Privacy Policy

Information collected

• Enquiry details, including your name, email address, telephone number, country, postcode, message and the product or project you ask about.
• Order and delivery details, including your name, contact details, delivery address, delivery notes, ordered items and selected options.
• Payment references, Checkout Session identifiers, payment status and receipt details supplied by Stripe. We do not receive or store your full card details.
• Limited technical and security information, such as request timing, one-time form tokens and shortened or hashed network identifiers used to prevent abuse, together with ordinary hosting logs.
• Basket and cookie-consent preferences stored in your browser, and analytics information only if optional analytics is introduced and you consent.

Why information is used

• To respond to enquiries and take steps you request before entering a contract.
• To process, make, deliver and support an order, and to keep a record of the contract.
• To take payment through Stripe and send transactional email through Resend.
• To meet accounting, tax, consumer-law and other legal obligations.
• For legitimate interests in securing the website, preventing fraud, resolving complaints and improving customer service, where those interests do not override your rights.
• On the basis of consent for any optional analytics. Consent can be withdrawn at any time through Cookie Settings.

Who receives information

Information is shared only where needed to operate the business, fulfil an order or comply with law.

• Vercel provides website hosting and associated infrastructure.
• Payload CMS and Neon provide the content-management and database services used for enquiries and orders.
• Stripe processes payments and hosts secure Checkout.
• Resend sends enquiry, order and service emails.
• Delivery providers receive the details needed to arrange delivery. Professional advisers, insurers or public authorities may receive information where reasonably necessary or legally required.

International transfers

Some service providers may process information outside the United Kingdom. Where this happens, we rely on the provider's lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and appropriate security measures.

Retention and security

Reasonable technical and organisational safeguards are used, but no internet service can guarantee absolute security.

• Abandoned, failed or incomplete checkout records are normally deleted after 30 days.
• Enquiries that do not become a contract are normally deleted 24 months after the last activity.
• Enquiries forming part of a contract and paid transaction records are normally retained for seven years for legal, tax and accounting purposes.
• Browser basket data expires after 30 days of inactivity and a cookie preference expires after six months.

Your rights

Depending on the circumstances, you may ask for access to, correction of, deletion of or restriction of your information, object to certain uses, ask for portable information, or withdraw consent. Some rights are limited where information must be kept for a contract or legal obligation.

• To exercise a right, email neil@neilbespokefurniture.co.uk. We may need to verify your identity.
• You can complain to the Information Commissioner's Office at ico.org.uk, although we would appreciate the opportunity to address your concern first.

Other information

We do not sell personal information or use it for automated decisions that produce legal or similarly significant effects.