Privacy Policy
Your data, handled properly
We collect the minimum we need to send you a rug. We never sell your data. We use industry-standard security. Last updated May 2026.
Encrypted
All data in transit is protected with SSL. Card details never stored — handled by Stripe / Shop Pay.
Never sold
We don't sell, rent, or trade your data. Ever. Not to anyone.
Your rights
Access, correct, delete — your data, your call. Email us to exercise any GDPR right.
1. Who we are
Rugs Factory Ltd is the controller of any personal data we collect through this website. We are registered with the UK Information Commissioner's Office.
2. What we collect
| Data | Why we collect it | How long we keep it |
|---|---|---|
| Name, address, phone | To deliver your order | 7 years (tax records) |
| Order updates + (optional) marketing | Until you ask us to delete | |
| Card details | To process payment | Never stored — handled by payment processor |
| Browsing data / cookies | Site analytics + cart functionality | 13 months max |
| Order history | To service your account + recommendations | 7 years |
3. How we use it
- To process and deliver your order
- To respond to your enquiries
- To send you marketing emails — only if you opt in at checkout or via the newsletter form
- To improve our website and product range based on anonymised usage data
- To prevent fraud and protect both you and us
4. Who we share it with
We share data only with the suppliers we need to fulfil your order:
| Supplier | Why |
|---|---|
| Royal Mail / DPD / Evri | Delivery |
| Stripe / Shopify Payments | Payment processing |
| Klaviyo / Mailchimp | Marketing emails (if opted in) |
| Google Analytics | Anonymised site analytics |
5. Cookies
This site uses cookies for:
- Essential: shopping cart, login, checkout (always on — required for the site to work)
- Analytics: Google Analytics, Shopify analytics (can be disabled in your browser)
- Marketing: Meta Pixel, Google Ads (only if you accept on the cookie banner)
You can manage cookie preferences through your browser settings or by clicking "Cookie preferences" in the footer.
6. Your rights (UK GDPR)
You have the following rights:
- Access — request a copy of all data we hold about you
- Rectification — correct anything that's wrong
- Erasure — ask us to delete your data ("right to be forgotten")
- Portability — receive your data in a machine-readable format
- Objection — opt out of marketing or specific processing
- Restriction — limit how we use your data
To exercise any of these rights, email help@rugsfactory.co.uk. We respond within 30 days as required by law.
7. Security
We use SSL encryption for all data in transit, secure storage for any data at rest, and never store full payment card details. Our payment processors (Stripe / Shop Pay) are PCI DSS compliant.
8. Children
Our website is not directed at children under 16. We do not knowingly collect data from minors. If you believe a minor has shared personal data with us, contact us and we'll delete it.
9. Changes to this policy
If we make material changes, we'll notify you by email and update the "last updated" date. Continued use of the site after changes means you accept the updated policy.
10. Contact & complaints
Questions about how we handle your data? Email help@rugsfactory.co.uk. If you're not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office at ico.org.uk.
Plain English, real security, no selling your data. That's our deal.