Privacy Policy

01 Who we are

1.1 This policy explains how we collect and use personal data when you visit zhomes.co.uk, buy from us, contact us, or collect an order from our unit.

1.2 The data controller is [REGISTERED COMPANY NAME] trading as ZHOMES, a company registered in England and Wales under company number [NUMBER], registered office [REGISTERED ADDRESS].

1.3 We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NUMBER]. [CONFIRM — registration is a legal requirement for almost every UK business that processes personal data, and it's a criminal offence not to hold one. If you are not registered, register at ico.org.uk before publishing.]

1.4 For any question about this policy or your data:

• Email: [privacy@zhomes.co.uk]
• Post: Data Protection, [REGISTERED COMPANY NAME], [ADDRESS]
• Telephone: [PHONE]

1.5 We are not required to appoint a Data Protection Officer, because we are not a public authority and our core activities do not involve large-scale monitoring or large-scale processing of special category data. Queries go to the contact above.

02 What this policy covers

This policy covers personal data we handle as a controller. It does not cover third-party websites we link to, or the separate processing carried out by payment and finance providers under their own policies — see section 8.

03 The personal data we collect

3.1 Special category data. We do not seek health, ethnicity, religious, biometric or similar data. If you volunteer something — for example, a mobility need affecting delivery access, or an allergy relevant to a fabric or finish — we use it only to provide the service you asked for, and we ask that you don't send us more than you need to.

3.2 Children. Our site is not intended for under-18s and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

04 Where we get it

• Directly from you — when you order, register, request a swatch or sample, apply for a trade account, contact us, or leave a review.
• Automatically — through cookies and similar technologies when you use the site. See section 6.
• From third parties — payment and finance providers (transaction outcomes and fraud signals), carriers and installers (delivery status and proof of delivery), suppliers who ship direct, credit reference agencies for trade credit applications, and advertising and analytics platforms.

05 Why we use it, and our lawful basis

5.1 Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. You can object at any time — see section 11 — and we will stop unless we have compelling grounds to continue.

5.2 Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.

06 Cookies

We use cookies and similar technologies. Strictly necessary cookies — those that make the basket, checkout, login and security work — are set without consent because the site cannot function without them. All other cookies, including analytics and advertising, are set only if you consent through our cookie banner, and you can change or withdraw your choices at any time via [the cookie settings link in the footer].

Full detail is in our Cookie Policy. [CONFIRM this page exists, and that your banner has a reject option as prominent as accept — that pairing is the most common PECR failure the ICO writes to retailers about.]

07 Marketing

7.1 If you have bought from us we may email you about similar furniture and home goods under the "soft opt-in" in the Privacy and Electronic Communications Regulations, because we collected your address in the course of a sale, the products are similar, and we gave you a simple chance to opt out when we collected it and in every message since.

7.2 If you have not bought from us — for example you requested a swatch or subscribed to our newsletter — we email you only with your consent.

7.3 Business contacts. We may send marketing to corporate contacts on a legitimate interests basis where the law permits.

7.4 Opting out. Use the unsubscribe link in any marketing email, adjust your account preferences, or email [privacy@zhomes.co.uk]. We action opt-outs promptly. You will still receive service messages about live orders — delivery updates are not marketing.

7.5 We do not sell your personal data, and we do not share it with third parties for their own marketing.

08 Who we share it with

We share personal data only where necessary, and only with recipients who are bound to protect it:

• Payment and finance providers — [Visa, Mastercard, Maestro, American Express, PayPal, Apple Pay, Google Pay, Klarna, Clearpay]. These are separate controllers for the payments they handle and their own privacy policies apply. [CONFIRM the list matches your checkout.]
• Carriers, delivery crews and installers — [NAMES], who receive your name, address, phone and access notes so they can deliver, assemble or install and contact you about the slot.
• Suppliers who ship direct — where an item is despatched from the manufacturer, they receive the delivery details needed to send it.
• IT, hosting and website providers — our hosting, WooCommerce and WordPress infrastructure, CDN and security, and backup providers. [CONFIRM providers.]
• Email, analytics and advertising platforms — [CONFIRM: name each one you actually use. Delete any you don't. Do not list a platform you have switched off.]
• Review platforms — [PROVIDER]. [CONFIRM or delete.]
• Credit reference and fraud prevention agencies — for trade credit applications and fraud screening.
• Professional advisers — accountants, insurers, lawyers, where needed.
• Authorities and regulators — where we are legally required to disclose, or to establish or defend legal claims.
• A buyer or successor — if we sell or restructure the business, subject to the same protections.

Providers acting on our instructions are processors under a written contract requiring them to keep the data secure and use it only as we direct.

09 International transfers

Some of our providers process data outside the UK. Where they do, we rely on one of:

• an adequacy decision for that country;
• the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
• another safeguard permitted by the UK GDPR,

together with a transfer risk assessment where required. Contact us at [privacy@zhomes.co.uk] for details of the safeguards for a specific transfer. [CONFIRM which providers transfer outside the UK — most US-based analytics, CDN and email tools do.]

10 How long we keep it

10.1 Product safety records. We keep records of which products went to which address so that we can act on a manufacturer recall or a safety notice — relevant for upholstered furniture, and for items such as tall units and wardrobes that must be secured to a wall. We rely on legal obligation and legitimate interests, and keep only what traceability requires. [CONFIRM the period with your insurer — 10 years is a common figure for furniture, but check.]

10.2 Where we no longer need identifiable data we delete it or anonymise it so it can no longer be linked to you.

11 Your rights

Under the UK GDPR you have the right to:

• Be informed — which this policy provides
• Access a copy of your personal data
• Rectify inaccurate or incomplete data
• Erase data, where we have no continuing basis to keep it (this is not absolute — we cannot delete records we must keep for tax or product-safety reasons)
• Restrict processing in certain circumstances
• Portability — receive data you gave us, in a machine-readable format
• Object to processing based on legitimate interests, and absolutely to direct marketing
• Withdraw consent at any time
• Not be subject to solely automated decisions producing legal or similarly significant effects — see 11.4

11.1 How to exercise them. Email [privacy@zhomes.co.uk] or write to the address in section 1.4.

11.2 What happens next. We respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. There is no fee unless a request is manifestly unfounded or excessive. We may ask for proof of identity before disclosing data.

11.3 Complaints. If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office:

11.4 Automated decisions. Payments and orders pass through automated fraud screening, and trade credit applications may involve automated scoring. These can result in an order or application being declined. You can ask for human review, express your point of view, and contest the decision by contacting us. We do not otherwise make solely automated decisions with legal or similarly significant effects, and we do not carry out profiling beyond what is described in this policy.

12 CCTV

We operate CCTV at our premises for the prevention and detection of crime and for the safety of staff, customers and stock, relying on legitimate interests. Signs are displayed. Footage is retained for [30] days and then overwritten, unless it is needed for an incident, insurance claim or police enquiry. To request footage of yourself, contact us at [privacy@zhomes.co.uk] with the date, time and location — we will redact other people where we can. [CONFIRM whether you operate CCTV at the unit. Customers attend it to collect, so if there are cameras this section applies and you need signage naming the operator with a contact. If there are no cameras, delete this section and the CCTV rows in sections 3, 5 and 10. If you record audio, say so here — audio recording is far harder to justify than video and the ICO expects a specific reason. Delete this section if you have no CCTV.]

13 Security

We use technical and organisational measures appropriate to the risk, including encryption in transit (TLS), access controls limiting staff access to what their role requires, secure hosting, and contractual obligations on our processors. We do not store full card numbers. No system is completely secure, but we take these obligations seriously, and we will notify you and the ICO of a personal data breach where the law requires it.

14 Changes to this policy

We may update this policy. The current version is always shown on this page with its effective date. Where changes are significant we will tell you by email or a notice on the site. Please check it from time to time.