Privacy policy

Last updated: 18 April 2026

1. Who We Are

Genpower Ltd (referred to in this policy as "we", "us", or "our") is the data controller for this website and its associated brands, including Hyundai Power Equipment, The PowerSite, JCB Tools, and Power Spares.

Registered office: Genpower Ltd, Isaac Way, Pembroke Dock, Pembrokeshire, SA72 4RW, United Kingdom
Company number: 05758983
Data protection contact: David Klass
Email: sales@hyundaipowerequipment.co.uk
Telephone: 01646 687 880

2. What This Policy Covers

This privacy policy explains how we collect, use, store, and share your personal information when you visit our website, use our services, or make a purchase. It applies to all visitors and customers of hyundaipowerequipment.co.uk.

By using our website, you acknowledge that you have read this policy and understand how we handle your personal information. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to personal information.

3. Personal Information We Collect

We may collect and process the following categories of personal information, depending on how you interact with us:

Contact and account details

Name, billing address, shipping address, email address, phone number
Username, password, account preferences

Financial and transaction information

Payment card details (processed by our payment providers, not stored by us)
Order history, items viewed, items added to cart or wishlist, purchase and return details

Device and usage information

IP address, browser type and version, operating system, screen resolution
Pages visited, time spent on pages, referring URLs, click paths

Analytics and advertising identifiers

Google Analytics client ID (a pseudonymous identifier stored in a first-party cookie)
Google Ads click identifiers (GCLID, gbraid, wbraid) when you arrive via a Google advertisement
Campaign attribution parameters (utm_source, utm_medium, utm_campaign) from marketing links
Landing page URL (sanitised to remove any personal identifiers before storage)

Communications

Information you include when contacting us via email, phone, or contact forms
Phone calls may be recorded and monitored for training and dispute resolution purposes

4. How We Collect Your Data

We collect personal data from the following sources:

Directly from you: when you create an account, place an order, complete a form, or contact us
Automatically via our website: through cookies and similar technologies when you browse our site (see section 7)
From our service providers: when they collect or process information on our behalf
From our partners or third parties: such as advertising networks and analytics providers

5. Lawful Basis for Processing

Under UK GDPR, we process your personal data only where we have a lawful basis to do so:

Contract performance

We process your data as necessary to fulfil our contract with you: processing orders, arranging delivery, handling returns, and providing customer support.

Legal obligation

We keep certain records (such as name, address, and transaction details) for a minimum of 6 years to comply with UK tax and accounting requirements.

Legitimate interests

We process some data where it is necessary for our legitimate business interests, provided those interests do not override your rights. This includes fraud prevention, website security, service improvement, and understanding how our site is used. Where we rely on legitimate interests, we consider the impact on your rights and only use your data in a fair and proportionate way.

Consent

For marketing communications, marketing cookies, and advertising identifiers, we rely on your consent. You can withdraw consent at any time (see section 11). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. How We Use Your Personal Data

Order fulfilment: processing payments, dispatching orders, arranging shipping, handling returns and exchanges
Account management: creating and maintaining your account, remembering preferences
Customer support: responding to enquiries and resolving issues
Website analytics: understanding how visitors use our site, measuring page performance, and improving the shopping experience (via Google Analytics 4)
Advertising measurement: measuring the effectiveness of our advertising campaigns on Google Ads and other platforms, including conversion tracking
Server-side conversion tracking: we use two server-side methods to measure advertising effectiveness. First, we send purchase data to Google Analytics via the Measurement Protocol as a backup when browser-based tracking could not fire. Second, we share order data (including hashed email address, phone number, and billing address) with Google Ads via a secure server-side connection for Enhanced Conversions matching. This allows Google to attribute purchases to the correct advertising campaign without relying on cookies. No raw personal data is transmitted; all identifiers are hashed before matching.
Marketing communications: sending promotional emails about products and offers (with your consent)
Fraud prevention and security: detecting and preventing fraudulent activity, securing our systems
Legal compliance: meeting our obligations under applicable law

7. Cookies and Tracking Technologies

We use cookies and similar technologies to operate our website, understand how it is used, and measure advertising effectiveness. When you first visit our site, you will see a consent banner. You can choose which categories of cookies to accept or decline.

Cookie categories

Essential cookies

Required for the website to function. These handle things like your shopping cart, login sessions, and security. They do not require consent under PECR.

Analytics cookies

Help us understand how visitors use the site by collecting anonymous usage statistics. These are only set when you grant analytics consent.

Marketing cookies

Used to measure advertising effectiveness and attribute purchases to specific ad clicks. These are only set when you grant marketing consent.

Specific cookies we set

Cookie Name	Category	Duration	Purpose
_hpp_ga_cid	Analytics	2 years	Stores a pseudonymous client ID used by Google Analytics to identify unique visitors. Does not contain personal information.
_hpp_attr	Marketing	90 days	Stores campaign attribution data (Google Ads click IDs, UTM parameters, landing page URL). Used to attribute purchases to the correct advertising campaign.
_ga, _ga_*	Analytics	2 years	Set by Google Analytics (GA4) to distinguish visitors and track session information.
_gcl_aw	Marketing	90 days	Set by Google Ads to store click information for conversion tracking.
_shopify_*	Essential	Varies	Set by Shopify to manage your shopping session, cart, and checkout.

This is not an exhaustive list. Third-party services may set their own cookies. See section 8 for details of our third-party processors.

Consent Mode

We use Google Consent Mode v2, which means:

Before you consent, Google tags send cookieless, anonymous pings that do not identify you. No cookies are set and no personal data is collected.
After you grant consent, cookies are set and data collection proceeds in accordance with the categories you accepted.
If you decline consent, no analytics or marketing cookies are set and no identifiable data is sent to Google.

Cart attributes

When you grant consent, we store campaign attribution data (such as your Google Ads click ID and UTM parameters) as order attributes within Shopify. These are only visible to our staff in the Shopify administration panel. Customers cannot see these attributes. Landing page URLs are sanitised to remove any parameters that could contain personal information (such as email addresses or tokens) before storage.

8. Third-Party Processors and Controllers

We share personal data with the following third parties, who process it on our behalf or as joint controllers:

Provider	Service	Data Shared
Shopify	E-commerce platform and hosting	All order, account, and browsing data as required to operate the store
Shopify Payments	Payment processing	Payment card details, billing address, transaction amounts
Google (Analytics, Ads, Merchant Centre)	Website analytics, advertising, and product feed management	Pseudonymous identifiers, page views, purchase events, ad click IDs. For conversion measurement, hashed email address, phone number, and billing address are shared via a secure server-side connection (Enhanced Conversions) to attribute purchases to advertising campaigns.
Google BigQuery	Data warehousing and business analytics	Order data, product data, anonymised analytics. Used for internal reporting and advertising conversion import.
Klaviyo	Email marketing and automation	Email address, name, purchase history, browsing behaviour (with consent)
NetSuite	Order management, operations, and dispatch	Order details, customer name, address, contact details
Zendesk	Customer support and ticketing	Name, email address, order details, and any information included in support enquiries
Klarna	Delayed payment options	Name, address, email, order details (subject to your application)
Clearpay	Instalment payments	Name, address, email, order details (subject to your application)
Meta (Facebook/Instagram)	Remarketing and social advertising	Pseudonymous identifiers and purchase events (with marketing consent)
AWIN	Affiliate marketing network	Click identifiers, transaction IDs, order values. Used to attribute sales to affiliate partners.
AdBeacon	Website performance and advertising data analysis	Pseudonymous browsing data, page views, advertising performance metrics
RaekData	Lead identification and enrichment	IP-based visitor identification, segmentation data, and follow-up support
Cloudflare	Content delivery, security, and server-side tag proxy	IP address, request headers. Our analytics proxy runs on Cloudflare Workers.

Each third party is required to process data securely and in line with applicable data protection law. Where data is shared with providers such as Klarna, it is processed in line with their own privacy notices.

9. International Data Transfers

Some of our third-party processors (including Google, Shopify, and Cloudflare) store and process data outside the United Kingdom. Where personal data is transferred outside the UK, we rely on recognised transfer mechanisms such as UK International Data Transfer Agreements or the UK Addendum to the EU Standard Contractual Clauses, unless the transfer is to a country with an adequacy decision.

10. Data Retention

We retain personal data only for as long as necessary for the purposes described in this policy:

Order and transaction data: 6 years from the date of the transaction, as required by UK tax law
Account data: for as long as your account remains active, plus 6 years after closure
Analytics cookies (_hpp_ga_cid, _ga): 2 years from last visit
Marketing attribution cookie (_hpp_attr): 90 days
Google Ads click identifiers (GCLID): 90 days (matches the Google Ads attribution window)
Marketing communications preferences: until you unsubscribe or withdraw consent

11. Your Rights

Under UK GDPR, you have the following rights:

Right of access: request a copy of the personal data we hold about you
Right to rectification: ask us to correct inaccurate or incomplete data
Right to erasure: ask us to delete your personal data (where applicable)
Right to restrict processing: ask us to limit how we process your data
Right to data portability: receive your data in a structured, machine-readable format
Right to object: object to processing based on legitimate interests, including direct marketing
Right to withdraw consent: withdraw consent at any time for marketing cookies, advertising identifiers, or marketing communications

To exercise any of these rights, contact us using the details in section 1. We may need to verify your identity before acting on your request. We will respond within one month, as required by law.

If you have an online account, you can update your personal details by logging in at any time.

12. Marketing Communications

If you sign up to our mailing list, you may receive marketing emails from our group brands, including Hyundai Power Equipment, The PowerSite, JCB Tools, and Power Spares.

You can unsubscribe at any time using the unsubscribe link in every email. We will not sell your personal data to third parties for their own marketing purposes.

13. Children's Data

Our website, products, and services are intended for users aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe your child has provided us with personal information, please contact us and we will delete it.

14. Security

We take data security seriously and use reasonable technical and organisational measures to protect your personal data, including SSL encryption, firewall protections, restricted access to systems and data, and secure password requirements. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

15. Relationship with Shopify

Our store is hosted by Shopify, which collects and processes personal information about your access to and use of our services in order to provide and improve the platform. Information you submit may be transmitted to and shared with Shopify and its sub-processors, which may be located outside the UK. To learn more about how Shopify uses your personal information, visit the Shopify Consumer Privacy Policy. You can also exercise your rights via the Shopify Privacy Portal.

16. Third-Party Links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We recommend reviewing their privacy policies before providing any personal information.

17. Changes to This Policy

We may update this privacy policy from time to time to reflect changes to our practices or for legal, regulatory, or operational reasons. We will post the revised policy on this page and update the "Last updated" date. We encourage you to review this page periodically.

18. Complaints

If you have concerns about how we process your personal data, please contact us first using the details in section 1 and we will do our best to resolve the issue.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

ico.org.uk
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113