GDPR and Data Protection Policy

Prestige Shop Fronts is a trading style of Shutters and Shop Fronts Ltd. We are committed to protecting the privacy, security and personal information of our customers, prospective customers, website visitors, suppliers and business contacts.

This GDPR and Data Protection Policy explains how we collect, use, store, share and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We aim to handle all personal information fairly, lawfully and transparently.

1. Data controller

Prestige Shop Fronts is a trading style of Shutters and Shop Fronts Ltd.

Our business details are:

Company name: Shutters and Shop Fronts Ltd
Trading name: Prestige Shop Fronts
Business address: 23 Manby Street, Tipton, DY4 9NG
Company registration number: 09357473
Country: United Kingdom

Shutters and Shop Fronts Ltd is the data controller responsible for deciding how and why personal data is collected and processed.

Throughout this policy, "we", "us" and "our" refer to Prestige Shop Fronts and Shutters and Shop Fronts Ltd.

2. What is personal data?

Personal data is any information that identifies an individual or could identify them when combined with other information.

Depending on how you interact with our business, personal data may include:

Full name.
Email address.
Telephone number.
Postcode.
Residential or business address.
Company or business details.
Enquiry information.
Quotation and order details.
Correspondence and communications.
Information relating to a project or installation.
Website usage information.
IP address and device information, where collected.

We only collect personal data that is reasonably necessary for our business activities and the services we provide.

3. How we collect personal data

We may collect personal data when you:

Complete a contact form on our website.
Request a quotation.
Contact us by email.
Contact us by telephone.
Arrange a site visit or consultation.
Request information about our services.
Purchase our products or services.
Enter into a contract with us.
Communicate with us about an existing or potential project.

We may also collect limited technical information automatically when you visit our website through cookies and similar technologies.

4. Why we process personal data

We process personal data for legitimate business purposes, including:

Responding to customer enquiries.
Preparing and providing quotations.
Arranging consultations and site visits.
Providing shopfront and shutter installation, replacement and repair services.
Managing orders and projects.
Communicating with customers and prospective customers.
Processing payments.
Maintaining business and financial records.
Providing customer support.
Managing complaints and resolving issues.
Improving our website and services.
Protecting our website and business systems.
Preventing fraud and misuse.
Complying with legal and regulatory obligations.

We do not knowingly use personal data for purposes that are incompatible with the reason it was originally collected unless we have a lawful basis for doing so.

5. Lawful bases for processing

The UK GDPR requires us to have a lawful basis before processing personal data.

Depending on the circumstances, we may rely on the following lawful bases.

Consent

We may process personal data where you have given us clear permission to do so.

For example, this may include receiving certain marketing communications or allowing non-essential cookies to operate on your device.

You can withdraw your consent at any time.

Contractual necessity

We may process personal data where it is necessary to take steps at your request before entering into a contract or to perform an existing contract.

For example, we may need your name, contact details and property information to prepare a quotation, arrange a site visit or provide an agreed service.

Legal obligation

We may process personal data where necessary to comply with legal or regulatory obligations.

For example, this may include maintaining financial, accounting and tax records.

Legitimate interests

We may process personal data where this is necessary for our legitimate business interests, provided those interests do not override your fundamental rights and freedoms.

These interests may include responding to enquiries, managing customer relationships, administering our business, maintaining website security and improving our services.

Vital interests

In limited circumstances, we may process personal data where necessary to protect someone's vital interests, such as protecting their life or preventing serious harm.

6. Data minimisation

We aim to collect only the personal data reasonably necessary for the purpose for which it is required.

We do not routinely collect special category personal data through our website.

Where additional information is required to provide a service, we will explain why it is needed where appropriate.

7. Accuracy of personal data

We take reasonable steps to ensure that the personal data we hold is accurate, complete and up to date.

If your personal information changes, please contact us so that we can update our records.

You can request the correction of inaccurate or incomplete personal data at any time.

8. How we protect personal data

We use appropriate technical and organisational measures to protect personal data against:

Unauthorised access.
Accidental loss.
Destruction.
Unauthorised disclosure.
Alteration.
Misuse.

Access to personal data is restricted to individuals who reasonably need it to perform their work or provide our services.

We regularly consider the security measures required to protect the information we hold.

However, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security.

9. Sharing personal data

We do not sell, rent or trade personal data.

We may share personal data with trusted third parties where necessary to provide our services, operate our business or comply with legal obligations.

These organisations may include:

Website hosting providers.
IT and website service providers.
Email and communication providers.
Website analytics providers.
Payment processing providers.
Accountants.
Professional advisers.
Contractors and suppliers.
Delivery and installation partners.
Government departments and regulatory bodies.
Law enforcement agencies where legally required.

We only share personal information where there is an appropriate lawful basis.

Where a third party processes personal data on our behalf, we take reasonable steps to ensure that appropriate data protection agreements and security measures are in place.

10. International data transfers

Some of our third-party service providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, we will ensure that an appropriate legal mechanism and suitable safeguards are in place where required by UK data protection legislation.

These safeguards may include UK adequacy regulations or approved international data transfer agreements, where applicable.

11. Data retention

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected.

The length of time we retain information depends on its purpose and any applicable legal, accounting or regulatory requirements.

Customer, quotation, financial and contractual records may be retained for longer where necessary to comply with legal obligations or protect our legitimate business interests.

When personal data is no longer required, we will take reasonable steps to securely delete or anonymise it.

12. Your rights under the UK GDPR

Under UK data protection legislation, you have several rights regarding the personal data we hold about you.

Subject to certain legal conditions and exemptions, these include:

Right of access

You can request a copy of the personal data we hold about you.

Right to rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to erasure

You can request the deletion of your personal data in certain circumstances.

Right to restrict processing

You can ask us to restrict how we use your personal data in certain circumstances.

Right to data portability

In certain circumstances, you can request your personal data in a structured, commonly used and machine-readable format.

Right to object

You can object to certain types of processing, including processing based on legitimate interests.

You also have an absolute right to object to the processing of your personal data for direct marketing.

Right to withdraw consent

Where we rely on consent to process personal data, you can withdraw that consent at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

13. Making a data protection request

If you wish to exercise any of your data protection rights, please contact us using the details below.

Prestige Shop Fronts
Trading style of Shutters and Shop Fronts Ltd
23 Manby Street
Tipton
DY4 9NG
United Kingdom

Please provide enough information for us to identify you and understand your request.

We may request additional information to verify your identity before releasing, correcting or deleting personal data.

We will normally respond to valid requests within one month of receiving the request. This period may be extended by up to two further months where legally permitted, depending on the complexity or number of requests.

We will explain if an extension is necessary.

14. Direct marketing

We may use personal data to communicate with existing customers and prospective customers about our products and services where we have a lawful basis to do so.

Where consent is required for electronic marketing communications, we will obtain consent before sending marketing messages.

You can opt out of marketing communications at any time by contacting us or following the unsubscribe instructions provided in our communications.

You can also object to direct marketing at any time. Once you do, we will stop processing your personal data for this purpose.

Opting out of marketing will not affect essential communications relating to an existing enquiry, quotation, contract or service.

15. Cookies and online tracking

Our website may use cookies and similar technologies to support website functionality and understand how visitors interact with our website.

Some cookies are essential for the website to operate correctly. Other cookies may support analytics, functionality or marketing activities.

Where required by law, we will obtain your consent before using non-essential cookies.

You can manage cookies through your browser settings and, where available, our website cookie consent mechanism.

Disabling certain cookies may affect the functionality of parts of our website.

Further information about cookies and their use is provided in our Privacy Policy.

16. Personal data breaches

A personal data breach occurs when personal data is accidentally or unlawfully lost, destroyed, altered, disclosed or accessed without authorisation.

If we become aware of a personal data breach, we will assess the incident, investigate its cause and take appropriate steps to reduce any potential harm.

Where required by UK GDPR, we will notify the Information Commissioner's Office within 72 hours of becoming aware of a reportable breach.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify those individuals without undue delay where required by law.

17. Data processors

We may use third-party organisations to process personal data on our behalf.

Where a third party acts as a data processor, we take reasonable steps to ensure that appropriate data protection arrangements are in place.

These arrangements include requirements for processors to:

Implement appropriate technical and organisational security measures.
Process personal data only in accordance with our documented instructions.
Maintain confidentiality.
Protect personal data against unauthorised access and disclosure.
Use additional processors only where appropriately authorised.
Assist us with relevant data protection obligations where required.
Delete or return personal data when the processing arrangement ends, where applicable.

We take reasonable steps to ensure that third-party processors handle personal data securely and lawfully.

18. Children's personal data

Our products and services are primarily intended for businesses, property owners and adults.

We do not knowingly collect personal data from children through our website for marketing purposes.

If you believe that a child has provided personal data to us, please contact us so that we can investigate and take appropriate action.

19. Automated decision-making

We do not intend to use personal data collected through this website to make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

If our approach to automated decision-making changes, we will update this policy and provide any information required by applicable data protection legislation.

20. Third-party websites

Our website may contain links to external websites operated by third parties.

We are not responsible for how external websites collect, use, store or protect personal data.

Third-party websites operate under their own privacy policies and data protection practices.

We recommend reviewing the privacy and cookie policies of external websites before submitting personal information.

21. Complaints

If you have concerns about how we collect, use or protect your personal data, please contact us first so that we can investigate and attempt to resolve your concerns.

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe that your personal data has not been handled in accordance with applicable data protection legislation.

The ICO is the UK's independent supervisory authority for data protection.

You can find further information or submit a complaint through its website:

https://ico.org.uk/

22. Changes to this policy

We may update this GDPR and Data Protection Policy from time to time to reflect changes to our business practices, website, technology or legal obligations.

The latest version will be published on our website.

The date at the top of this policy shows when it was most recently updated.

We recommend reviewing this policy periodically to remain informed about how we protect personal data.

23. Contact details

If you have questions about this policy, wish to exercise your data protection rights or require further information about how we process personal data, please contact us through the enquiry form on our website.

Alternatively, you can write to us at: