Data Retention Policy
What We Collect
We collect only the personal data needed to fulfil orders, respond to enquiries, and improve our service. We do not sell your data to third parties, and we do not use it for automated profiling or decision-making.
The table below sets out the categories of data we hold, how long we keep them, and the lawful basis under UK GDPR for doing so.
Retention Periods
| Category | Data Held | Retention Period | Lawful Basis |
|---|---|---|---|
| Customer accounts | Name, email address, hashed password | Duration of account, plus 2 years after last activity | Contract performance |
| Orders | Order details, delivery address, payment reference (no card data stored) | 7 years | Legal obligation (HMRC record-keeping) |
| Quote requests | Name, email, phone, product interest, budget range, notes | 2 years from submission | Legitimate interest |
| Product reviews | Review text, star rating, product slug | Duration of account; anonymised on account deletion | Legitimate interest |
| Contact & enquiry messages | Name, email, message content | 2 years | Legitimate interest |
| Newsletter subscriptions | Email address, subscription date | Until unsubscribed, plus 1 year | Consent |
| Wishlist | Saved product slugs linked to account | Duration of account | Contract performance |
| Web analytics | Anonymised page views, browser type, approximate country | 26 months (aggregated, no individual identifiers) | Legitimate interest |
Your Rights
Under UK GDPR you have the right to:
- AccessRequest a copy of the personal data we hold about you.
- RectificationAsk us to correct inaccurate or incomplete data.
- ErasureRequest deletion of your personal data where we have no overriding legal reason to retain it.
- RestrictionAsk us to pause processing while a dispute is resolved.
- PortabilityReceive your data in a machine-readable format (where processing is by automated means).
- ObjectionObject to processing based on legitimate interest, including direct marketing.
We will respond to all rights requests within one calendar month. In complex cases we may extend this to three months, and will notify you of the extension within the first month.
Data Export & Deletion
You can download a copy of your order history and account data at any time from your account page.
To request deletion of your account and all associated personal data, please email privacy@kenningtonupholstery.co.uk with the subject line Right to Erasure Request. We will process your request within 30 days. Please note that order records required for HMRC compliance (7-year retention) cannot be deleted before that period expires; all other identifiers will be removed or anonymised.
Contact & Complaints
For any data privacy enquiry, contact us at privacy@kenningtonupholstery.co.uk.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.
Last updated: March 2026