1. Controller and contact details
Cartonnex Limited is the controller of the personal information covered by this policy. We are a company registered in England and Wales under company number 16815502. Our registered office is Unit 16 Enterprise Way, Cheltenham Trade Park, Cheltenham, England, GL51 8LZ.
For privacy questions, rights requests or data protection complaints, email tashan@cartonnex.co.uk, use our contact form, or write to the registered office above.
2. Information we collect and where it comes from
| Information | Typical source | Why it is needed |
|---|---|---|
| Name, business contact details, company, job role, subject, project requirements, product interests and correspondence. | You, your organisation, an adviser or project partner. | To identify you, respond, understand a brief and prepare or administer a quotation. |
| Delivery, invoicing, specification, site-contact, order and payment records where an enquiry progresses. | You, your organisation, suppliers, contractors and professional advisers involved in the project. | To plan and perform agreed work, maintain accounts and handle project issues. |
| IP address, browser and device information, requested URL, date and time, and security events. | Web server, hosting and security systems. | To deliver, secure and troubleshoot the website. The theme uses the visitor address only to create a salted rate-limit token that expires after one minute; it does not add the address to the enquiry email. |
| Business contact information from public professional sources. | Company websites, business directories and other lawful public sources. | To verify a business contact or communicate about a relevant existing or prospective commercial relationship. |
The enquiry form requires a name, email address, subject and message so that we can understand and respond. Company, telephone and product-interest fields are optional. Please do not send passwords, payment-card details, special-category information or other unnecessary sensitive material through the form. This business website is not directed at children, and we do not knowingly seek children’s information through it.
3. Purposes and lawful bases
We process enquiry and project information to respond, take requested steps before a possible contract, prepare quotations, perform agreed work, administer customer and supplier relationships, maintain business records, handle rights requests or complaints, protect the website, and comply with legal obligations.
The relevant lawful basis depends on the context. It will normally be: steps requested before entering a contract; performance of a contract; compliance with a legal obligation; or our legitimate interests in operating a commercial furniture business, answering proportionate business enquiries, managing records, preventing misuse and protecting systems. We balance legitimate interests against the rights and reasonable expectations of the people concerned.
The form’s short privacy notice is an acknowledgement of this information, not consent to marketing. We do not use enquiry details for unrelated electronic marketing without a separate lawful basis and any permission required by the Privacy and Electronic Communications Regulations. We do not sell personal information and do not use the form for solely automated decisions that have legal or similarly significant effects.
When you submit the form, WordPress validates and sanitises the fields and sends the contents by email to Cartonnex. The supplied theme does not intentionally store the enquiry message as a WordPress database record. Hosting, security, backup and email systems may still process connection logs and message copies as part of delivering and protecting the service.
5. How long we keep information
We keep personal information only for as long as it is reasonably needed for the stated purpose and any legal, accounting or dispute requirements. Our normal working periods are:
- the salted form rate-limit token expires after one minute;
- a routine enquiry that does not progress is normally deleted within 24 months of the last substantive contact;
- quotation, customer, supplier and project records are normally kept for the relationship and up to six years afterwards where needed for contracts, claims and accountability;
- financial and transaction records are normally kept for six years after the relevant accounting period or transaction, unless a longer period is legally required; and
- rights-request and data-protection-complaint records are normally kept for three years after closure, or longer where a live claim, regulatory matter or legal duty requires it.
Technical, security, email and backup records follow the shortest provider schedule reasonably needed to deliver, secure and recover the service. At the end of the applicable period, information is deleted, anonymised or allowed to roll out of protected backups unless it must be preserved for a defined legal reason.
6. Your data protection rights
Depending on the circumstances, you may ask for access to your personal information, correction of inaccurate or incomplete information, erasure, restriction, objection to processing, or portability of certain information. You may object at any time to direct marketing. Where processing genuinely relies on consent, you may withdraw that consent without affecting earlier lawful processing.
We may ask for proportionate information to confirm identity and locate the relevant records, particularly where disclosure could expose another person’s information. Rights are qualified by law and do not apply in every situation. We will respond within the period required by applicable data protection law and explain any lawful limitation.
7. Data protection complaints
You can make a data protection complaint by emailing tashan@cartonnex.co.uk, writing to our registered office, or using the contact form and selecting “Data protection complaint / rights request”. Please explain what happened, when it happened, the information concerned and the outcome you are seeking. Do not include more personal information than is needed.
We will acknowledge a data protection complaint within 30 days. Without undue delay, we will make appropriate enquiries, keep you informed where the investigation continues, and tell you the outcome. You may complain to the Information Commissioner’s Office using the ICO’s complaint service. We would welcome the opportunity to investigate your concern directly, but this does not remove your right to contact the ICO.
8. Security, cookies and policy changes
We use proportionate organisational and technical measures intended to protect information against unauthorised access, loss, alteration or disclosure. These include access controls, maintained software, secure hosting and careful use of email and service providers. No internet service can be guaranteed completely secure. Suspected incidents are contained, documented and assessed, and we notify the ICO or affected people where the law requires it.
Read our Cookie Policy for the current use of cookies, similar technologies and the optional Google Map. External websites apply their own privacy terms.
We review this notice when our processing, providers or legal obligations change. Material new uses will be explained before they begin where required. Questions can be sent to tashan@cartonnex.co.uk.