BPM Supplies Privacy Policy

Who we are

BPM Supplies is the data controller for the personal information collected through bpmsupplies.ie and at our showrooms. This policy explains what we collect, why, who we share it with and your rights under the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Acts 1988–2018.

Contact us about anything in this policy:

• Email: sales@bpmsupplies.ie

• Post: BPM Supplies, Lismard Business Park, Portlaoise, Co. Laois, R32 A379, Ireland

• Phone: Portlaoise (057) 865 7411 · Dublin (01) 553 9995

Our showrooms are at Lismard Business Park, Portlaoise, Co. Laois, R32 A379 and Unit 2 Crag Avenue, Clondalkin, Dublin 22, D22 WP60.

What we collect

We collect only what we need to sell, deliver and support your order.

• Order and account details: name, billing and delivery address, email address, phone number, order history and any delivery notes you give us.

• Payment details: your card is processed by Shopify Payments. We never see or store your full card number.

• Messages: what you send us by email, website chat, social media messages or WhatsApp, including photos of deliveries or damage.

• Reviews and alerts: your name and review if you leave a product review, and your email or phone number if you ask to be told when an item is back in stock.

• Trade account details: business name, contact person and VAT number where you hold a trade account.

• Device and browsing data: IP address, browser, device type, pages viewed and how you reached our site. This is collected through cookies and similar technology (see Cookies below).

We do not record phone calls.

Why we use it

Each use below rests on a lawful basis under Article 6 of the GDPR.

• Processing your order, taking payment, arranging delivery or collection, and handling returns and warranty claims: performance of a contract.

• Answering your questions and updating you about your order: performance of a contract.

• Keeping invoices and sales records for tax and accounting: legal obligation.

• Preventing fraud and keeping our website secure: legitimate interests.

• Improving our website, products and service using analytics: legitimate interests, and consent where cookies are involved.

• Sending marketing emails or messages and showing you personalised ads: consent, which you can withdraw at any time.

• Publishing your product review: consent.

You can unsubscribe from marketing using the link in any email, or by contacting us. Order and service messages are not marketing and will still be sent.

Who we share it with

We do not sell your personal information. We share it only with service providers who help us run the business, under contracts that require them to protect it.

• Shopify: hosts our online store and processes orders and card payments (Shopify Payments, including wallet payments such as Shop Pay and Google Pay). Shopify may also use your information, combined with other Shopify data, to improve its services and ad targeting for our store, as described in Shopify's privacy policy.

• Delivery couriers: your name, delivery address and phone number go to our courier partners, including TK Couriers and JS Ryan Freight, so they can deliver and contact you.

• Email and messaging: Google Workspace for our email, and Shopify's own messaging tools for order and marketing emails.

• Store apps: Judge.me (product reviews), Kbite (back-in-stock alerts) and WorkflowMail (order emails).

• Advertising and sales channels: Google, Meta (Facebook and Instagram) and Pinterest, to measure our ads and list our products. Where you consent to marketing cookies, these platforms may use data about your visit to show you our ads.

• AI shopping assistants: if you buy from us through an AI shopping assistant such as ChatGPT, Microsoft Copilot or the Shop app, that service passes your order details to us so we can fulfil it. Its own privacy policy also applies.

• Professional advisers and authorities: our accountants and legal advisers, and Revenue or other authorities where the law requires it.

If the business is ever sold or restructured, customer records may transfer to the new owner under this policy.

Cookies

Cookies are small files stored on your device when you visit our site. We use three kinds:

• Essential cookies: needed for the basket, checkout, login and security. These are always on.

• Analytics cookies: help us understand how visitors use the site. These are set only with your consent.

• Marketing cookies: used by Google, Meta and Pinterest to measure our ads and show you relevant ads. These are set only with your consent.

You choose which optional cookies to allow in the cookie banner when you first visit, and you can change your choice at any time. You can also block or delete cookies in your browser settings, though some parts of the site may then stop working. Shopify's full list of store cookies is at shopify.com/legal/cookies.

Transfers outside the EU

Some of our service providers, including Shopify, Google and Meta, process data outside the European Economic Area, mainly in Canada and the United States. When this happens, the transfer is protected by an EU adequacy decision, the EU–US Data Privacy Framework, or the European Commission's Standard Contractual Clauses. You can contact us for more detail on the safeguard used.

How long we keep it

• Orders, invoices and payment records: 6 years from the end of the tax year they relate to, as Irish tax law requires.

• Customer account details: for as long as your account is open, then deleted or anonymised unless the records above still need them.

• Messages and claims: up to 2 years after the matter is closed, or longer if a dispute or warranty claim is still open.

• Marketing consent: until you unsubscribe, after which we keep only a note of your opt-out so we do not contact you again.

• Back-in-stock requests: until the alert is sent or you cancel it.

• Cookie data: for the periods set in the cookie banner, up to 2 years.

Your rights

Under the GDPR you have the right to:

• see a copy of the personal information we hold about you;

• have inaccurate information corrected;

• have your information deleted, unless we must keep it by law;

• restrict or object to how we use it, including for marketing;

• receive your information in a portable format;

• withdraw any consent you have given, at any time.

To use any of these rights, email sales@bpmsupplies.ie. We will reply within one month and may ask you to confirm your identity first. There is no charge.

If you are unhappy with how we handle your information, you can complain to the Data Protection Commission at dataprotection.ie, by post to Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, or by phone on (01) 765 0100 or 1800 437 737. We would appreciate the chance to resolve it with you first.

Other points

• Children: our website and products are intended for adults. We do not knowingly collect information from anyone under 16.

• Security: your data is held on secure, access-controlled systems, and payments are encrypted. No system is completely secure, so please tell us at once if you think your account has been misused.

• Changes: we may update this policy from time to time. The latest version will always be on this page, with the date it was last changed.

Last updated: 29 October 2026