Privacy Policy

1. Who We Are

2. What Personal Data We Collect & Why

We only collect the information we genuinely need to serve you. Here is exactly what we collect, why, and the legal basis for processing it:

3. What We Do NOT Collect

4. How We Use Your Data

We use your personal data only for these specific purposes:

• To fulfill your orders - processing made-to-measure manufacturing requests, cutting fabric, arranging delivery, and scheduling installation
• To communicate with you - sending order confirmations, manufacturing updates, delivery notifications, and responding to your enquiries
• To arrange consultations - scheduling free home consultations and measuring appointments
• To send samples - dispatching fabric samples you have requested
• To check delivery eligibility - validating your delivery postcode and calculating whether it is within our 20-mile delivery area
• To comply with legal obligations - retaining order records for tax and accounting purposes as required by UK law
• To improve our website — monitoring site performance and usability to enhance your experience
• To prevent fraud - monitoring for suspicious activity and protecting our customers and business

We do not: sell your data to third parties, use your data for automated decision-making or profiling, share your data with advertisers, or send marketing communications without your explicit consent.

5. Who We Share Your Data With

We only share your data with trusted service providers who help us run our business. All providers are contractually bound to protect your data and use it only for the services we engage them for:

We do not sell, trade, or rent your personal information to third parties for their own marketing purposes. We may disclose your data if required by law, to enforce our Terms of Service, or to protect our rights, property, or safety.

6. Data Storage & Security

We take the security of your data seriously and implement appropriate technical and organizational measures to protect it:

• SSL/TLS encryption for all data transmitted between your browser and our website
• Encrypted password storage - passwords are hashed and salted, never stored in plain text
• Secure API tokens for all server-to-server communications
• Access controls - only authorized personnel have access to personal data
• Regular security updates and monitoring
• Secure payment processing via Stripe (PCI-DSS Level 1 certified)

7. How Long We Keep Your Data

We only keep your data for as long as necessary:

• Order records: 7 years after the order is completed - required by UK tax and accounting law (HMRC)
• Account information: Until you request account deletion, or after 3 years of inactivity
• Manufacturing specifications: 7 years - needed for warranty claims and future re-orders
• Enquiry/consultation records: 2 years after the last contact
• Email communications: 2 years from the last message

After the retention period, your data is securely deleted or anonymized so it can no longer be linked to you.

8. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation and Data Protection Act 2018, you have the following rights regarding your personal data:

To exercise any of these rights, please contact us at enquiries@hartcurtainsandblinds.com. We will respond within 30 days. There is no charge for exercising your rights unless your request is manifestly unfounded or excessive.

9. Cookies & Tracking

Our website uses cookies to function properly and to improve your experience. For full details, please see our Cookie Policy.

In summary: we only use strictly necessary cookies that are essential for the website to function (cart, login, security, cookie preferences). You can manage your preferences via our cookie consent banner. For full details, please see our Cookie Policy.

10. Marketing Communications

We will only send you marketing communications if you have explicitly opted in. We do not send newsletters or promotional emails by default. If you opt in, you can unsubscribe at any time by clicking the "unsubscribe" link in any email or by contacting us directly.

Transactional emails (order confirmations, delivery updates, invoices, appointment confirmations) are not marketing - they are necessary to fulfill your order and cannot be opted out of while you have an active order with us.

11. International Data Transfers

Your data is primarily processed and stored within the UK and European Economic Area (EEA). Where we use services that may transfer data outside the UK/EEA (e.g., Stripe, GitHub), we ensure appropriate safeguards are in place, such as UK International Data Transfer Agreements or adequacy decisions. Stripe is certified under the EU-US Data Privacy Framework.

12. Children's Privacy

Our services are not intended for children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of any material changes by posting the updated policy on this page with a revised "Last updated" date. If you have an account with us, we may also notify you by email. We encourage you to review this policy periodically.

14. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or would like to make a complaint about how we handle your data, please contact us:

15. Your Right to Complain to the ICO

If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the UK's data protection supervisory authority:

We would appreciate the opportunity to resolve any concerns directly before you approach the ICO - please contact us first so we can help.