1. Who we are
This website is operated by Malvern Chains Ltd, trading as Merley Chains, a company registered in England & Wales, company number 16501059. Registered office: Upper Interfields, Leigh Sinton Road, Malvern, Worcestershire, WR14 1UT.
Malvern Chains Ltd is the data controller for personal data collected through this website. We have not appointed a Data Protection Officer (we are not required to); for anything relating to your personal data, contact us at info@merleychains.com, call 01886 830 117, or write to the registered office above.
2. What we collect, and why
Enquiries sent through the form on this site are delivered to us by email using Brevo, an email delivery service that processes the message on our behalf and keeps delivery logs for a limited period. The site is hosted by Vercel; our enquiry form runs in Vercel's London region. Neither company uses your enquiry for any purpose of its own.
When you contact us (by email, phone, post, or the enquiry form on this site, in which case your enquiry is delivered to us by email and we use it only to answer you): your name, company, contact details, and the content of your enquiry, including any drawings, photographs or specifications you send. We use this to answer your enquiry, prepare quotations, supply goods, and keep a record of the specifications we have made for you so that reorders match. Our lawful bases are taking steps at your request before entering a contract, and performing a contract (UK GDPR Article 6(1)(b)), and our legitimate interests (Article 6(1)(f)) in responding to business enquiries and maintaining customer records.
When you visit this website: our hosting provider processes technical data such as your IP address in server logs, for security and to deliver the site. Lawful basis: legitimate interests in running a secure website. We do not use this data to identify or profile visitors.
What we deliberately do not do: this website sets no cookies and contains no advertising or social-media trackers; our only measurement is the cookieless visit counter described in section 7. We do not send marketing emails unless you have explicitly agreed to receive them, and you can withdraw that agreement at any time. We never sell personal data.
3. Who we share it with
Only where necessary to run the business: our email and IT providers (Google Workspace, and Brevo for delivering form enquiries), our website hosting provider (Vercel), our accountants and professional advisers, delivery carriers (name and delivery address, to fulfil orders), and, where an enquiry requires it, the manufacturing partners who make parts to our specification (limited to the technical details needed to make the part, not your contact details unless unavoidable). We require providers handling personal data on our behalf to do so under contract as processors. We do not transfer personal data outside the UK except where a provider does so under UK-approved safeguards (such as the UK International Data Transfer Agreement or an adequacy decision).
4. How long we keep it
We deal business to business and keep only the business contact and technical information needed to quote and supply. Enquiry correspondence that does not lead to an order is kept only as long as needed to answer and follow up, then deleted. Customer records, orders, quotations and the specifications we hold for reordering: for the trading relationship plus 6 years, in line with tax and company-record requirements.
5. Your rights
Under UK GDPR you have the right to: access a copy of your personal data; have inaccurate data rectified; have data erased; restrict or object to processing (including any direct marketing, at any time); data portability for data you provided to us; and to withdraw consent where processing relies on consent, without affecting processing before withdrawal. To exercise any right, contact us using the details in section 1 and we will respond within one month. We do not carry out automated decision-making or profiling. You are not required by law or contract to provide personal data, but we cannot answer an enquiry or supply an order without the details needed to do so.
6. Complaints
If you are unhappy with how we have handled your data, please contact us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk, or 0303 123 1113. Malvern Chains Ltd (trading as Merley Chains) is the data controller and is registered with the Information Commissioner's Office, registration number ZC263047.
7. Cookies & analytics
This website sets no cookies. Our only measurement is Vercel Web Analytics, which is cookieless and does not identify you personally. If that ever changes (for example if we add a customer login in future), this policy will be updated first and, where the law requires it, we will ask for your consent before any non-essential cookies are set.
8. Changes to this policy
We will post any changes on this page with a new "last updated" date. This policy was last updated in October 2026 (version 1.0).