Privacy Policy

Last updated: 26 July 2026

1. Who We Are

This privacy policy explains how Online British Homes ("we", "us", "our") collects, uses, stores and protects your personal data when you visit or purchase from www.onlinebritishhomes.co.uk (the "Site"). We are the data controller for the personal data described in this policy.

You can contact us regarding any privacy matter at [email protected] or via our Contact Us page.

2. Information We Collect

We collect the following categories of personal data:

Identity Data: first name, last name, title.
Contact Data: billing address, delivery address, email address, telephone number.
Account Data: if you register an account with us, we store your name, email address, delivery address, and encrypted password, so you can log in more easily and track your order history.
Transaction Data: details of orders placed, products purchased, order value, and order history.
Financial Data: we do not directly collect or store full payment card details. Card details are collected and processed entirely by our payment processor, Stripe, Inc. (see Section 6).
Technical Data: IP address, browser type and version, time zone setting, operating system, device information, and other technology used to access the Site.
Usage Data: information about how you use the Site, including pages viewed, time spent, navigation paths, and products viewed or added to your basket.
Marketing and Communications Data: your preferences in receiving marketing communications from us, and your communication preferences.

3. How We Collect Your Data

We collect data through:

Direct interactions: when you create an account, place an order, subscribe to marketing, contact us, or complete a form on the Site.
Automated technologies: as you interact with the Site, we automatically collect Technical Data via cookies, server logs, and similar technologies. See our Cookies section below.
Third parties: we may receive data about you from our payment processor (Stripe) confirming payment status, and from analytics and hosting providers.

4. Legal Basis and Purposes for Processing

Under UK data protection law, we must have a legal basis for processing your personal data. We rely on the following:

Performance of a contract: to create and maintain your account, process and fulfil your order, manage payment, arrange delivery, and provide customer service relating to your purchase.
Legal obligation: to comply with our legal and regulatory obligations, including tax, accounting, and consumer protection law (e.g. record-keeping for HMRC, handling statutory returns under the Consumer Rights Act 2015).
Legitimate interests: to prevent fraud, secure our Site, understand how customers use our Site so we can improve it, and communicate with you about your order or account, provided these interests are not overridden by your rights.
Consent: where you have opted in to receive marketing communications from us, or where we introduce optional cookie-based advertising in future (see Section 10). You may withdraw this consent at any time (see Section 9).

5. How We Use Your Data

We use your personal data to:

Create and maintain your account, so you can log in and review your order history more easily.
Process and deliver your order, including managing payment and arranging dispatch via our courier.
Notify you about changes to your order, our Site, or these policies.
Manage our relationship with you, including notifying you of changes to our terms or privacy policy.
Handle returns, refunds, and any complaints or disputes.
Detect and prevent fraud or misuse of the Site.
Send you marketing communications, where you have consented to receive them.
Analyse Site usage, browsing behaviour, and past orders to improve our product range, layout, and customer experience, and to help us understand which products may interest you.
Comply with our legal obligations, including tax and accounting requirements.

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects concerning you. If we introduce targeted advertising (for example, via Google or social media platforms) in future, we will update this policy and, where required, obtain your consent via a cookie banner before doing so.

6. Payment Processing (Stripe)

All payment card transactions on this Site are processed by Stripe, Inc. ("Stripe"), a PCI-DSS Level 1 certified payment processor. When you enter your payment details at checkout, this information is transmitted directly and securely to Stripe; we do not receive, store, or have access to your full card number, expiry date, or CVC.

Stripe processes this data as an independent data controller in accordance with its own privacy policy, available at stripe.com/gb/privacy. We receive limited transaction data from Stripe (such as payment status, the last four digits of your card, and card type) which we retain as part of your order record for accounting and fraud-prevention purposes.

7. Delivery and Courier Data Sharing

To fulfil and deliver your order, we share the minimum necessary data — your name, delivery address, and contact telephone number or email — with our delivery partner, Royal Mail Group Limited, for the purposes of delivering your parcel and providing tracking information. Royal Mail acts as an independent data controller for the data it processes in the course of delivery. Royal Mail's privacy policy is available at royalmail.com/privacy-notice.

8. Data Sharing and Third Parties

We share personal data with the following categories of third party, only to the extent necessary for the purposes set out in this policy:

Payment processors (Stripe) — to process your payment securely.
Delivery and courier partners (Royal Mail and, where applicable, other couriers) — to deliver your order.
IT, hosting, and website service providers — who host our Site and store our data on our behalf, acting under our instructions as data processors.
Professional advisers — including accountants, auditors, and legal advisers, where necessary for their services to us.
HMRC, regulators, and other authorities — where we are required to report or share data by law.
Advertising and analytics partners — only if we introduce this in future (see Section 5); we will name any such partners here and update this policy before doing so.

We do not sell, rent, or trade your personal data to third parties for their own marketing purposes.

9. Marketing Communications and Your Choices

Where you have opted in, we may contact you by email with details of products, offers, or promotions that may interest you. You can withdraw your consent to marketing communications at any time by clicking the "unsubscribe" link in any marketing email, or by contacting us at [email protected].

Opting out of marketing communications does not affect service communications relating to your order (such as dispatch confirmations), which we are entitled to send you as part of fulfilling our contract with you.

10. Cookies

Our Site uses cookies and similar tracking technologies to distinguish you from other users, remember your cart contents, keep you securely logged in, and understand how the Site is used. Cookies are small text files placed on your device.

We use the following types of cookies:

Strictly necessary cookies: required for the Site to function, including session management and shopping cart functionality. These cannot be switched off.
Performance and analytics cookies: help us understand how visitors interact with the Site so we can improve it.
Security cookies: used to help identify and prevent security risks, including Cloudflare's bot-protection and Turnstile services.
Advertising cookies: not currently in use. If we introduce advertising or retargeting cookies (for example, via Google or social media platforms) in future, we will update this section, name the relevant partners, and request your consent via a cookie banner before any such cookies are set.

You can set your browser to refuse some or all cookies, or to alert you when a website sets or accesses cookies. If you disable cookies, some parts of the Site — including checkout — may not function correctly.

11. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements:

Order and transaction records are retained for a minimum of 6 years to comply with UK tax and accounting obligations (HMRC requirements).
Account data is retained for as long as your account remains active, and for a reasonable period thereafter in case you wish to reactivate it.
Marketing consent and mailing list data is retained for 12 months following your last engagement with us (for example, opening an email or browsing the Site), or until you withdraw consent, whichever is earlier.
Technical and usage data is retained for 12 months following initial collection.
Correspondence, enquiries, and complaint records are retained for 12 months following resolution, or longer where necessary to defend a potential legal claim.

Where data is no longer required, we will securely delete or anonymise it. We may retain anonymised or aggregated data (which can no longer identify you) indefinitely for statistical purposes.

12. International Data Transfers

Some of our third-party service providers, including Stripe and our website infrastructure providers, may process data outside the United Kingdom, including in the United States. Where this occurs, we ensure appropriate safeguards are in place, such as reliance on adequacy regulations, Standard Contractual Clauses, or the UK International Data Transfer Addendum, to ensure your data receives a level of protection equivalent to that under UK data protection law.

13. Data Security

We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, alteration, or disclosure. These include use of HTTPS/TLS encryption across the Site, secure hosting infrastructure, restricted access to personal data on a need-to-know basis, and reliance on PCI-DSS certified payment processing (Stripe) so that we never handle your full card details directly.

We have procedures in place to deal with any suspected data security breach and will notify you and any applicable regulator (the Information Commissioner's Office) of a suspected breach where we are legally required to do so.

14. Your Legal Rights

Under UK data protection law, you have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you.
Right to rectification — to request correction of inaccurate or incomplete data.
Right to erasure — to request deletion of your data in certain circumstances (subject to our legal obligations to retain some records).
Right to restrict processing — to request that we limit the way we use your data in certain circumstances.
Right to data portability — to request transfer of your data to you or a third party in a structured, commonly used format.
Right to object — to object to processing based on legitimate interests, or to direct marketing at any time.
Right to withdraw consent — where processing is based on consent, at any time, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month, as required by law. We may need to request specific information from you to confirm your identity before responding.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues, at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the chance to address your concerns directly before you approach the ICO, so please contact us first.

15. Children's Privacy

Our Site and products are not directed at children, and we do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected personal data from a child, we will take steps to delete that information promptly.

16. Third-Party Links

Our Site may, from time to time, include links to third-party websites. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. We encourage you to read the privacy policy of every website you visit.

17. Changes to This Privacy Policy

We may update this privacy policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors — including, for example, if we introduce targeted advertising in future. We will post any updates on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

18. Contact Us

If you have any questions about this privacy policy or our data practices, please contact us at [email protected] or via our Contact Us page at www.onlinebritishhomes.co.uk.