VANRACKNO-DRILL WORK KITS
POLICY REGISTER / PRIV-01

Privacy Policy

The complete account of how order, delivery, support, membership and site data moves through Vanrack.

Last updated 21 July 2026Governing law: England and Wales
LOAD-SAFETY & NO-DRILL BOUNDARY

All cargo must be secured. Unless a product page shows a supplier-provided rating, the item is not a load-restraint device. Do not drill, cut or alter the vehicle, and do not obstruct vision, cameras, airbags, belt paths, controls or pedal travel.

01

Who is responsible

DTJ COMMERCIALS LTD, at 8 Burns Avenue, Oswaldtwistle, England, BB5 4RB, United Kingdom, is the data controller for information collected through Vanrack. Contact our privacy team at support@dtjcommercialss.shop or +44 7696170956.

02

What we collect and where it comes from

We collect information you give us: name, email, phone, billing and delivery address, country, order lines, vehicle size or measured cargo dimensions, returns, support messages, membership preferences and fleet request details. We receive order and transaction status, payment identifiers, fraud signals and limited billing details from Stripe or PayPal; we do not receive or store your full card number or card security code.

We also collect essential device and request data such as IP address, browser, timestamps, pages requested, consent choices and security events. Delivery carriers may provide tracking and delivery status. We do not intentionally collect special-category data.

03

Information collection sources / Where information comes from

Information comes directly from you when you browse, build a cart, complete checkout, create or access an account, join Vanrack Club, contact support, request a return, submit a fleet enquiry or otherwise communicate with us. It also comes automatically from your browser and device through essential request logs, security controls, cart storage, cookie choices and any analytics you consent to.

We receive limited information from service providers involved in your transaction: Stripe or PayPal supplies payment status, transaction references, billing country and fraud signals; fulfilment partners and parcel carriers supply dispatch, tracking, delivery attempt, delivery completion, loss or damage status; email and support providers supply message delivery and reply status; and security providers supply bot and abuse signals. We may receive identity or transaction information from advisers, banks, regulators or law-enforcement bodies when needed to handle a dispute, prevent fraud or comply with law.

04

Shipping, order fulfilment, carriers, returns and support data

For shipping and order fulfilment we use the recipient name, shipping address, email, phone, country, products ordered, quantities, parcel references, delivery instructions and tracking events to validate the order, pick and pack goods, create carrier labels, dispatch parcels, provide tracking, manage customs documentation and resolve failed or damaged deliveries. We disclose only the delivery information needed by the relevant fulfilment partner, customs intermediary and parcel carrier.

For returns, refunds and support we use the order reference, contact details, product and vehicle-size selections, correspondence, photographs you choose to provide, return reason, parcel tracking, inspection outcome, refund status and complaint history. This information is used to authenticate the request, give product-fit or safety information, arrange a return, inspect goods, issue a lawful remedy, prevent return abuse and keep an auditable customer-service record.

Checkout leads that do not become orders and ordinary support or fleet enquiries are deleted or anonymised within 24 months unless an earlier deletion request applies or a legal issue requires retention. Delivery contact and tracking data is kept with the order record for up to 6 years where needed for tax, accounting, consumer claims, product safety or dispute evidence. Routine carrier working copies and fulfilment labels are deleted by those processors under their schedules after delivery and operational reconciliation. Return and support records are deleted or anonymised when the applicable order, warranty, dispute and legal limitation periods expire.

05

Why we use it and legal bases

We process contact, order, payment status, delivery and returns data to perform our contract; respond to pre-contract questions; meet tax, accounting, consumer, product-safety and legal obligations; and pursue legitimate interests in fraud prevention, site security, customer support, stock planning and improving product fit information.

We use consent for optional marketing and non-essential analytics where required. Consent may be withdrawn at any time without affecting earlier lawful use. We do not sell personal information.

06

Who we share it with

We share only what is necessary with hosting and infrastructure providers, Supabase for lead and order records, Stripe or PayPal for payment processing, email delivery providers for transactional and support messages, Cloudflare for bot and security checks, analytics providers where enabled with consent, professional advisers, and logistics carriers or fulfilment partners that need name, address, contact and parcel details.

Payment providers act under their own privacy notices. Carriers use delivery details to fulfil and track shipments. We may disclose information to authorities or counterparties where legally required, or during a properly managed business transfer.

07

International transfers

Some processors or delivery partners may process information outside the United Kingdom or European Economic Area. Where required, we use an adequacy decision, the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses and proportionate supplementary safeguards. Cross-border delivery necessarily sends limited delivery data to the destination carrier.

08

How long we keep it and how it is deleted

Checkout leads that do not become orders and contact or fleet enquiries are normally kept for up to 24 months. Order, payment, shipping, tax and accounting records are generally kept for 6 years after the relevant financial period. Support and returns records are kept for the order lifecycle and up to 6 years where needed for disputes, product-safety follow-up or legal claims. Security logs are usually retained for up to 12 months. Consent records are kept while relied on and for an appropriate limitation period.

At the end of the applicable period, records are securely deleted from active systems or anonymised so they no longer identify a person. Encrypted backups expire on the provider’s rotation schedule and are not restored for ordinary business use after deletion. We may suspend deletion for a documented legal hold, chargeback, fraud investigation or live claim, then delete or anonymise the record when that reason ends.

09

Security

We apply access controls, encrypted transport, provider security features, environment-separated secrets, logging and least-privilege operational access. No online system is risk-free; if a breach creates a reportable risk, we will notify the relevant authority and affected people as law requires.

10

UK GDPR, EU GDPR and CCPA rights

Depending on location, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent. UK and EU residents may complain to their supervisory authority; in the United Kingdom this is the Information Commissioner’s Office. California residents may request disclosure, correction or deletion and may not be discriminated against for exercising rights.

To verify a request we may ask for information reasonably necessary to match our records. An authorised agent must provide authority to act. Email support@dtjcommercialss.shop; we aim to respond within the legally required period.

11

Do Not Sell or Share

Vanrack does not sell personal information and does not share it for cross-context behavioural advertising. If that practice changes, we will update this notice and provide any required opt-out control before it begins. Browser privacy signals are respected where legally applicable to enabled non-essential technologies.

12

Cookies and analytics

Essential storage keeps the cart, security state and consent selection working. Non-essential analytics or marketing technologies are used only where presented and permitted by your choice. See the Cookie Policy for categories, duration and controls. Cart contents are product selections, not a long-term store for delivery or payment information.

13

Automated decisions and children

We do not make decisions with legal or similarly significant effects solely by automated means. Fraud and security tools may flag an order for human review. Van Finder uses only the four rules you select and does not profile individuals.

The site is not for children under 13. People aged 13–17 may use it only with parent or guardian consent; orders must be placed by an adult. Contact us if a child has provided information without appropriate permission.

14

Contact and complaints

Contact DTJ COMMERCIALS LTD at support@dtjcommercialss.shop, +44 7696170956, or 8 Burns Avenue, Oswaldtwistle, England, BB5 4RB, United Kingdom. Please first give us the opportunity to address a concern. You may also complain to the Information Commissioner’s Office or the supervisory authority where you live or work.

DTJ COMMERCIALS LTD

8 Burns Avenue, Oswaldtwistle, England, BB5 4RB, United Kingdom
support@dtjcommercialss.shop
+44 7696170956