Privacy policy

Who we are

Offroad Midlands is the controller of personal information collected through this website. We are based in the Midlands, United Kingdom. For privacy questions, email sales@offroadmidlands.co.uk or call 07876 290746.

What we collect

We only collect what the site actually uses.

• Contact and used-bike enquiries. Name, email, phone if you give one, topic, and message. A used-bike enquiry includes the bike title and price in the message, and the topic “Used bike enquiry”.
• New bikes notify-me signups. Email, name if you give one, the bike or brand you asked about, and the category. A hidden field catches spam, and we don't keep it.
• Customer accounts. If you sign in, Shopify holds your name, email, addresses and order history. This site stores the login session in cookies, described below. We don't see your Shopify password.
• Orders. For an online purchase, Shopify collects your name, email, phone, delivery address, what you bought, and payment confirmation. Shopify handles card numbers. This website doesn't store them. Used bikes aren't paid for on the site.
• Technical data. The host records IP address, browser type and pages requested in the normal way a website runs. The notify-me form also uses the IP address for a few minutes to limit repeated signups. The basket on this site stays in the browser tab. We don't save it in a cookie.

Why we use it

Under UK GDPR we rely on these reasons:

• Contract, or steps before a contract. To reply to an enquiry, agree a used-bike sale, take an online order, deliver it, and run your account.
• Consent. The notify-me signup. You ask us to email you when that stock arrives. You can withdraw consent by emailing us, and we won't use the address for anything else.
• Legal obligation. To keep order and tax records the law requires.
• Legitimate interests. To keep the site secure, limit form spam, and answer a message you sent us. We don't use it to send marketing you didn't ask for.

We don't sell your information.

Who we share it with

We use these processors, and no advertising networks:

• Shopify runs the product catalogue, hosted checkout, payments, and customer accounts.
• Resend delivers contact-form, used-bike enquiry, and notify-me emails to our sales inbox.
• Vercel hosts this website and keeps the request logs needed to run it.

We also share information if the law says we must, for example with a regulator or to deal with a legal claim. The site code doesn't send data to an analytics or advertising service.

How long we keep it

• Enquiry emails, including used-bike enquiries, are kept for as long as we need them to finish the conversation and any follow-up, then deleted from the inbox in the ordinary way.
• Notify-me emails are kept until we have emailed you that the stock is in, or until you unsubscribe by asking us to delete the signup. We don't add them to a marketing list.
• Order and account records are kept for as long as tax and consumer law require. Shopify stores the order. You can ask us, or Shopify through your account, about deletion once those periods end.
• Login cookies expire on the timetable in the cookies section. Signup rate-limit records stay in server memory for about ten minutes, and we don't write them to a database.

Your rights

You can ask us for a copy of your personal information, to correct it, to delete it, to restrict how we use it, or to object to use based on legitimate interests. Where we rely on consent, you can withdraw it at any time. You can also ask for information you gave us to be sent to you or to another service, where the right to portability applies.

Email sales@offroadmidlands.co.uk. We may need to confirm it's you. We reply within one month, or tell you if we need longer.

Cookies

This site doesn't set analytics or advertising cookies. There's no analytics script in the site code. The basket is stored in the page while you browse. We don't put it in a cookie.

If you sign in, we set cookies that are strictly necessary for the account. They're HTTP-only, SameSite Lax, and secure on the live site. Page scripts can't read them.

• orm_ca_tx is set for up to 10 minutes while Shopify login is in progress. It holds the login check (state, nonce and code verifier) and is cleared when login finishes or you leave the flow.
• orm_ca_access and orm_ca_exp hold the Shopify access token and when it expires. They last until that token expires.
• orm_ca_refresh and orm_ca_id hold the refresh token and Shopify identity token, for up to 45 days, so you can stay signed in.

Signing out clears these cookies. Shopify's own checkout, on Shopify's checkout pages, sets Shopify cookies to run the basket and payment session. Shopify controls those cookies.

International transfers

Shopify, Resend and Vercel may process personal information outside the United Kingdom, including in the United States. Where data leaves the UK we rely on the safeguards those providers offer, including the UK International Data Transfer Addendum or standard contractual clauses where they are required. You can ask us for a copy of the relevant safeguard.

Complaints

Please contact us first and we'll try to put it right. You can also complain to the Information Commissioner's Office, the UK regulator for personal information: ico.org.uk/make-a-complaint.

Last updated

20 October 2026.