Global Ordnance UK Limited — Version 1.0 · Last updated: 2 July 2026 · Reviewed at least annually and whenever our processing activities change.
1. Who we are
Global Ordnance UK Limited (“GO-UK”, “we”, “us”) is a private limited company registered in England and Wales (company number 09197958) with its registered office at 10-12 Mulberry Green, Harlow, Essex, CM17 0ET, United Kingdom. We are the data controller for the personal data described in this notice.
We have appointed a Data Protection Lead responsible for data protection matters: Garry Leach, Director. We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR; this decision is recorded and reviewed annually.
Contact for all data protection matters: business@globalordnance.com, or by post to the registered office above, marked “Data Protection Lead”.
2. The personal data we collect
We are a business-to-business wholesale supplier to licensed dealers, government and commercial customers. We collect and process the following categories of personal data:
- Business contact data — names, job titles, business email addresses, business phone numbers and business addresses of customer, prospect, dealer and supplier contacts.
- Employee data — personal data of our employees and contractors needed for employment, payroll, pension and legal purposes.
- Contract-related data — personal data contained in contract documentation, including personal data relating to UK Ministry of Defence contract work.
- Correspondence — personal data you provide when you email or write to us.
- Website technical data — limited technical information (such as IP address and browser type) processed by our web hosting provider’s server logs and security services for the purpose of operating and securing this website.
We do not process special category data (as defined in Article 9 UK GDPR) in the ordinary course of business, we do not collect data from children, our website contains no functionality directed at children, and we do not carry out any solely automated decision-making or profiling.
3. Why we process your data, and our lawful bases
| Purpose | Data categories | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Performing and administering contracts with customers and suppliers | Business contact data; contract-related data | Contract necessity (Art. 6(1)(b)) |
| Employment, payroll, pension and HMRC obligations | Employee data | Contract necessity (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Business development and maintaining relationships with business contacts, prospects, dealer accounts and supplier contacts | Business contact data | Legitimate interests (Art. 6(1)(f)) — a documented Legitimate Interest Assessment is on file and reviewed annually |
| Complying with export control, defence contracting and other regulatory obligations | Contract-related data; business contact data | Legal obligation (Art. 6(1)(c)) |
| Responding to enquiries sent to us by email or post | Correspondence | Legitimate interests (Art. 6(1)(f)) |
| Operating and securing this website | Website technical data | Legitimate interests (Art. 6(1)(f)) |
We do not rely on consent as a lawful basis for any employee, customer or supplier processing. If we ever introduce consent-based processing (for example, a marketing mailing list), consent will be captured by a clear opt-in and you will be able to withdraw it at any time.
4. Where your data is stored, and international transfers
Our operational data is held in the Microsoft 365 cloud environment with data residency in the European Economic Area (Netherlands), which is covered by UK adequacy regulations.
Encrypted backups of our Microsoft 365 environment are held by AvePoint in AWS GovCloud data centres in the United States. This transfer outside the UK/EEA is safeguarded by a written data processing agreement incorporating UK GDPR Article 28 clauses, the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, a documented Transfer Impact Assessment, and encryption of the data in transit (TLS 1.2+) and at rest (AES-256).
5. Who we share your data with
We use a small number of service providers (“processors”) who process personal data on our behalf under written contracts: Microsoft (Microsoft 365, provisioned via Crayon), AvePoint (backup), and GoDaddy (website hosting). We do not sell personal data. We may disclose personal data where required by law or regulation, including to HMRC, the UK Ministry of Defence and other public authorities.
6. How long we keep your data
We retain personal data only for as long as needed for the purposes above, in line with our documented Retention Schedule: employment and payroll records for the periods required by UK law; contract records for the duration of the contract plus the period required by contract and statute; business contact data for the duration of the business relationship and a reasonable period after; backup data for up to 7 years under our backup retention policy, after which it is deleted. Data is disposed of securely at the end of its retention period.
7. Your rights
Under the UK GDPR and Data Protection Act 2018 (and the EU GDPR where applicable) you have the right to: access your personal data; have inaccurate data rectified; have data erased; restrict processing; data portability; object to processing based on legitimate interests; and not be subject to solely automated decision-making. Where processing is based on consent, you may withdraw it at any time.
To exercise any right, or to raise a complaint or question about how we handle your data, email business@globalordnance.com or write to the Data Protection Lead at 10-12 Mulberry Green, Harlow, Essex, CM17 0ET. We will confirm receipt within 3 working days and respond within one calendar month (extendable by up to two further months for complex requests, in which case we will tell you). We may need to verify your identity before acting on a request.
8. Complaints to the regulator
You have the right to complain to the UK’s supervisory authority, the Information Commissioner’s Office (ICO): ico.org.uk · 0303 123 1113 · Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. If you are in the EU, you may also complain to your local supervisory authority. We would appreciate the chance to address your concerns first, but you may contact the regulator at any time.
9. Cookies
This website uses only cookies that are strictly necessary for its operation and security. We do not set analytics, advertising or other non-essential cookies. If we introduce non-essential cookies in future, we will ask for your consent through a cookie banner before setting them, and you will be able to change or withdraw your preference at any time.
10. Security
We protect personal data with technical and organisational measures including encryption in transit and at rest, multi-factor authentication and conditional access controls, device management, data loss prevention, segregated encrypted backups, staff security training, and documented incident response procedures, including notification to the ICO within 72 hours where a personal data breach meets the notification threshold.
11. Changes to this notice
This notice is reviewed at least annually by the Data Protection Lead and updated whenever our processing activities change. The version number and date at the top of this page show when it was last updated.