Privacy Policy

UNIQ FLOOR LTD runs the UniqFloors online shop at https://uniq-floor.com. We are the controller of the customer information described in this policy.

• Company number: 12975965
• Registered office: 141 Glaisdale Drive West, Unit 1 Arctic House, Nottingham, England, NG8 4GY
• Email: info@uniq-floor.com

The registered office is the legal address of the company. It is not a statement that every collection or delivery address used by the shop is that office.

We sell to customers in the United Kingdom and deliver only to UK addresses. We do not ship orders or samples outside the United Kingdom. Some companies that help us run the shop may still process information outside the United Kingdom. That is described under International transfers.

You can also use the contact page on the website. Those contact details are the right place to ask for your information or to raise a privacy question.

This policy covers personal information collected through the UniqFloors website and the emails we send about your account, orders, samples, and, if we send them, marketing. It does not cover other websites we link to, including a courier's own tracking site or Stripe's payment pages.

We collect:

• Name, email address, phone number, and UK address when you type them in.
• Account details if you register: email address, a password stored only as a bcrypt hash, and addresses you save.
• Order details: products, quantities, the delivery option you choose, and the amount to pay.
• Free-sample details: the samples in your sample basket, and optional answers about your project if you choose to give them.
• A one-time email code when you verify the address used for a sample request or account registration. The code is checked with a keyed hash and is not kept as readable text. The code lasts about 10 minutes. A short-lived proof that the address was verified lasts about 30 minutes.
• Messages you send through the enquiry and contact forms, including a product you were looking at when that applies.
• Records of a marketing opt-out, unsubscribe, or email suppression, and whether a first-party link in a marketing email was clicked, if those emails are sent.
• Technical information needed to run the shop, including a basket session and the sign-in tokens described below.

We do not ask you to store your card number on this website. Card payments are handled by Stripe. We receive the result, such as whether payment succeeded, and a payment reference. We do not store your full card number or card security code on UniqFloors servers. Free sample requests are not card payments.

If you create an account, we use your email and password so you can sign in, see orders, and save addresses. You can also sign in with Google, where that option is offered. A password-reset link sent by email expires after 1 hour.

Sign-in uses tokens kept in your browser. The customer access token is stored in local storage and in a cookie named customer_token for about 24 hours so account pages can tell that you are signed in. A refresh token is stored in an HTTP-only cookie named customer_refresh_token for about 7 days. Staff sign-in uses separate cookies and is only for the admin area.

We do not use your password for marketing.

We use your name, contact details, address, and chosen samples to take the request, arrange delivery, and send you updates about that request. Guest requests and signed-in requests use the same kinds of contact and address details.

Sample checkout emails you a six-digit code. You need a valid code before the request can continue. An incorrect or expired code is rejected. Text-message verification is not used.

A sample allowance can stop a further free-sample request until a later qualifying purchase. That limit is a shop rule shown at checkout. It is not a credit decision.

Guest sample tracking asks you to show that you can access the email address on the request. The tracking page then shows the stages and times we hold for that delivery.

We use your name, contact details, address, and order contents to take a paid flooring order, arrange delivery or collection, and send updates about that order. Payment is taken through Stripe, as described above.

For a free-sample courier delivery we pass the delivery details Parcel2Go needs to carry and track the parcel. Parcel2Go is a separate controller for its own tracking website.

UniqFloors Own Delivery, where it is offered for free samples, is a delivery within the United Kingdom. It uses the address and postcode our own delivery staff need. That service does not create a courier tracking number.

We do not currently book pallet freight with ParcelBroker, and we do not pass your order to ParcelBroker.

Address lookup, when staff have switched it on, sends the postcode you enter to Ideal Postcodes so you can pick a matching UK address. You can still type the address yourself.

Order confirmations, sample updates, delivery messages, and replies to an enquiry are service messages about something you asked us to do. They are separate from marketing email. They are sent whether or not you receive marketing.

We do not currently send marketing emails.

Sample checkout includes this tick box: “I don't want to receive flooring inspiration, product updates and special offers from UniqFloors.” If you tick it, we record an opt-out. If you leave it unticked, that choice is stored. It is not, by itself, a separate marketing consent, and it does not start a marketing email.

If we later send emails about similar flooring, we will do that only where the law allows it, you have not opted out or unsubscribed, and each marketing email includes an unsubscribe link. A sample request does not, on its own, mean those emails will be sent.

Unsubscribing stops marketing email. It does not stop messages about an order or sample you have asked for. A delivery suppression, such as a hard bounce, stops further marketing to that address and is not cleared by a later sample request.

Product links in a marketing email can pass through a UniqFloors page so we can record that the link was clicked, then send you to the product. The link does not contain your email address. We do not use a third-party advertising pixel for this. Security tools that open links can increase the click count.

We use browser storage to run the shop. We do not use advertising or analytics cookies of our own. Stripe, when you pay, and Google, when you use Google sign-in or an optional map or distance service, can set their own cookies. Those are their cookies, not ours.

Storage we set includes:

• customer_token in local storage and in a cookie, for customer sign-in.
• customer_refresh_token in an HTTP-only cookie.
• Admin sign-in cookies and local storage, used only in the staff area.
• cart_session in local storage, so the paid basket can be recognised.
• The email address typed for the basket, in local storage, so a returning browser can find that basket.
• uniqfloors_sample_basket_v1 in local storage, so the free-sample basket survives moving between pages.
• A sample-checkout draft in session storage for up to two hours, so the form survives a visit to this policy. It is cleared when the request is placed, when the browser session ends, or after two hours. It does not keep the verification code.
• A short-lived sample-tracking proof in session storage.
• A pending-payment note in local storage during Stripe checkout.
• Room-planner session storage, if you use that tool.

There is no separate cookie-banner choice in the shop today. If we later add non-essential cookies, we will ask for a choice before they are used.

• To take and deliver an order you asked for, including payment and messages about that order. This is necessary for the contract.
• To send the free samples you asked for, and to check the email address on that request. This is necessary to provide the service you asked for. The security check is also in our legitimate interests.
• To reply to an enquiry. This is necessary to respond to you, and in our legitimate interests in handling that enquiry.
• To keep the site secure and to keep a record of what was ordered. This is in our legitimate interests and, where it applies, to meet a legal duty.
• Marketing email is not currently sent. Any future similar-flooring email would depend on a confirmed legal basis and on the opt-out and unsubscribe rules above.

We do not sell your personal information. We do not use your information for solely automated decisions that produce a legal or similarly significant effect, such as credit scoring.

We use service providers to run the shop:

• Stripe, for card payments and refunds.
• Amazon SES, for email from the live shop. Service messages use that mail service today.
• Parcel2Go, when a free sample is sent by courier.
• UniqFloors staff, for our own sample delivery.
• Ideal Postcodes, only when address lookup is switched on.
• Amazon Web Services, which hosts the shop's servers, database, and stored images.
• Google, when you use Google sign-in or when an optional Google map or distance service is switched on.

Staff can see the order, sample, enquiry, and marketing records they need for their job. We share information with a public authority when the law requires it.

The shop's servers, database, stored images, and Amazon SES email service are in Amazon Web Services' London region. Amazon's published UK terms say that information stays in the region we select, except where Amazon needs to handle it elsewhere to provide the service or to comply with the law. Where that information is handled in a country that does not have a UK adequacy decision, those terms use the Information Commissioner's international data transfer addendum to the standard contractual clauses. A message we send may then be stored by your own email provider.

Card payments are processed by Stripe. Stripe's published terms say the payment information is transferred to Stripe, LLC in the United States. Stripe, LLC is certified under the UK Extension to the EU-US Data Privacy Framework. Where that certification does not cover a transfer, Stripe's published terms use the UK International Data Transfer Addendum. Stripe says those terms apply when its payment service is used. We do not store your full card number.

If you sign in with Google, Google handles that sign-in. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework. If an optional map or distance check is switched on, we send Google the postcode or address needed for that check. Google's own privacy information describes what Google then does with it.

We use Parcel2Go for UK courier deliveries only. Parcel2Go's privacy policy says that organisations it uses may be outside the United Kingdom, including in countries that do not have the same data protection laws. It says it puts a contract in place, and that its measures include model clauses approved by the European Commission or another approved transfer mechanism. It does not name the country, and it does not name the UK transfer document that applies to a booking we make. A UK delivery does not mean those delivery details stay in the United Kingdom.

When address lookup is switched on, the postcode is sent to Ideal Postcodes, run by IDDQD Limited in the United Kingdom. Ideal Postcodes lists its hosting suppliers in the UK or the European Union. A transfer from the United Kingdom to the European Economic Area is covered by the United Kingdom's adequacy regulations. Ideal Postcodes also lists a global load-balancing service and United States suppliers for support and error monitoring. Its privacy policy says some information may be stored outside the European Economic Area, and that it then uses standard contractual clauses where they are available. Those documents do not show whether a postcode lookup uses the United States suppliers, and they do not name a UK transfer agreement for that lookup.

These periods are set in the product today:

• Email verification codes: about 10 minutes.
• The short proof that a sample email was verified: about 30 minutes.
• The sample-checkout draft in your browser: until you place the request, close the session, or two hours have passed.
• A password-reset link: 1 hour.
• The customer access cookie: about 24 hours.
• The customer refresh cookie: about 7 days.

For accounts, orders, samples, enquiries, and marketing choices, we do not keep the information for a fixed number of years. We keep it only while the reason below still applies. Once that reason has ended, we do not keep it:

• Account details, while the account is open. After the account is closed, only where an order, sample, or enquiry is still open, or where the law requires a record.
• Paid orders, payment results, and invoices, while we need them to finish the order, deal with a return or a complaint, and meet tax and accounting duties.
• Free-sample requests and delivery records, while we need them to send the samples, show tracking, and answer a question about that request.
• Enquiry messages, while we need them to reply and to keep a record of that reply.
• Marketing opt-outs, unsubscribes, and email suppressions, for as long as we might otherwise send marketing, so that an opt-out is not lost.

Under UK data protection law you can ask us to:

• provide a copy of the personal information we hold about you;
• correct information that is wrong;
• delete information in the situations where the right applies;
• restrict how we use it while a request is considered;
• receive information you provided, in a portable form, where the right applies;
• object to use based on legitimate interests.

Contact info@uniq-floor.com. We may need to confirm it is you before we act. Some information has to be kept for an order, a payment, or a legal duty even after a deletion request.

You can tick the opt-out at sample checkout, or use the unsubscribe link in a marketing email if one is sent. That stops further marketing email. It does not cancel the sample or order itself.

You can complain to the Information Commissioner's Office if you are unhappy with how we use your information. The ICO's site is https://ico.org.uk. We would like the chance to put things right first.

The shop sells flooring for homes and commercial spaces. It is not directed at children, and we do not knowingly open customer accounts for children. There is no separate age check in the checkout. If you believe a child has given us personal information, contact us and we will delete it where we are allowed to.

If this policy changes, we will update this page and the date at the top. Where the law requires a fresh choice, we will ask for it.