Privacy Policy

Data Protection & Privacy · Orchard Home Interiors

Last updated: 26 August 2026

1. Introduction and Scope

This Privacy Policy describes how Orchard Home Interiors Ltd ("we," "our," or "us") collects, uses, shares, and protects your personal information when you visit our website, make purchases, or interact with our services.

We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By using our website, you acknowledge that you have read and understood this policy.

2. Information We Collect

Personal Information: Name, email, telephone number, billing and delivery address, and payment details.

Business Information: Business name, VAT number, and compliance-related data where applicable.

Technical Information: IP address, browser, device information, pages visited, and timestamps.

Communication Data: Records of emails, telephone calls, and support interactions.

3. How We Use Your Information

• Order Processing: To fulfil orders and manage delivery and returns.
• Account Management: To maintain your account and preferences.
• Customer Support: To respond to enquiries and improve service quality.
• Legal Compliance: To meet regulatory, tax, and Companies House obligations.
• Business Operations: Analytics and internal improvements to enhance your experience.

4. Lawful Basis for Processing

We process your personal data under the following lawful bases as defined by UK GDPR:

• Contract Performance: Processing necessary to fulfil your order and deliver goods.
• Legal Obligation: To comply with VAT, Companies Act 2006, Consumer Rights Act 2015, and other UK legal requirements.
• Legitimate Interests: To operate our business, prevent fraud, and improve our services, provided your rights are not overridden.
• Consent: Where you have given explicit consent for marketing communications or non-essential cookies.

5. Information Sharing and Disclosure

• Service Providers: Trusted partners assisting with website hosting, payment processing, and customer relationship management.
• Delivery Carriers: Royal Mail, DPD, Evri, Yodel, and other UK carriers for order fulfilment.
• Payment Processors: Secure third-party payment providers including PayPal, Klarna, and Clearpay.
• Legal Requirements: Disclosure to law enforcement, Trading Standards, or courts when required by UK law.
• Business Transfers: Data may transfer to a successor entity during mergers or acquisitions, subject to continued data protection.

6. Data Security and Protection

We implement encryption, SSL security, secure hosting, and restricted access controls to protect your data from unauthorised access, loss, or misuse. Whilst we strive for maximum protection, no system is completely secure. We regularly review our security measures to maintain high standards.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to enhance user experience, analyse site traffic, and improve functionality. Under the Privacy and Electronic Communications Regulations 2003 (PECR), we obtain your consent before setting non-essential cookies.

You can manage cookie preferences through your browser settings or our cookie banner. Essential cookies required for site operation do not require consent. For full details, please refer to our separate Cookie Policy.

8. Your Privacy Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Rectification: Correct inaccurate or incomplete personal data.
• Right to Erasure: Request deletion of your personal data in certain circumstances.
• Right to Restriction: Limit how we process your data in specific situations.
• Right to Data Portability: Receive your data in a structured, machine-readable format.
• Right to Object: Object to processing based on legitimate interests or for direct marketing.
• Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
• Right to Complain: Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or telephone 0303 123 1113.

To exercise any of these rights, please contact us using the details in Section 14.

9. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy and to comply with legal obligations, including:

• Six years for financial records under HMRC requirements.
• Order and delivery records for potential Consumer Rights Act 2015 claims (six years in England, Wales, and Northern Ireland; five years in Scotland).
• Marketing consent records until you withdraw consent or we cease trading.

10. International Data Transfers

Where we transfer your personal data outside the United Kingdom, we ensure adequate safeguards are in place as required by UK GDPR. This may include:

• Transfers to countries with UK adequacy decisions.
• Use of Standard Contractual Clauses with the UK Addendum.
• Transfers to processors certified under the UK-US Data Bridge or equivalent framework.

We do not transfer data to third countries unless necessary for service delivery, and only with appropriate protections.

11. Third-Party Services and Links

Our website may contain links to external websites, including payment providers, social media platforms, and partner sites. We are not responsible for the privacy practices of these third-party websites. Please review their privacy policies before providing personal information.

12. Children's Privacy

Our services are intended for users aged 18 and over. We do not knowingly collect personal data from children under 13 years of age. If we become aware that we have inadvertently collected such data, we will take steps to delete it promptly.

13. Automated Decision-Making and Profiling

We do not engage in automated decision-making or profiling that produces legal or similarly significant effects. Any analytics we conduct are for internal improvement purposes only.

14. Updates to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top indicates the most recent revision. Continued use of our services following updates constitutes acceptance of the revised policy.

15. Contact Information and Data Controller