Privacy notice

SYN Furniture is the controller of the personal data collected through this site, in the workshop, and in the course of taking, making and delivering orders. "Controller" is the word the law uses for the party that decides what is collected and why; it also means the party you can make a complaint to, and the party that has to answer it.

Anything under this notice — a question about it, a rights request, a complaint — reaches us through the contact channels on this site, and it is answered by a person who can act on it rather than sorted into a queue.

This notice covers everything we do with personal data: browsing this site, asking us a question, ordering a catalogue piece, commissioning a bespoke piece, and running a project with us. It does not cover a site you reach from a link on ours — those have their own notices, which are worth a minute of your time before you hand anything over.

Three things we do not do, stated here rather than buried: we do not process special category data (nothing about health, beliefs or anything of that kind is asked for or wanted); we do not build advertising profiles or track you across other sites; and we do not sell personal data to anyone, for any amount, ever.

What you give us directly. In practice this is the largest part of it:

• your name, email address, telephone number, and the delivery and billing addresses for an order;
• the content of a message you send us, whether through the live chat, the contact form, by email or in a note attached to a project enquiry;
• order and project details — the piece, its SKU, the finish, the dimensions, the specification, and anything you send us to help: floor plans, site photographs, photographs of a doorway, a drawing from your designer;
• for trade and project accounts, the business name, registration details, VAT number, and the names and contact details of colleagues working on the same project;
• payment information in the limited form our payment provider passes back to us: the last four digits, the card type, the outcome, and the billing postcode used for verification. We never see or hold a full card number.
• whatever preferences you tell us about — pieces you are considering, a room you are furnishing, a project date.

What is collected automatically. When you load a page, our servers and our hosting provider record the IP address, the browser and device, the page requested, the referring page, and the time. This is ordinary web server logging. It is used to run the site, to spot abuse, and to understand roughly which pages are useful; it is not used to build a profile of you.

What we create. Working records are part of running a workshop, and they are personal data where they identify you: the order history against your name; the delivery note and the signed proof of delivery; the correspondence log, so that whoever answers your message can see what was said before; and — this is deliberate — a note of what we told you about colour variation, care and tolerances before the order.

That last one deserves a sentence. If a piece arrives and a discolouration or a hairline at a joint is a surprise, the question that decides whether it is a fault is whether you were told it might happen. Keeping that record protects you as much as it protects us, and we would rather have it than win an argument by attrition.

We also keep photographs taken in the workshop: the piece before the crate is closed, the crate with its paperwork visible and the strap tell-tale intact. These usually do not identify you at all, and where they do — a delivery note in the frame, a name on a crate label — they are held as part of the order record.

If you do not give us something. You can browse this site, read the journal and look at the catalogue without giving us anything. But we cannot deliver a piece without a delivery address and a telephone number, cannot accept a card payment without the details our payment provider requires, and cannot clear a project consignment through customs without the consignee information the destination country asks for. Where declining to give us something means we cannot do the thing you have asked for, we will tell you which thing it is.

Data protection law requires us to have a lawful basis for everything we do with personal data, and to tell you which one it is. Where you are in the United Kingdom or the European Union, the UK GDPR and the EU GDPR apply to your data and give you the rights set out in this notice. There are six lawful bases available; we rely on four of them, and never more than one at a time for a given purpose. The mapping is below, and it is deliberately specific.

To take, make and deliver your order — contract

Article 6(1)(b): processing necessary for the performance of a contract with you, or to take steps at your request before entering one. This covers everything from the Order Acceptance to the delivery appointment, the customs paperwork and the warranty record.

To keep tax, company and customs records — legal obligation

Article 6(1)(c): processing necessary to comply with a legal obligation. Invoices and payment records, export documentation, and the consignee information a customs authority requires.

To answer a question, quote a piece, or resolve a complaint — legitimate interests, or contract where an order already exists

Where your enquiry is about an existing order, it is part of performing the contract. Where it is not, we rely on Article 6(1)(f): our legitimate interest in replying to people who write to us, and in keeping a record of what we said.

To market similar pieces to an existing customer — legitimate interests, under the soft opt-in

Where you have bought from us and we have your email, we may occasionally email about similar pieces, which electronic marketing rules allow without fresh consent provided you were given an easy way to opt out when we first collected the address and in every message since. If you opt out, we stop, and we do not ask why.

To understand which pages are used and to improve the site — legitimate interests

Article 6(1)(f): our interest in running a site that works. We use the minimum data that answers the question, aggregate rather than identify wherever possible, and honour browser signals that ask us not to do non-essential measurement.

To defend or bring a legal claim — legitimate interests, and legal obligation

Article 6(1)(f), and Article 6(1)(c) where a document must be kept by law. Project files and workshop photographs are kept for this purpose for as long as a claim about the piece could still be brought.

About legitimate interests. Where we rely on legitimate interests we have carried out a balancing test: we have a real interest, the processing is necessary for it, we use no more data than the purpose needs, and the outcome is not something you would find surprising or objectionable. You can object to processing on this basis at any time under clause 8, and you can ask us for a summary of the assessment by writing to our data protection contact.

No automated decisions. We do not make decisions about you by automated means that produce legal effects or similarly significant effects, and we do not profile you for advertising. The only automated thing that happens to your order is that it appears in a production queue, which is a list, not a decision about you.

Marketing. We never sell, rent or trade personal data, and no third party receives your details in order to market its own products to you. If you receive something from us that you did not ask for and cannot stop, tell us and it will stop.

A cookie is a small file a site asks your browser to store; it comes back to the site on later requests. We use as few as we can, and we group them by what they are for rather than by vendor, because the grouping is the part that tells you whether you need to care.

Strictly necessary

The session and basket cookies that keep a shopping bag from emptying between pages, the ones that keep a signed-in session secure, and the ones our hosting provider uses for load balancing and for blocking abusive traffic. These cannot be turned off without breaking the basket and the checkout, and they do not need consent.

Preferences

A small cookie or local storage entry that remembers a choice you made — a dismissed notice, a currency selection. Turning these off costs you nothing except having to make the choice again.

Measurement

We measure how the site is used in a configuration that does not set a persistent advertising identifier and does not track you across other sites. Where the law requires consent for a measurement tool, we ask before it runs and it does not run until you agree.

If we ever add an advertising or cross-site tracking cookie, this notice changes before the cookie appears, and we ask for consent first. We have no plan to add one; we mention it because a notice that only describes today is not much of a notice.

Managing cookies in your browser. Every mainstream browser lets you see, block and delete cookies, and lets you set a preference per site. Blocking everything will break the basket and the checkout, because those genuinely need to remember what you put in them. Where you have given consent to a measurement tool, you can withdraw it at any time by clearing the site’s cookies or by using the cookie preferences in the footer of any page.

Browser signals. Where your browser sends a Global Privacy Control or a comparable signal, we treat it as an objection to non-essential cookies and anything that depends on them. Where an older "Do Not Track" header is sent, we treat it the same way. Neither changes anything about the cookies the basket needs.

Third parties reached by your browser. Fonts on this site are currently loaded from Google’s font servers, which means your browser makes a request to Google and your IP address is visible to them. We would rather self-host the fonts, for speed as much as for privacy, and that change is on the list; when it happens this paragraph changes with it. Nothing else on the site loads from a third party without your knowledge.

We share personal data with a small number of organisations, all of which are either our processors — acting on our written instructions and nothing else — or parties we are required to involve by law. We do not share it with anyone for their own marketing, and we do not sell it.

The categories of processor we use, and what each of them receives:

• the payment service provider that takes card payments and performs the fraud checks — it receives the payment details, the billing address and the order total, and returns only the outcome and the last four digits to us;
• the freight forwarder, the shipping line and the final-mile crew that move the piece — they receive the consignee name, delivery address, a telephone number, access notes, and the crate dimensions and weight;
• the customs broker at the destination, and the customs authority itself, where the consignment must be cleared — they receive the invoice, the goods description, the value and the consignee details, which the law requires;
• the email and hosting providers that carry our correspondence and serve this site, which hold message contents and server logs on our behalf;
• our accountants and auditors, and our professional advisers, where a document has to be examined or a claim considered;
• for project work, the installing contractor or the site team, where coordinating a delivery requires it — and we will tell you before we do it.

It is worth being plain about the second one. A crated consignment cannot be delivered without giving the carrier an address, a phone number and a note about the access, and a consignment cannot cross a border without the paperwork the destination country demands. That is the whole of what they get. We do not send a carrier your order history, your correspondence or your basket.

Insurers and claims. Where a piece is damaged in transit, the claim is ours against the carrier and the insurer, and the file includes photographs, the delivery note and the crate record. Your name and address appear in that file because a claim is about a delivery to you. You do not have to deal with the carrier: our Shipping Policy is there so that you do not.

Where the law requires it. We may disclose personal data to a court, a regulator, a tax authority, a customs authority or a law enforcement body where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim. Where we are permitted to tell you that a request has been made, we will.

If the business changes hands. If SYN were ever sold or its business transferred, customer records would transfer with it, because they are part of the business. A change of controller of that kind does not require your consent, but you would be told, and this notice would be updated before the records moved.

Written processor terms. Every processor we use is engaged on terms that meet Article 28 of the GDPR: they act only on our instructions, they must keep the data secure, they must help us answer your rights requests, and they must delete or return the data when the arrangement ends. We keep those agreements and can describe them on request.

We are not in the same country as all of the organisations described in clause 5. Personal data therefore crosses borders in a small number of ordinary, unavoidable ways — and one that is very much not avoidable at all.

The unavoidable one. A consignment of furniture cannot be delivered to another country without disclosing the consignee name, delivery address and a contact telephone number to carriers and to the customs authority of the destination country. That is a transfer of personal data to that country, and there is no version of international delivery in which it does not happen. What we do is keep it to what the shipment needs, and send nothing about your order or your history with it.

The safeguards we rely on for everything else:

• for transfers to the European Economic Area and to the United Kingdom, the adequacy regulations, which permit the transfer without further steps;
• for transfers to the United States and to other countries without an adequacy finding, the International Data Transfer Agreement issued by the UK Information Commissioner, or the European Commission’s Standard Contractual Clauses with the UK Addendum, whichever the processor is contracted under;
• where a processor is certified under the UK Extension to the EU–US Data Privacy Framework, that certification, together with the contractual terms above;
• for any transfer not covered by the three above — which would be unusual, and we would tell you — a transfer risk assessment, and additional technical measures such as encryption in transit and at rest.

You can ask our data protection contact for a copy of the relevant safeguard. We may redact parts of a contract that are commercially confidential or that identify another customer, but the operative clauses that protect your data are never the parts we take out.

Retention is decided by what the record is for, not by how long it is convenient to keep.

An enquiry that does not become an order

Twenty-four months from the last correspondence, then deleted. Two years is long enough that we can pick up a conversation about a piece you were considering, and short enough that old enquiries do not accumulate.

Order, specification and project records

Six years from the end of the year in which the piece was delivered or the order was closed — the window in which a claim about the piece could still be brought, and the same period we keep the financial records for. This covers the order, the approved drawing, the finish and colour notes, the correspondence, the delivery record and the workshop photographs.

Financial records — invoices, payment confirmations, credit notes

Six years from the end of the financial year to which they relate, plus the current year, as the tax and company law that applies to us requires. We cannot delete these early even if you ask, and the section on your rights says why.

Customs and export documentation

Six years, for the same legal reason, and because export evidence is what supports a zero-rated sale for VAT.

Website server logs

Between thirty and ninety days, depending on the provider. Aggregated statistics that no longer identify anyone are kept indefinitely, because aggregated data is not personal data.

A damage claim

Until the claim is closed, and then on the order-record timetable above. Where a claim is live, the file is not deleted on the ordinary timetable.

Where a period in this clause ends, we delete the data or anonymise it. Where data sits in a backup that is on its own cycle, it is deleted from live systems immediately and falls out of the backup when that cycle turns.

You have the following rights over your personal data. None of them is absolute, and clause 8.3 explains the limits, but all of them are yours to use.

Access

A copy of the personal data we hold about you, with information about what we do with it. In practice we send a PDF or a spreadsheet of the records, plus an explanation of anything that is not obvious.

Rectification

Correction of anything inaccurate, and completion of anything incomplete. The address for an order in progress is the most common one, and it matters: tell us before the crate is closed.

Erasure

Deletion of data we no longer need. Where we are holding something we are not required to keep, we delete it.

Restriction

A pause on using data while a question about its accuracy or our use of it is settled. In practice, we would stop using it and hold it until the question is answered.

Portability

The data you gave us, which we process by automated means, in a structured, commonly used, machine-readable format — CSV or JSON — and, where you ask, sent directly to another organisation.

Objection

An objection to processing based on legitimate interests or on a public task. Where we cannot show compelling grounds that override your interests, we stop. Where the objection is to direct marketing, we stop immediately and without argument — that one is absolute.

Withdrawing consent

Where we rely on consent, you can withdraw it at any time and we stop that processing. Withdrawal does not make anything done before it unlawful.

Automated decisions

The right not to be subject to a decision based solely on automated processing that has legal or similarly significant effects. We do not make any, so this one is here for completeness rather than for use.

How to exercise them. Tell us what you want through the contact channels on this site. You do not need to use a particular form, quote a clause, or explain why. We reply within one month, and we will tell you at once if for some reason it will take longer and why. There is no charge unless a request is manifestly unfounded or excessive, which in practice means repeated requests for the same thing.

We may ask for proof of identity before acting on a request, and if we do, we ask for the least that will settle it — in most cases your order number and the email address you used, rather than a copy of a passport. If we are unsure whether you are the person the data is about, we will say so rather than guess.

The limits. Erasure does not reach records we are required by law to keep: an invoice stays for six years, a customs declaration for six years, regardless of what either of us would prefer. We also cannot delete a project file while a claim about the piece is live, because the file is the only way to assess it — but we will tell you when the claim closes and what the timetable is afterwards.

Marketing. Use the unsubscribe link in any email, or write to us, and it takes effect immediately. You do not need to explain, and we will not ask. Nothing about marketing affects correspondence about an order in progress, which is part of the contract rather than marketing.

Tell us what has gone wrong through the contact channels on this site. We answer within five working days, and we will tell you what we think happened rather than what we are willing to admit.

If you are in the United Kingdom and are not satisfied with our answer, you have the right to complain to the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113. You may complain to the ICO without coming to us first — the right is yours and we do not take it personally.

If you live in the European Union, you may complain to the supervisory authority in your country of residence, and if you are elsewhere you may complain to the authority in the country where the processing that concerns you took place. We would rather have the chance to put it right first, but that is a preference, not a condition.

If the complaint is about a piece rather than about data — a delay, a fault, a delivery — the routes are in the Terms of Service and the Shipping Policy. One of the directors sees every complaint under either heading; they are not handled by different people who never talk to each other.

This notice is dated at the top of the page, and it is dated because it is a version rather than a document. We review it when something changes — a new processor, a new payment method, a change in the law, a change in the way we work — and not on a schedule for its own sake.

Where a change is material, we will say so on the site rather than quietly reissue the page. Where it affects customers with an order in progress, or customers with a claim about a piece still live, we will tell them by email as well, because a notice nobody read is not a notice.

This notice forms part of the Terms of Service and should be read with them, but it does not create contractual rights beyond those conferred by data protection law, and it does not narrow anything the law gives you. If there is a conflict between a sentence here and a right the law gives you, the right wins.

Our data protection contact is reached through the contact channels on this site. We are a small company and we have not appointed a statutory data protection officer, because we are not required to — the person who answers is the part that matters.

Use those channels for a rights request, a question about this notice, a complaint, or a request for a copy of the safeguards we rely on for a transfer outside your country. Anything about an order — a change, a delay, a fault — is better sent the same way with your order number, because it will be answered by the people who can actually do something about it.

If you are writing on behalf of somebody else, tell us that in the first line and tell us on whose authority you write. We will not disclose anything about a customer to a third party without the customer’s agreement, whatever the request looks like.

We do not sell your personal information, and we do not share it for advertising. We never have. There is no advertising or analytics cookie on this site, no advertising pixel, and no third-party tag receiving your data in order to build a profile of you somewhere else. The cookie panel in the footer of every page says the same thing in a sentence, and it is the same fact.

Those two words are used here in the sense they carry in the California Consumer Privacy Act and the California Privacy Rights Act, and in the state laws modelled on them: sell means transferring personal information for money or other valuable consideration, and share means transferring it for cross-context behavioural advertising. Neither happens on this site.

What does leave our systems is what clause 5 lists: the carrier and the customs broker that move the piece, the payment provider that takes the card, the service that sends our email, and the people who host the site and the database. Each receives what it needs for that job and nothing more, each acts on our instructions rather than its own, and none is permitted to use it for advertising. That list is written by category and it is the whole of it — a new processor goes in there before it goes live.

How to ask, and what happens next. Send a message through the chat at the bottom of any page or the form on the contact page and say what you want — it reaches a person who can act on it. You do not have to live in California to ask, you do not need to use a particular form, and you do not need to give a reason. A request to delete is answered under clause 8, including the six-year invoices and customs declarations we are required to keep; a request to confirm what we hold is answered under the same clause, within one month. If you would rather we simply recorded that you have asked not to be sold or shared, we will do that too, though as things stand there is nothing for it to apply to.