Privacy Policy

Who Is Responsible for Your Data

Kennington Upholstery Ltd is the controller of the personal data described in this notice. You can contact us at Gower Mews, near Tottenham Court Road, London WC1E 6HP, or by emailing privacy@kenningtonupholstery.com.

Information We Collect

Depending on how you use the site, we may collect:

• contact, project, delivery, uploaded-image, quote, order, account, payment-reference, review, and correspondence information you give us;
• technical and security information needed to operate the site, such as request time, truncated or security-filtered network information, and fraud-prevention signals; and
• if you choose the relevant optional settings, pseudonymous page, interaction, experiment, campaign, device-class, and broad service-interest information. We do not put your name, email address, telephone number, quote text, or uploaded photographs into the growth analytics records.

Why We Use It

We use information to answer enquiries, prepare and administer quotes, fulfil orders, take payment, provide accounts and customer support, keep business and tax records, protect the service, and send marketing only where permitted. Our lawful bases depend on the activity: taking steps at your request or performing a contract, complying with legal obligations, our legitimate interests in operating and securing the business, and your consent for optional analytics, experiments, personalisation, or marketing storage.

Analytics, Experiments, and Personalisation

Optional analytics and homepage experiments run only after you actively choose analytics and experiments. A random browser identifier is converted into a one-way, secret-keyed visitor key before it is stored in our growth database. Experiment assignment is stable for that browser, and successful quote submissions are recorded against an opaque quote identifier so that we can compare versions accurately.

Optional personalisation requires analytics consent plus a separate personalisation choice. It may use several recent interactions to infer a broad interest such as sofas, armchairs, restoration, commercial work, or fabrics. It changes approved homepage content only. It never changes prices, eligibility, service availability, or how we respond to a quote, and it does not make a legal or similarly significant decision about you. A holdout group continues to see the general page so we can measure whether personalisation is useful.

How AI Supports the Programme

The growth system can use the configured AI provider, currently Google Vertex AI, to propose a bounded homepage candidate from aggregate counts and rates when the reviewed challenger queue eventually needs replenishing. It is not sent names, contact details, message or quote text, uploaded images, full URLs, individual browsing histories, or raw visitor identifiers. Candidate content is restricted to an approved schema and operational rules. AI never allocates traffic or chooses a winner: fresh production checks control launch, and a fixed statistical policy independently revalidated by the database controls promotion. It does not decide prices, customer eligibility, or the outcome of an enquiry. The feature remains subject to independent operational, consent, emergency-control, and programme authorisation gates.

Cookies and Similar Storage

Necessary storage supports security, consent choices, accounts, baskets, and core functions. Optional analytics/experiments, marketing, and personalisation storage is off until you make a choice. You can reject optional storage as easily as you accept it, choose categories individually, and reopen Cookie Preferences from the footer to withdraw or change your choice. Withdrawing consent stops future optional collection and removes the growth browser identifier and interest profile where supported. Google's tag runs with optional storage and advertising user data denied by default and can send limited cookieless requests for aggregate advertising and site measurement. Successful forms include only an opaque transaction identifier in those denied-storage conversion requests. Names, email addresses, telephone numbers, form text, and uploaded photographs are excluded unless marketing consent permits enhanced conversion contact data. See our Cookie and Storage Notice for category and provider details.

Google Maps and Business Profile Reviews

Our saved workshop details and dated review snapshot are served by us and do not contact Google. The interactive map is embedded directly on pages that display it and may connect to Google when the page loads. The live Google review panel connects only when it is near your viewport and you have allowed marketing services, or when you deliberately request the reviews.

When the live feature connects, Google can receive technical information such as your IP address, browser and device information, page referrer, and your interaction with the map or review panel. Google may use cookies or similar browser storage and may process information outside the UK under its own safeguards. See the Google Privacy Policy and Google Maps Platform Terms. Withdrawing marketing consent prevents future automatic loading of live reviews; the embedded workshop map remains available on pages that display it. Information Google has already received remains subject to its policies.

Who We Share Data With

We do not sell personal data. We use service providers only where needed to run the business, including website and database hosting, email and file delivery, payment processing (including Stripe), operational support, and security. Google receives the limited cookieless measurement requests described above while optional storage remains denied. If you consent to the relevant category, sharing can also include PostHog EU for analytics and experiments, Google enhanced conversion measurement, and Google or Meta advertising storage. OpenAI receives only the aggregate growth brief described above.

Google receives the technical information described above when a page loads its embedded map, or if you explicitly request a live review panel, even when marketing consent is otherwise off.

Some providers may process data outside the UK. Where this happens, we use the provider's applicable contractual and transfer safeguards and assess them before enabling the service.

Retention and Security

We keep each category only for its documented period and then delete or anonymise it, unless a legal claim or obligation requires longer retention. The growth service automatically expires short-lived event and profile records. Our Data Retention Policy gives the periods. We use access controls, signed consent records, restricted identifiers, encryption in transit, input validation, and audit logs appropriate to the information and service.

Your Rights

Under UK data protection law, you may have rights to access, rectify, erase, restrict, or receive your personal data, and to object to particular processing. Where processing relies on consent, you can withdraw it at any time without affecting processing already carried out lawfully. Rights can be limited where an exemption or overriding legal requirement applies. Email privacy@kenningtonupholstery.com to make a request; we normally respond within one calendar month.

Questions and Complaints

Contact us at privacy@kenningtonupholstery.com or 020 7096 0101. You can also complain to the Information Commissioner's Office.