Privacy Policy

Who we are

[LEGAL NAME LTD] is a company registered in England and Wales under company number [COMPANY NUMBER], with its registered office at [LEGAL ADDRESS]. We are the controller of the personal data described here for the purposes of the UK GDPR and the Data Protection Act 2018.

Questions about this policy or about the data we hold can be sent to [EMAIL] or by telephone on [PHONE].

What we collect

Information you give us

When you order, request a sample or ask us to quote for carpet cut to size, we collect your name, delivery and billing addresses, email address, telephone number, the measurements you send us, and the contents of your correspondence. Card details are entered directly with our payment provider; we receive confirmation of payment and the last four digits of the card, not the full number.

Information we collect automatically

Our servers record your IP address, the pages you view, the approximate time of each request and basic device and browser information. Your currency preference and basket count are stored in your browser and are not transmitted to us until you place an order.

Why we use it, and on what basis

• To take, fulfil and deliver your order, to cut goods to your measurements and to handle cancellations, returns and repairs. Basis: performance of a contract.
• To answer enquiries and to keep a record of what was agreed about sizes, colours and delivery dates. Basis: performance of a contract, or our legitimate interest in responding to people who contact us.
• To keep accounting, VAT and customs records. Basis: compliance with a legal obligation.
• To protect the site against fraud and misuse, and to understand which products people look at. Basis: our legitimate interest in running a secure and viable shop.
• To send occasional emails about new arrivals, where you have asked for them. Basis: consent, which you can withdraw at any time using the link in each message.

Who sees your data

We share personal data only with the parties who need it to complete your order: our payment processor, our carriers and fitters, our accountants, and the providers who host this website and our email. Each acts on written instructions and may not use your data for their own purposes. We do not sell personal data or share it for advertising.

Where a provider is located outside the United Kingdom, we rely on UK adequacy regulations or on the International Data Transfer Agreement, together with appropriate technical safeguards.

How long we keep it

Order and transaction records are kept for six years after the end of the financial year in which the order was placed, as required by tax law. Enquiries that do not lead to an order are deleted after twelve months. Marketing consents are kept until you withdraw them, and for a short period afterwards to record that the withdrawal was actioned.

Your rights

Under the UK GDPR you may ask us for a copy of your personal data, ask us to correct it, ask us to erase it, object to or restrict how we use it, and ask us to send certain data to another provider. Where we rely on consent, you may withdraw it at any time without affecting anything done beforehand.

Write to [EMAIL] and we will respond within one month. If we need more time on a complex request, we will tell you why. There is no charge unless a request is manifestly unfounded or excessive.

If you believe we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.

Cookies and local storage

This site sets no advertising or tracking cookies. Your currency choice and basket count are held in your browser's local storage so the site behaves consistently between pages; clearing your browser data removes them. Our hosting provider may set a strictly necessary cookie to balance traffic and block automated abuse.

Security

Traffic to and from this site is encrypted in transit. Access to order records is limited to staff who need it, protected by individual accounts and two-factor authentication. We keep a log of who has accessed customer records. Where a breach is likely to result in a risk to your rights, we will notify the Information Commissioner's Office within 72 hours and tell you without undue delay.

Children

This shop is intended for adults. We do not knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We update this policy when our practices or the law change. The version published at [WEBSITE] is the current one, and material changes affecting existing customers are notified by email.