Privacy Policy & Data Protection (UK GDPR)

In compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Last updated: November 2026.

1. Data Controller

The Data Controller responsible for processing personal data collected on this website is Thames Sanitary Care Ltd (Company No. 14982735, VAT No. GB 418 9275 30, Registered Office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom). For any privacy enquiry or Data Subject Access Request (DSAR), you can contact our Data Protection Officer at [email protected].

2. Personal Data We Collect & Purpose

We practise strict data minimisation and collect only the information necessary to fulfil your order and provide customer support:

Identity & Delivery Data: First name, last name, UK postal address, email address and mobile telephone number (used solely for Royal Mail / Evri parcel tracking updates).
Transaction Data: Selected product bundle, order total and payment confirmation status (payment card details are processed directly by PCI-DSS certified payment providers and are never stored on our servers).
Technical & Consent Data: Security logs and your cookie consent status (`fuugu_uk_cookie_consent_v1`).

3. Lawful Basis for Processing

Performance of a Contract (Article 6(1)(b) UK GDPR): Processing, dispatching and tracking your order, and administering our 60-Day Money-Back Guarantee.
Legal Obligation (Article 6(1)(c) UK GDPR): Retaining VAT invoices and accounting records as required by HM Revenue & Customs (HMRC).
Consent (Article 6(1)(a) UK GDPR): Optional non-essential analytics cookies, only when explicitly accepted via our cookie banner.

4. Data Sharing & Retention

We never sell, rent or trade your personal data to third parties. Data is shared strictly with our UK fulfilment partners (such as Royal Mail and Evri) and payment processors solely to complete your order. Order records are retained for 3 years for customer care purposes and archived in accordance with statutory HMRC tax retention periods.

5. Your Rights Under UK GDPR

Under the UK GDPR and Data Protection Act 2018, you have the right to access, rectify, erase, restrict or port your personal data, and to object to processing. You can exercise these rights at any time free of charge by emailing [email protected] or calling +44 800 048 9240. You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO) (www.ico.org.uk).