Privacy policy

Privacy Policy

Last Updated: October 2026

Fulham DIY ("we", "us", or "our") operates the website fulhamdiy.shop (the "Site") and is dedicated to safeguarding your personal information and respecting your privacy. This Privacy Policy explains how we collect, use, process, share, and protect your personal data when you visit our site, make purchases, or communicate with us, in full compliance with the UK Data Protection Act 2018, the UK General Data Protection Regulation (UK GDPR), and Google Merchant Center (GMC) standards.

1. Data Controller Information

Fulham DIY is the data controller responsible for your personal data. If you have any questions or wish to exercise your legal rights regarding your personal information, please reach out to our dedicated data privacy desk using the contact details provided at the bottom of this policy.

2. Information We Collect

We collect only the personal information necessary to deliver our products, complete transactions, fulfill orders, and maintain clear communication:

Identity & Contact Details: Full name, billing address, UK delivery address, email address, and contact telephone number.
Order & Transaction Data: Records of power tools purchased, kit configurations, order values, invoices, and return/exchange histories. (Note: We do not collect or store full credit/debit card numbers or security CVV codes on our servers. All transactions are tokenised and executed via PCI-DSS compliant third-party processors).
Technical & Usage Data: IP address, browser type and version, time zone setting, operating system, pages viewed, and interaction patterns gathered automatically via standard cookies.
Customer Support Communications: Records and correspondence resulting from inquiries made via our contact form, email, or 24/7 live chat.

3. Legal Grounds for Processing Your Data

Under UK GDPR, we process your personal information only when an established lawful basis applies:

Contractual Necessity: To register your order, process your payment, pack items in our warehouse, and dispatch tools via our courier network.
Legal Obligation: To maintain proper tax accounting, invoice records, and warranty compliance as mandated by UK statutory law.
Legitimate Interests: To prevent fraudulent orders, secure our website infrastructure, and improve customer service performance without overriding your fundamental privacy rights.
Consent: For sending direct electronic marketing communications (where you have explicitly opted in via an unchecked box) or non-essential website analytics cookies. You may revoke consent at any time.

4. How We Use and Share Your Information

We do not sell, rent, or trade your personal information to third parties. We share your data strictly with trusted service providers who assist us in fulfilling orders and operating our store:

Shipping & Logistics Partners: Royal Mail, Evri, and DPD UK receive your name, UK shipping address, phone number, and email address solely to deliver your orders and transmit tracking notifications.
Payment Gateways: Secure payment service providers (including Shop Pay and accredited card acquiring networks) handle checkout transactions under Level 1 PCI-DSS standards.
IT & Cloud Infrastructure: Trusted cloud-hosting and support software vendors providing secure data storage and customer messaging capabilities.
Legal & Regulatory Compliance: Authorised UK law enforcement bodies or regulators when disclosure is strictly necessary to satisfy statutory duties or prevent fraud.

5. Cookies and Web Tracking

Our website uses cookies and similar tracking technologies to ensure smooth site navigation, remember items in your shopping basket, and understand customer browsing habits:

Strictly Necessary Cookies: Essential for page navigation, session management, and secure checkout.
Performance & Analytics Cookies: Help us evaluate traffic patterns and website speeds anonymously to optimize catalogue usability.
Managing Preferences: You can instruct your browser to refuse all or some browser cookies, or alert you when cookies are being set. If you disable essential cookies, portions of our checkout process may become inaccessible.

6. Data Security and Storage

We employ strict administrative, technical, and physical security measures to shield your personal details from accidental loss, unauthorized access, alteration, or disclosure:

All browsing and payment sessions are encrypted end-to-end using 256-bit Secure Sockets Layer (SSL) protocols.
Access to personal order records is restricted strictly to authorized staff members on a need-to-know basis.
In the unlikely event of a suspected security breach involving personal data, we maintain formal procedures to notify you and the UK Information Commissioner's Office (ICO) where legally required.

7. Data Retention Timelines

We retain personal information only for as long as necessary to fulfill the purposes for which it was gathered:

Order & Invoicing Records: Kept for 7 years to satisfy UK statutory tax and financial reporting requirements.
Customer Support Records: Retained for up to 3 years after resolution to assist with product warranty claims or past order queries.
Marketing Consent Data: Retained until you withdraw consent or unsubscribe via our email preference links.

8. Your Legal Rights (UK GDPR)

Under UK data protection law, you possess explicit rights regarding your personal records:

Right of Access: Request a complimentary copy of the personal information we hold about you.
Right to Rectification: Request corrections to incomplete or inaccurate records.
Right to Erasure ("Right to be Forgotten"): Request the deletion of your personal data where there is no ongoing legal basis or statutory reason for its retention.
Right to Restrict or Object: Object to or restrict the processing of your data in specific scenarios, including direct marketing.
Right to Data Portability: Request transfer of your data to you or a nominated third party in a structured, machine-readable format.

To exercise any of these rights, contact us at info@fulhamdiy.shop. We respond to all legitimate requests within one calendar month. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.