Privacy Policy

Controller: Globaltopz UK Limited (registered in England and Wales, company number 04701546). Website: globaltopz-online.co.uk

Contents

• Contact details
• What information we collect, use, and why
• Lawful bases and your data protection rights
• Where we get personal information from
• How long we keep information
• Who we share information with
• Sharing information outside the UK
• Cookies and similar technologies
• Children's data
• Automated decision-making
• Changes to this notice
• How to complain

Contact details

Telephone: 01442 877600
Email: info@globaltopz.co.uk

What information we collect, use, and why

Providing services and goods, including delivery:

• Names and contact details
• Addresses
• Purchase or account history
• Payment details (including card or bank information for transfers and direct debits)
• Account information
• Website user information (including user journeys and cookie tracking)
• Records of meetings and decisions
• Information relating to compliments or complaints
• Kitchen plans, drawings, measurements and supporting photographs that you upload to your quote

Operation of customer accounts and guarantees:

• Names and contact details
• Addresses
• Payment details (including card or bank information for transfers and direct debits)
• Purchase history
• Account information, including registration details
• Marketing preferences

Service updates or marketing purposes:

• Names and contact details
• Addresses
• Marketing preferences
• Location data
• Recorded images, such as photos or videos
• Purchase or viewing history
• IP addresses
• Website and app user journey information
• Records of consent, where appropriate

Complying with legal requirements:

• Name
• Contact information
• Financial transaction information

Dealing with queries, complaints or claims:

• Names and contact details
• Address
• Payment details
• Account information
• Purchase or service history
• Video recordings of private or staff only areas
• Customer or client accounts and records
• Financial transaction information
• Correspondence

Analytics and website improvement:

• Purchase or account history
• Customer or client accounts and records
• Purchase or viewing history
• IP addresses
• Device and browser information
• Website and app user journey information
• Records of consent, where appropriate

Free samples fulfilment:

• Names and contact details
• Delivery addresses
• Sample request details (product, finish, colour)
• Marketing preferences (where you opt in to follow-up)
• Records of consent, where appropriate

Showroom visits, measure-up and installation appointments:

• Names and contact details
• Property and site addresses
• Appointment scheduling information
• Kitchen / installation specifications, measurements and supporting photographs
• Correspondence with our fabricators and installers

Trade and B2B account management:

• Business name and trading address
• Names and contact details of authorised representatives
• VAT number and Companies House information
• Trade account registration and credit-check information
• Purchase and order history
• Account communications

Lawful bases and your data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.

If you are located in the European Economic Area, the EU General Data Protection Regulation (EU GDPR) also applies to our processing of your personal information because we offer goods and services to people in the EU. The lawful bases, rights and safeguards described in this notice apply equivalently under the EU GDPR. You can complain to your local supervisory authority as well as to the UK Information Commissioner's Office — see How to complain below.

Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:

• Your right of access — you have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for.
• Your right to rectification — you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
• Your right to erasure — you have the right to ask us to delete your personal information.
• Your right to restriction of processing — you have the right to ask us to limit how we can use your personal information.
• Your right to object to processing — you have the right to object to the processing of your personal data.
• Your right to object to direct marketing— you have an absolute right to ask us to stop using your personal information for direct marketing at any time, including when we rely on legitimate interests or the PECR soft opt-in. We will always stop sending you direct marketing as soon as you ask us to. You can use the unsubscribe link in any marketing email, reply “STOP” to a marketing SMS, or contact us using the details at the top of this notice.
• Your right to data portability — you have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
• Your right to withdraw consent — when we use consent as our lawful basis you have the right to withdraw your consent at any time. You can change your cookie preferences at any time using the cookie preferences control on our website (see the Cookies section below).

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

Our lawful bases for providing services and goods

• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests— we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • fulfilling the orders, samples and quotes you ask us for and keeping records of those interactions;
  • administering guarantees, warranties and after-sales support over the lifetime of an installation;
  • recovering unpaid amounts and defending claims;
  • preventing and detecting fraud or other criminal activity affecting our customers, our suppliers or us.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for operating customer accounts and guarantees

• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for service updates or marketing

• Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
• Legitimate interests— we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • promoting our products and services to existing customers and to people who have asked us for a quote or a sample, in line with the ICO's soft opt-in guidance under PECR;
  • measuring whether our marketing is reaching the right audiences and improving the campaigns we run.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for complying with legal requirements

• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.

Our lawful bases for dealing with queries, complaints or claims

• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests— we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • investigating complaints and resolving them fairly;
  • defending or pursuing legal claims;
  • improving our service quality and training our team based on feedback received.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for analytics and website improvement

We operate two layers of website analytics, with different lawful bases:

• Consent— for analytics that rely on cookies or other identifiers that can recognise you across visits (such as our product analytics, session recordings, and advertising measurement). We only process this data after you accept the relevant category in our cookie banner. All of your data protection rights may apply, except the right to object — you have the right to withdraw your consent at any time.
• Legitimate interests— we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. We rely on this for cookieless, aggregate analytics that do not set cookies on your device and that do not build a profile capable of identifying you. You can object to this processing at any time using the contact details at the top of this notice. All of your data protection rights may apply, except the right to portability. Our legitimate interest is:
  • understanding overall site usage and detecting problems even when a visitor has declined optional cookies.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for free samples fulfilment

• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests— we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • following up reasonably with people who have asked for a sample to see if they want a quote, subject to PECR soft opt-in;
  • monitoring sample-to-quote conversion to make sure samples are being used fairly and not in a way that abuses the free offer.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for showroom visits, measure-up and installation appointments

• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legitimate interests— we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • scheduling and rescheduling visits efficiently, including planning routes for our fabricators and installers;
  • keeping records of installation conditions and measurements so we can support guarantee claims after the work is done.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Our lawful bases for trade and B2B account management

• Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
• Legal obligation — we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
• Legitimate interests— we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
  • verifying that trade applicants are bona fide businesses (including Companies House and VAT checks);
  • managing the credit position of trade accounts and preventing credit losses;
  • keeping records of trade communications so we can support trade customers consistently.

For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.

Where we get personal information from

• Directly from you (for example when you request a quote, sample or appointment, place an order or contact us)
• From our suppliers, fabricators, installers and other service providers when they perform services on our behalf
• From publicly available sources such as Companies House, the VAT register and trade directories (for trade and B2B account vetting)
• From Meta and Google, in respect of advertising audiences and conversion events you trigger on their platforms

How long we keep information

We keep your personal information for as long as we need it for the purpose we collected it for, and for any period required by law. The table below sets out the main retention periods we apply.

If you would like more information on how long we store a specific type of personal information or the criteria we use to determine this, please contact us using the details provided above.

Who we share information with

Joint data controllers

We have a joint controller relationship with Meta Platforms Ireland Limited. We use the Meta Pixel and related Meta business tools on our website to measure the effectiveness of our advertising, build audiences for future advertising campaigns and analyse how visitors interact with our site. When a visitor arrives on our website (and has accepted marketing cookies), the Meta Pixel collects information such as the pages visited, actions taken (for example, submitting a quote request), browser and device information, and IP address, and transmits this to Meta. In addition, when you submit a quote request and have accepted marketing cookies, our server also sends a corresponding server-side conversion event to Meta. That event contains a de-identified copy of certain contact details you provided (such as a hashed version of your email and phone number) together with technical signals about your visit. We send this server-side event so the conversion can still be measured if the browser-side pixel is blocked by an ad blocker or a privacy browser. Under Meta's Controller Addendum, we and Meta act as joint controllers for the collection and transmission of this personal data from our website and our server to Meta. Once the data reaches Meta, Meta becomes the sole controller for any further processing, including for its own advertising, analytics and product-development purposes. The allocation of responsibilities between us and Meta is set out in Meta's Controller Addendum, which forms part of our agreement with Meta.

We also have a joint controller relationship with Google Ireland Limited. We use Google Ads and Google's conversion tracking, remarketing and audience tools on our website to measure advertising performance, retarget visitors with relevant ads and build similar audiences for future campaigns. When a visitor arrives on our website, Google's tags collect information such as the pages visited, conversion events (for example, submitting a quote request), browser and device information, and IP address. For certain Google Ads features — including audience measurement, remarketing and the use of the EU User Consent data — we and Google Ireland Limited act as joint controllers in respect of the collection and transfer of personal data from our website to Google. The allocation of responsibilities between us and Google is set out in Google's Ads Data Processing Terms and Controller-Controller Data Protection Terms. We deliver Google's tags through Google Tag Manager, which loads on every page; the individual marketing and measurement tags inside the container fire only after you give the relevant cookie consent.

Data processors

The following organisations process personal data on our behalf. Each row shows what they do for us, where the data sits, and the safeguard that applies when personal information is transferred outside the UK. To obtain a copy of any of the safeguards referred to below, please contact us using the details at the top of this notice.

Others we share personal information with

• Professional or legal advisors
• Relevant regulatory authorities (including the ICO and HMRC)
• Organisations we're legally obliged to share personal information with
• Suppliers, fabricators, installers and other service providers performing services on our behalf
• Courier and delivery partners, for shipping samples and worktops
• Trade and credit reference agencies, in connection with trade account applications

Sharing information outside the UK

Where necessary, we will transfer personal information outside of the UK. When doing so, we comply with the UK GDPR, making sure appropriate safeguards are in place.

Transfer details for our data processors are shown alongside each provider in the Data processors table above. The transfers we make as a joint controller are described below. To obtain a copy of any of the safeguards referred to in either place, please contact us using the contact information provided at the top of this notice.

Meta Platforms Ireland Limited (with onward transfer to Meta Platforms, Inc.)

• Category of recipient: online advertising and social media platform
• Country the personal information is sent to: Ireland (EEA), with onward transfer to the United States
• Safeguard: UK adequacy / UK Data Bridge (UK Extension to the EU-US Data Privacy Framework) for the US onward transfer

Google Ireland Limited(with onward transfer to Google LLC) — Ads

• Category of recipient: online advertising and analytics platform
• Country the personal information is sent to: Ireland (EEA), with onward transfer to the United States
• Safeguard: UK adequacy / UK Data Bridge (UK Extension to the EU-US Data Privacy Framework) for the US onward transfer

Cookies and similar technologies

Our website uses cookies and similar technologies (such as browser storage and pixel images) to make the site work and, where you agree, to measure how it is used and how our advertising performs. We group them into four categories. The first time you visit our website you will see a cookie banner asking which categories you accept; you can change or withdraw your consent at any time (see “Managing your cookie preferences” below).

Some pages also embed content from third parties — for example, a Google Reviews widget provided by Elfsight, and links to our consultation booking form on Typeform. When that content loads (or you follow a link to it), the third party may set its own cookies on its own domain. Their use of cookies is governed by their own privacy notices.

Cookieless analytics

We also use a small amount of cookieless analytics that does not set or read any cookies, and does not store anything in your browser. Whatever you choose in our cookie banner, we may still measure aggregate signals such as page views, country, device type and referrer in a non-identifying form. To do this we briefly process technical information such as your IP address and user-agent on our servers and turn them into a short-lived, daily-rotating hashed counter; we do not build a profile that can identify you, and we do not link these signals to your name or contact details. Our lawful basis for this is legitimate interests in understanding overall site usage and detecting problems. You can object to this processing at any time using the contact details at the top of this notice.

Managing your cookie preferences

You can change or withdraw your consent at any time using the cookie preferences control on our website (look for the small consent icon on the page, or follow any “Cookie preferences” link in our footer if one is available), or by clearing the consent cookie in your browser settings. You can also block or delete cookies using your browser's settings, but blocking strictly necessary cookies may stop parts of the site from working. Any cookies that have already been set before you change your choice will remain on your device until they expire or you delete them, but we will stop sending the related events to our analytics and advertising partners.

Children's data

Our services are aimed at adults and businesses. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Automated decision-making

We do not make decisions that produce legal effects, or similarly significant effects, about you solely by automated means. Some elements of our service (such as quote calculators and online price estimates) use automated calculations to give you an indicative price, but the final quote and any contract are always reviewed by a person.

Changes to this notice

We may update this privacy notice from time to time to reflect changes in our services, our processors, the law or regulatory guidance. When we do, we will update the “Last updated” date at the top of this notice and, if the changes are material, we will draw them to your attention by another suitable means.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.

If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the Information Commissioner's Office (ICO).

Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint

If you are based in the European Economic Area, you can complain to the data protection supervisory authority in the EU country where you live, work, or where the alleged infringement took place. A list of national data protection authorities is published by the European Data Protection Board at edpb.europa.eu/about-edpb/about-edpb/members_en.