marketing call we check the TPS and CTPS and our own do-not-contact records.

Where we got your details. From your employer’s own public website.

Who receives your details. Our own staff and service providers that process data on our behalf: an AI service provider, a database and hosting provider, and the email services that send our messages and receive your replies. They act on our instructions.

Transfers outside the UK. Some service providers may process personal information outside the UK. Where required, we use appropriate safeguards recognised under UK data-protection law, such as approved contractual safeguards. You can contact us for further information.

How long we keep it. If we research a named contact but never contact them, we delete their personal contact data after 30 days. If we contact you and you do not reply, we delete your personal contact data 12 months after the last contact. If a relationship develops into an opportunity or customer record, we keep that record under our normal business-record retention rules.

Your rights. You can object to our marketing at any time. If you object, we stop using your information for that purpose and keep only the minimum suppression information needed to make sure we respect your objection in future. Reply “no thanks” to any email, or write to info@canalli.co.uk. You can also ask for access, correction or deletion. Where it applies, you can ask us to restrict how we process your information. You may complain to us, or to the Information Commission’s Office (ICO) at ico.org.uk.

You have rights over your personal information under UK data protection law. They are not all absolute, and which of them apply depends on why we are using the information.

• Access — ask for a copy of the personal information we hold about you.
• Correction — have inaccurate information about you corrected, or incomplete information completed.
• Erasure — ask us to delete your information, in certain circumstances.
• Restriction — ask us to limit how we use your information, in certain circumstances.
• Objection — object to our use of your information where we rely on legitimate interests. Because we rely on legitimate interests to handle enquiries, you can object at any time. We will stop unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or we need the information for legal claims.
• Portability — where it applies, receive information you gave us in a portable format. This right covers information processed by automated means on the basis of consent or a contract, so it will not apply to most enquiries here.

To exercise any of these, contact us using the details below. There is no charge, and asking will not affect how we deal with you. We respond within one month of receiving your request. That period can be extended for complex requests, and it can pause if we need more information from you before we can deal with it — we will tell you if either applies.

For anything in this notice, including a request about your rights, contact us:

• Email: info@canalli.co.uk
• Post: CANALLI UK LTD, G56 Legacy Building, 1 Viaduct Gardens, London, SW11 7EP, United Kingdom

Please tell us what you would like us to do. We may need to confirm who you are before we act on a request about your information.

If you are unhappy with how we have handled your personal information, please tell us first, at info@canalli.co.uk. We will acknowledge your complaint within 30 days of receiving it, look into it, and tell you the outcome.

You also have the right to complain to the UK’s data protection regulator, the Information Commission’s Office (ICO), at ico.org.uk/make-a-complaint. You can do that at any time, though the regulator will normally expect you to have raised the matter with us first.

We will update this notice if how we handle personal information changes — for example if we add a service, change a provider, or start sending marketing communications. The date at the top of this page shows when we last changed it.