Privacy Policy

This Privacy Policy explains how CO2 YOU Ltd collects, uses, shares and protects personal data when you visit co2you.com, subscribe to a CO₂ cylinder plan, place an order, receive a delivery or collection, or contact our support team. Please read it alongside our Cookie Policy and our Terms & Conditions.

1. Who we are

CO2 YOU Ltd ("CO2 YOU", "we", "us", "our") is the data controller for the personal data described in this policy.

Registered office and fulfilment centre: Arches 897–898, Holyrood Street, London SE1 2EL, United Kingdom

Company number: 13008341 (incorporated in England and Wales, 12 November 2020)

VAT number: GB 370 9185 80

ICO registration number: ICO: ZC216932

Contact: refill@co2you.com

We are registered with the UK Information Commissioner's Office as a data controller.

2. The personal data we collect

2.1 Information you give us

Account and order information — your name, email address, phone number, billing address, delivery address, and the details of your order or subscription plan. Payment information — your payment card or bank details are collected and processed directly by our payment providers. We do not store full card numbers on our systems. We hold a secure payment token that allows us to take recurring subscription payments, plus the last four digits and expiry date of your card so you can identify it in your account. Delivery information — access instructions, safe-place preferences, gate or entry codes, concierge details, and any notes you give our riders and drivers about how to reach you. Support information — the content of your emails, chat messages, phone calls and social media messages to us, including any photographs or attachments you send (for example, a photo of a damaged cylinder or a regulator fitting). Business customer information — where you apply for a trade account, we collect your business details, the names and contact details of your directors and authorised contacts, and information supporting a trade credit application. Marketing preferences — your consent choices and whether you have opted out of marketing.

2.2 Information we collect automatically

Device and usage information — your IP address, browser type and version, operating system, time zone, referring URL, the pages you view on our site, the products you look at, items added to your basket, and how you move through the site. We collect this using cookies, log files, pixels and similar technologies. See section 8. Subscription and delivery records — your delivery and collection schedule, which cylinders are currently allocated to you, cylinder serial numbers, swap history, and any failed or rescheduled deliveries. Proof of delivery — when our riders or drivers complete a delivery or collection, they may take a photograph of the cylinder at your doorstep or safe place, together with a timestamp and GPS location. These photographs may incidentally show your property, front door or house number. They exist to evidence that a delivery took place and to resolve disputes. Route and vehicle data — our own delivery vehicles and cargo e-bikes record location data for routing, safety and delivery-time estimates. This is linked to a delivery stop rather than to you personally, but a delivery stop can be traced back to your address. CCTV — our premises at Holyrood Street operate CCTV for site security and health and safety. If you visit us, you may be recorded. CCTV is not used to monitor individual customers and is not linked to your account.

2.3 Information we receive from others

We may receive information about you from delivery carriers (delivery status and exceptions), payment providers (payment success, failure and chargeback data), fraud-screening tools, credit reference agencies where you apply for a trade account, and advertising platforms where you interact with our ads. We do not knowingly collect special category data (such as health data). Please do not include it in messages to our support team.

3. Why we use your data, and our lawful basis

Under the UK GDPR we must have a lawful basis for each purpose. Ours are set out below. What we use it for Lawful basis Creating and managing your account Performance of a contract Taking payment and managing your subscription billing Performance of a contract Delivering cylinders and collecting empties, including proof of delivery Performance of a contract Tracking which cylinders are allocated to you Legitimate interests — managing our returnable asset base Providing customer support, including AI-assisted support Performance of a contract; legitimate interests — resolving your query efficiently Cylinder safety, product recalls and safety notices Legal obligation; vital interests where there is a risk to life What we use it for Lawful basis Screening orders and payments for fraud Recognised legitimate interests — detecting and preventing crime Sending you service messages (delivery notifications, payment failures, plan changes) Performance of a contract Sending you marketing about our own similar products where you are an existing customer, and you have not opted out Legitimate interests, relying on the soft opt-in under PECR Sending you marketing where you are not an existing customer Consent Personalising the emails and offers you receive Consent (marketing) or legitimate interests (relevance of our own communications) Advertising to you on third-party platforms Consent, given through our cookie banner Website analytics and improving our site Legitimate interests — understanding and improving our service Accounting, tax and statutory record-keeping Legal obligation Handling complaints, disputes and legal claims Legal obligation; legitimate interests — defending our position Site, premises and staff security including CCTV Legitimate interests — protecting our people and property Assessing trade credit applications Performance of a contract (steps prior to entering one); legitimate interests — managing credit risk Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights. You can ask us for a summary of that assessment at refill@co2you.com. Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect processing carried out before you withdrew it.

4. Artificial intelligence and automated decision-making

We use AI tools in a limited number of places, and we think you should know where. AI-assisted customer support. Some of your messages to our support team are handled by an AI assistant, which can answer common questions, look up your order and subscription status, and carry out routine account actions. Your message content and relevant account details are shared with the provider of that assistant so it can respond. You can ask to speak to a human at any point, and we will pass you to one. Fraud and payment screening. Orders and payments are screened automatically for indicators of fraud. A high-risk score may cause an order to be held for manual review, or in rare cases cancelled and refunded. Where an order is cancelled, that decision is reviewed by a member of our team. Marketing segmentation. We use automated tools to group customers by things like plan type, usage frequency and engagement, so the emails we send are more relevant. This affects which marketing you receive. It does not affect the price you pay or the service you get. We do not make decisions about you that are based solely on automated processing and that produce legal effects or similarly significant effects on you. If we ever introduce one, we will tell you first, explain the logic involved, and give you a route to obtain human intervention, express your point of view and contest the decision. You can contact refill@co2you.com at any time to ask for human review of anything an automated system has decided.

5. Who we share your data with

We share personal data with the following categories of recipient, all of whom act on our instructions as processors unless stated otherwise. Store, subscription and payments Shopify (e-commerce platform and hosting); Appstle (subscription management); our payment providers, who process card payments and Direct Debits and act as independent controllers for their own regulatory and fraud-prevention purposes. Delivery and logistics DPD, DHL and other carriers we use for national delivery; our own riders and drivers; the software we use for routing and delivery scheduling. Customer support Gorgias (helpdesk); Siena AI (AI-assisted support); our telephony and messaging providers. Marketing and analytics Klaviyo (email and SMS marketing); Google Analytics; Meta and Google for advertising, as described in section 6. Business operations Xero (accounting); our professional advisers, including accountants, lawyers and insurers; credit reference agencies where you apply for a trade account. Other disclosures We may disclose personal data where we are required to do so by law, in response to a lawful request from a public authority, to establish, exercise or defend legal claims, or to protect the rights, property or safety of CO2 YOU, our customers or others. If our business or assets are sold or reorganised, personal data may be transferred as part of that transaction. We require every processor to act only on our documented instructions, to keep your data secure, and to comply with applicable data protection law. We do not sell your personal data.

6. Advertising, pixels and audiences

We advertise on Meta (Facebook and Instagram) and Google. To do this we use tracking pixels and tags on our website, which record what you do on our site and match that activity to your account on those platforms. We also upload customer lists — typically hashed email addresses — to Meta and Google so that we can show ads to existing customers, exclude existing customers from acquisition campaigns, or build "lookalike" audiences of people with similar characteristics. For the collection of your data through the Meta pixel and its transfer to Meta, CO2 YOU and Meta Platforms Ireland Limited act as joint controllers. We have entered into Meta's controller addendum, under which Meta is responsible for enabling you to exercise your rights in respect of the data it holds. Meta's own privacy policy explains what it does with that data. You can exercise your rights against either of us, but requests about Meta's own processing are best directed to Meta. None of this advertising tracking happens unless you accept marketing cookies in our cookie banner. You can change your mind at any time using the cookie settings link in our website footer.

7. International transfers

Some of our providers are based outside the United Kingdom, or store data outside it — principally in the European Economic Area and the United States. Where we transfer personal data out of the UK, we rely on one of the following: -​ a UK adequacy decision covering the destination country; -​ the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission's Standard Contractual Clauses; or -​ another transfer mechanism recognised under UK data protection law. Where we transfer personal data out of the EEA in respect of EU or Irish customers, we rely on an EU adequacy decision or the European Commission's Standard Contractual Clauses. You can request a copy of the relevant safeguards by emailing refill@co2you.com.

8. Cookies and similar technologies

We use cookies, pixels, tags and local storage on our website. Our Cookie Policy sets out each one, what it does and how long it lasts. Cookies we set without asking. Some cookies are strictly necessary for the site to work — keeping you logged in, remembering your basket, and protecting against fraud and security threats. UK law also now permits us to set certain low-risk cookies without consent, including those used purely to collect statistical information about how the site is used so we can improve it, and those that adjust the appearance or performance of the site to suit your device. Where we rely on this, you can still opt out using our cookie settings. Cookies we ask about. Advertising, retargeting and audience-building cookies, including the Meta and Google tags described in section 6, are only set after you actively consent. We do not use pre-ticked boxes, and rejecting is as easy as accepting. You can change your preferences at any time using the Cookie settings link in our website footer, or by clearing and blocking cookies in your browser.

9. How long we keep your data

Data Retention period Account and subscription records Duration of your subscription, then 6 years from the end of the financial year in which it ended Order, invoice and payment records 6 years from the end of the relevant financial year (Companies Act 2006 and HMRC requirements) Stored payment tokens Duration of your subscription, then 6 months Proof of delivery photographs 90 days, unless retained longer for an open dispute or claim Route and vehicle location data 90 days Customer support conversations 24 months from the date the ticket is closed Marketing profile and engagement history Until you unsubscribe, or after 24 months of no engagement, whichever comes first Cookie and analytics data As set out in the Cookie Policy; no longer than 14 months for analytics CCTV footage 30 days, unless retained for an incident investigation Trade account applications — accepted 6 years from the end of the trading relationship Trade account applications — declined 12 months Website enquiries that do not become orders 12 months Records of complaints and data rights requests 6 years Health and safety and cylinder incident records As required by health and safety legislation Where we are required by law to keep records — accounting and tax records in particular — we cannot delete them on request, even if you ask us to close your account. In those cases we will restrict our use of the data to the legal purpose only.

10. How we protect your data

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access controls so that staff only see the data they need, multi-factor authentication on our core systems, vetting of the suppliers who process data for us, staff training, and a documented process for identifying and reporting personal data breaches. If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay.

11. Your rights

Under the UK GDPR you have the right to: -​ be informed about how we use your data — this policy; -​ access the personal data we hold about you; -​ rectification of data that is inaccurate or incomplete; -​ erasure of your data in certain circumstances; -​ restrict our processing of your data in certain circumstances; -​ data portability — receive data you gave us in a structured, machine-readable format; -​ object to processing based on legitimate interests, and to object to direct marketing at any time, which we will always honour; -​ withdraw consent at any time where we rely on it; -​ not be subject to solely automated decisions with legal or similarly significant effects, and to obtain human intervention where such a decision is made; and -​ complain — first to us, and then to the Information Commissioner's Office. Section 12 explains how. To exercise any of these rights, email refill@co2you.com. We will respond within one month. If your request is complex, or you have made several requests, we may extend this by up to two further months and will tell you if we do. We may ask you for information to verify your identity, and the one-month period does not begin until we have it. There is no charge, unless a request is manifestly unfounded or excessive.

12. How to complain

If you are unhappy with how we have handled your personal data, please tell us. We would much rather put it right ourselves. Complain to us. Email refill@co2you.com with "Data protection complaint" in the subject line, or write to us at Arches 897–898, Holyrood Street, London SE1 2EL, marked for the attention of our Data Protection Lead. You can also raise a complaint through any other channel you normally use to contact us — email, live chat, phone or social media — and we will route it to the right place. We will acknowledge your complaint within 30 days of receiving it, investigate it, and tell you the outcome and the reasons for it. Complain to the regulator. You have the right to complain to the Information Commissioner's Office at any time, whether or not you have raised it with us first. Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Telephone: 0303 123 1113 Web: https://ico.org.uk/make-a-complaint/ If you are in the European Union or Ireland, you may also complain to your local supervisory authority. In Ireland this is the Data Protection Commission, https://www.dataprotection.ie.

13. Children

Our website and services are intended for adults aged 18 and over, and CO₂ cylinders are not sold to under-18s. We do not knowingly collect personal data from children. We have had regard to the ICO's Age Appropriate Design Code in designing our site. If you believe a child has given us personal data, contact refill@co2you.com and we will delete it.

14. Do Not Track and Global Privacy Control

There is still no agreed industry standard for how websites should respond to browser "Do Not Track" signals, and we do not currently respond to them. We do recognise Global Privacy Control signals where your browser sends one, and will treat this as an objection to advertising and analytics cookies. You can manage all of your preferences through the Cookie settings link in our footer.

15. Changes to this policy

We may update this policy to reflect changes to our practices or for operational, legal or regulatory reasons. The current version is always published at co2you.com with the date it was last updated at the top. Where a change materially affects how we use your data, we will tell you directly by email before it takes effect.

16. Contact us

Email: refill@co2you.com

Post: CO2 YOU Ltd, Arches 897–898, Holyrood Street, London SE1 2EL

Company number: 13008341