1. Who we are

C.D. Leisure supplies, installs, services and maintains gaming and entertainment machines — fruit machines, coin-operated pool tables, digital touchscreen jukeboxes, vending machines and casino-style multi-game cabinets — in pubs, clubs, restaurants, offices, schools and leisure centres across the United Kingdom. Machines are placed on a 50/50 profit-share basis at no cost to the venue.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, C.D. Leisure is the data controller for the personal data described in this policy. That means we decide why and how your personal data is used.

How to contact us about your data: email gdpr@cdleisure.co.uk, our dedicated data-protection mailbox, or call us on 07539 528 070 and we will direct your request to the right person. Our office hours are Monday to Friday, 9am to 6pm, and Saturday, 10am to 4pm.

2. What personal data we collect

We only ask for the information we genuinely need in order to reply to you and prepare a quote. Through the enquiry form on this website we collect:

Your name — so we know who we are speaking to.
Your phone number — this is our primary way of calling you back.
Your email address — used to confirm details or send a written proposal.
Your venue type — pub, club, restaurant, office, school, leisure centre or other, so we can recommend suitable machines.
The machines you are interested in — fruit machines, pool tables, jukeboxes or vending machines.
An optional message — anything else you choose to tell us about your venue, such as its size, footfall or the machines you have now.

If you telephone us instead, we will take whatever details you give us over the phone so that we can deal with your enquiry. If you use the on-site chat assistant, the conversation stays in your own browser tab (see section 8 and our Cookie Policy).

We do not ask for, and we ask you not to send us, any special category data (such as health, ethnicity, religious belief or political opinion) or any financial or card details through this website.

3. Why we use your data, and our lawful bases

Under UK GDPR we must have a lawful basis for using your personal data. Ours are:

Legitimate interests

When you send us a business enquiry we use your details to respond to you, to discuss your venue, to prepare and provide a quote or profit-share proposal, and to arrange a site visit or installation if you decide to go ahead. Our legitimate interest is running and growing a machine-supply business by answering the enquiries people deliberately send us. We consider this to be within your reasonable expectations — you contacted us precisely so that we would get in touch. You can object to this at any time (see section 9).

Consent

Where you have given consent — for example by choosing “Accept all” on our cookie banner so that optional analytics may load — we rely on your consent. You can withdraw consent at any time, and withdrawing it is as easy as giving it. Withdrawing consent does not affect anything lawfully done before you withdrew it.

Contract

If you go on to become a venue we supply, we will process your details as necessary to enter into and perform that agreement — arranging installation, servicing visits, machine collections and profit-share payments.

Legal obligation

We may need to retain certain records to comply with our tax, accounting, licensing and gambling-regulation obligations.

4. How your enquiry reaches us

We want to be straightforward about the mechanics of the form, because it involves your data leaving your browser and also staying in it.

Transmission to our own server, then to Resend. When you press the submit button, the details you typed are sent over an encrypted (HTTPS) connection to a small script running on our own website server, which passes the enquiry to Resend, our email delivery provider, so it can be emailed to our team. Resend processes the data on our instructions as a data processor and is not permitted to use it for its own purposes.
A backup copy in your own browser. Your submission is also written to your browser’s local storage on your own device, under the key cdl_leads. This is a safety net: if the network drops or our server is briefly unavailable, your enquiry is not lost and can be re-sent. This copy sits on your device, not on our servers, and you can remove it at any time by clearing the site data for this website in your browser settings. It is described in full in our Cookie Policy.

The form also includes a hidden anti-spam field. It is never shown to you and is only used to detect automated submissions.

5. Who we share your data with

We never sell, rent or trade your personal data, and we do not pass it to third parties for their own marketing. Your data is shared only with:

Resend, our email delivery provider, which transmits your enquiry to us as described above.
Our own staff and engineers, on a need-to-know basis — the person who calls you back, and, if you proceed, the technicians who carry out the site visit, installation and servicing.
Our professional advisers (for example accountants) and regulators or law-enforcement bodies, where we are legally required or permitted to do so.

6. How long we keep it

We do not keep personal data for longer than we need it.

Enquiries that do not lead anywhere: kept for up to 24 months from your last contact with us, then deleted. This lets us pick up the thread if you come back to us the following season.
Enquiries from venues we go on to supply: kept for the life of the agreement and then for up to six years afterwards, to meet accounting, tax and contractual-limitation requirements.
The local backup copy in your browser: stays on your device until you clear your browser’s site data for this website.

If you ask us to delete your data sooner, we will do so unless we are legally required to keep it.

7. How we protect your data

Enquiries are transmitted over an encrypted connection. Access to enquiry details is limited to the people who need it to do their job. We keep the number of systems holding your data deliberately small — this website makes no external requests, loads no third-party fonts and hosts no advertising trackers. No method of transmission over the internet is completely secure, but we take reasonable and proportionate steps to protect your information and to restore it if something goes wrong.

8. Cookies, local storage and analytics

This website sets no third-party tracking cookies by default. It uses a small amount of browser storage to remember your cookie choice, to keep the backup copy of your enquiry, and to hold your chat conversation for the current tab. Optional Google Analytics 4 is loaded only if you choose “Accept all” on the cookie banner.

Full details — including exactly what each item is called, what it does and how long it lasts — are set out in our Cookie Policy.

9. Your rights under UK GDPR

You have the following rights over your personal data. They are free to exercise.

Right of access — to be told whether we hold data about you and to receive a copy of it.
Right to rectification — to have inaccurate data corrected and incomplete data completed.
Right to erasure — to have your data deleted where there is no good reason for us to keep it.
Right to restrict processing — to ask us to pause use of your data, for example while its accuracy is being checked.
Right to object — to object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.
Right to data portability — to receive data you gave us in a structured, commonly used, machine-readable format, or to have it sent to another controller.
Right to withdraw consent — where we rely on consent, you may withdraw it at any time.
Rights in relation to automated decision-making — we do not make decisions about you by purely automated means, and we do not profile you.

To exercise any of these rights, email gdpr@cdleisure.co.uk or call us on 07539 528 070. We may need to confirm your identity before we act, so that we do not disclose your data to someone else. We will respond within one month. If your request is unusually complex we may extend that by up to two further months, and we will tell you if we do.

10. Complaining to the ICO

If you are unhappy with how we have handled your personal data, please raise it with us first — email gdpr@cdleisure.co.uk or call 07539 528 070. Most things are resolved quickly with a phone call.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at any time. The ICO’s website is ico.org.uk, where you will find its current contact details, helpline number and online complaint form. Complaining to the ICO does not affect any other legal remedy available to you.

11. International transfers

We are a UK business serving UK venues, and we aim to keep personal data within the United Kingdom or the European Economic Area. Some of the service providers we use — such as Resend, our email delivery provider, and, where you have consented, Google Analytics — may process or store data outside the UK. Where that happens, we take steps to ensure your data receives an equivalent standard of protection, by relying on UK adequacy regulations for the destination country or on approved safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information on gdpr@cdleisure.co.uk or 07539 528 070.

12. Children’s data

This website is aimed at business owners, licensees, venue managers and facilities staff. It is not directed at children, and we do not knowingly collect personal data from anyone under 18 through this site. Where we supply machines to a school or leisure centre, our contact is the responsible adult member of staff. If you believe a child has submitted personal data to us, email gdpr@cdleisure.co.uk or call 07539 528 070 and we will delete it.

Please also note that gaming machines are subject to legal age restrictions and licensing conditions, and we install and site machines strictly in line with those requirements.

13. Links to other websites

Where this website links to an external site — for example the ICO — that site has its own privacy policy and we are not responsible for how it handles your data. Please read the policy of any site you visit.

14. Changes to this policy

We may update this policy from time to time to reflect changes in the way we work, in the services we use, or in the law. When we do, we will revise the “last updated” date below and publish the new version on this page. If a change materially affects how we use data you have already given us, we will take reasonable steps to tell you about it. We recommend checking this page occasionally so you always know where you stand.

Last updated: 20 July 2026

Privacy Policy