Privacy policy

Controller and information we use

COTHAM HARDWARE LIMITED is the controller for personal information collected through this shop. Contact us using the details below about privacy or a request to exercise your rights. An order request collects your name, email, optional telephone, address, postcode, region and any notes you choose to provide, together with the selected products and reference. A contact enquiry collects your name, email and message. Do not include special-category data or financial credentials.

Purposes and legal bases

We use request details to take steps at your request before a contract and, if accepted, to fulfil the order. We use enquiry information to answer you on the basis of our legitimate interest in providing customer support; where it relates to a purchase, contractual steps may also apply. Legal obligations may require records of accepted transactions. Essential session cookies support security, cart, checkout and confirmation. Optional preferences require consent. We do not use your request to subscribe you to marketing.

Recipients and transfers

Information is stored by the website hosting infrastructure and is accessible to authorised personnel handling enquiries and orders. Information needed for an accepted delivery may be shared with the delivery provider agreed during fulfilment. Professional advisers or authorities may receive data where legally necessary. We do not sell personal information. This site loads no third-party analytics, advertising pixels, embedded social feeds or remote fonts. If a future service requires an international transfer, we will provide appropriate information and safeguards before using it. We update this notice when our services or recipients change.

Retention and security

Unaccepted requests and contact enquiries are retained for up to 90 days from receipt. Accepted transaction records may be retained for six years from acceptance for accounting and legal claims; a documented legal hold can extend the relevant record only. Essential sessions expire after 14 days of inactivity; cookie preferences expire after 180 days. Records are stored outside the public site with restricted access. Deletion from any operational backup follows its rotation; a restored record must remain subject to the same retention rule.

Your rights and complaints

Depending on the circumstances you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. You may withdraw optional cookie consent at any time without affecting earlier lawful processing. We may need proportionate identity checks before disclosing information. We normally respond to a rights request within one month, explaining any lawful extension. You can complain to the UK Information Commissioner at ico.org.uk. Contacting us first is helpful but is not a condition of that right.

Contact