1. Who We Are

Lux Woodburners Ltd ("we", "us", "our") is the data controller responsible for your personal data. We are committed to protecting and respecting your privacy in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This Privacy Policy explains how we collect, use, store, share and protect your personal data when you visit our website at luxwoodburners.co.uk, contact us, visit our showrooms, or use our stove supply and installation services.

2. Information We Collect

We may collect and process the following categories of personal data:

3. How and Why We Use Your Data

We only process your personal data when we have a lawful basis to do so under the UK GDPR. The table below sets out our purposes for processing and the corresponding legal basis:

Where we rely on legitimate interests, we have carried out a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may request details of this assessment by contacting us.

4. Who We Share Your Data With

We do not sell, rent or trade your personal data to any third party. We may share your information only in the following circumstances:

• Service providers and data processors: third-party companies that help us operate our business and deliver our services (see Section 5 below). Each is bound by a data processing agreement and processes data only on our documented instructions.
• Professional advisers: accountants, solicitors and insurers as necessary for our business operations, under duties of confidentiality.
• Regulatory bodies and authorities: where required by law or regulation, including HMRC, local authority Building Control, and HETAS.
• Law enforcement: if required to do so by law or in response to valid legal process.

5. Third-Party Data Processors

The following third-party service providers act as data processors on our behalf. Each processes your data only on our instructions and is bound by appropriate contractual safeguards:

6. International Data Transfers

Some of our third-party service providers are based outside the United Kingdom. Where personal data is transferred to a country that the UK Secretary of State has not deemed to provide an adequate level of data protection, we ensure appropriate safeguards are in place, including:

• The UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses
• Standard Contractual Clauses as approved by the Information Commissioner's Office

You may request further details about the safeguards in place by contacting us.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. Our standard retention periods are:

When data is no longer required, it is securely deleted or anonymised so that it can no longer be associated with you.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures include:

• HTTPS (TLS) encryption for all data transmitted through our website
• Access controls restricting personal data to authorised personnel on a need-to-know basis
• Regular security assessments of our systems and third-party providers
• Spam and bot protection on our enquiry forms (reCAPTCHA, rate limiting, honeypot fields)

While we take all reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your personal data to the highest practicable standard.

9. Your Rights Under the UK GDPR

You have the following rights regarding your personal data. These rights are not absolute and may be subject to certain conditions:

• Right of access (Article 15): You have the right to request a copy of the personal data we hold about you, free of charge.
• Right to rectification (Article 16): You can ask us to correct any inaccurate or incomplete personal data.
• Right to erasure (Article 17): You can request that we delete your personal data in certain circumstances, for example where it is no longer necessary for the purpose it was collected.
• Right to restrict processing (Article 18): You can ask us to temporarily limit how we use your data while a concern is being investigated.
• Right to data portability (Article 20): You can request that we provide your personal data in a structured, commonly used and machine-readable format.
• Right to object (Article 21): You can object to processing based on legitimate interests. You have an absolute right to object to direct marketing at any time, and we will stop immediately upon receiving your request.
• Right to withdraw consent (Article 7): Where we process your data based on consent, you can withdraw that consent at any time by contacting us at info@luxwoodburners.co.uk. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Rights relating to automated decision-making (Article 22): You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not currently carry out any automated decision-making or profiling.

To exercise any of these rights, please contact us using the details in Section 13. We will respond within one calendar month. In exceptional circumstances we may extend this by a further two months, but we will inform you if this is necessary and explain why.

10. Children's Data

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately and we will take steps to delete it.

11. Complaints

We would appreciate the opportunity to address any concerns you may have before you approach the regulator. However, if you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or other factors. Any changes will be posted on this page with an updated "Last updated" date. Where changes are significant, we will take reasonable steps to notify you. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or want to make a complaint, please contact us: