Toolstation CCTV Privacy Notice

All you need to know about our CCTV policy at stores, car parks and offices.

About Us

The company posting this privacy notice is a member of the Travis Perkins Group (the “Travis Perkins Group” means Travis Perkins plc and its subsidiaries).


Images captured on devices operated by the Travis Perkins Group are classed as Personal Information.


Travis Perkins Group is committed to protecting your privacy and comply with data protection laws applicable to the United Kingdom, including the UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA).

What Personal Information do we collect about you?

We capture your image and in some cases your audio when you come into the field of vision and capture of any of the following devices in operation:


CCTV (Video Surveillance) in:


  • Stores
  • Car parks
  • Offices

How do we use this Personal Information?

We use the recorded images and audio for the following purposes:


  • the prevention and detection of crime
  • for the safety of our colleagues, customers and visitors
  • to provide evidence for investigations, insurance, health & safety breaches
  • for training purposes (steps are taken to protect the privacy of any person captured)


Where CCTV is in operation clear signage will be displayed informing you of its use. 

Lawful basis for processing

The Travis Perkins Group has a legitimate interest in operating video and audio recording devices, in order to keep colleagues, customers and visitors safe and protect our property, assets and reputation.


Sometimes CCTV is processed for compliance of a legal obligation.

Who do we share your Personal Information with?

We will only share your personal information when we consider the request to be appropriate, for example with the following parties:


  • Service providers: to manage and operate the CCTV system as our data processor
  • Competent authorities e.g. the Police to assist investigations
  • Insurance providers: to assist with insurance claims, legal claims and investigations.
  • Any relevant regulators: where we are required to do so by law 
  • Individuals when exercising their data protection & privacy rights


We do not disclose personal information to anyone else except as set out above unless we have your consent, or we are legally obliged to do so.  We do not sell your data.


We may anonymise any of the personal information we hold on our CCTV system (so that it does not directly identify you, for example by obscuring your face) and it therefore ceases to be your personal information. We may use this anonymised information for any other purposes.


Your personal information will be processed safely and securely within the UK and European Economic Area (EEA).


Information is retained in line with its purpose of processing. Whilst being processed on the recording devices it will be retained for 31 days as standard however, any recorded images that have been downloaded for investigation, incident evidence, insurance claims or legal proceedings may be required for longer and will be retained in line with our retention schedule. Once there is no reason to retain any recorded data, i.e. the purpose for its request has been fulfilled, it is deleted unless retention is required for continuing legal proceedings.

What are your rights?

You can exercise certain rights in regards to your personal information:


  • The right to receive a copy of the information we hold about you
  • The right to have inaccurate information corrected or incomplete information completed
  • The right to have your information erased
  • The right to have the processing of your information restricted
  • The right to withdraw your consent or object to processing reliant upon legitimate interests
  • The right to have your information transferred to another organisation
  • The right to request human intervention in regards to automated decision making


In regard to CCTV processing some of these rights are not absolute rights.  The applicability of these rights is dependent upon our purpose and the lawful basis of processing relied upon. 


Should your request be one that we cannot process you will be informed of this, along with the reasons as to why your request cannot be carried out.


You can exercise your rights either verbally or in writing. However, should you make a request verbally we recommend that you follow this up in writing to provide a clear correspondence trail. 
Requests in relation to accessing your personal information can be made by emailing


If you are making a request on behalf of someone else please email


We have an obligation to respond within one month of receiving your request. Should we deem the request to be complex, the response time can be extended by up to two months and you will be informed of the extended response date, alongside an explanation, within the original one-month time frame.


If required, identification will be requested within the one-month time frame and only limited to what is necessary for confirmation, such as a copy of your driving licence, passport or utility bill.  Once ID has been confirmed we will then process your request.


Should we refuse to comply with a request we will inform you of this within the one-month time frame and provide an explanation outlining our justification, our internal complaints procedure and your right to complain to a supervisory authority and to enforce your rights through a judicial remedy.


Contact information for submitting a request can be found at the bottom of this privacy notice.

Contact Details

If you have a query about this privacy notice please contact the Travis Perkins Group’s Data Protection Officer by writing to them at:


Travis Perkins Group Data Protection Officer
Travis Perkins plc
c/o General Counsel Office
Rye Hill House
Rye Hill Close
Lodge Farm Industrial Estate


Or emailing them at: (marking emails for the attention of the Data Protection Officer)

Making a Complaint

If you are not satisfied with our use of your personal information or our response to any request made by you in relation to your personal information, you have a right to make a complaint to the Information Commissioner:


Information Commissioner’s Office
Wycliffe House
Water Lane


Tel: 0303 123 1113 (local rate) or 01625 545745 (national rate) Email: 


The ICO currently recommends you contact them within 3 months of your last contact with us and advises you to contact them once the company's complaints process has been exhausted.

More Help