Privacy policy
Last updated 15/08/2026
Who we are — data controller and processor
SW Glass Fulham Ltd is the data controller for the personal data described on this page. Registered in England and Wales, company number 10811331. Our registered office is 671A Fulham Road, London, SW6 5PZ.
The platform this site runs on is built and maintained for us by Quantum AI WebApps, who act as our data processor under a written agreement and only process data on our documented instructions.
Our registration with the Information Commissioner's Office is pending. We will publish the reference here once it is issued. We would rather say that plainly than print a number we cannot yet evidence.
Questions about this policy, or about your data, come to us at shop@sw-glass.co.uk or call us on 0207 751 0011.
What we collect and why (orders, drawings/documents, ePOD, consent decisions, marketing)
Orders and accounts — your name, email, phone, delivery and billing address, what you ordered and what you paid. We need this to take and fulfil the order and to invoice it.
Job specifications, drawings and documents — the measurements and options you configure, the technical drawings produced from them, and the quotes, invoices and credit notes generated. These are the record of what was agreed and what was made.
Proof of delivery — when we deliver, our driver captures a signature, the name of the person signing, optionally a photo, and a single location point at the moment of delivery. That point is a point in time, not tracking; we do not follow your address or your device around. Where location is unavailable the record says why rather than leaving a blank.
Cookie and consent decisions — which cookie categories you allowed or refused, when, and against which version of our cookie policy. We keep this as evidence that we asked, which the Privacy and Electronic Communications Regulations require.
Marketing — your email or number where you have consented, or where you are an existing customer and we are telling you about similar goods. Every message carries an unsubscribe.
Payments — we store a reference to the payment, and for a saved card only the brand and last four digits plus the wording of the mandate you agreed. Card numbers never reach our servers — they are captured inside our payment provider's own secure form.
Support and site use — messages you send us through the site chat, email, forms or social channels, and a small number of first-party usage counts (for example that a configurator session was started or priced). Those counts carry no name, account or visitor identifier.
Lawful basis and retention periods per data category
- Account, orders and invoices — basis: performance of a contract, and legal obligation for the tax records. Invoices and their line detail are kept for 6 years as HMRC requires. Account details are kept until you ask us to remove them, then anonymised.
- Specifications, drawings and job documents — basis: contract. Kept for 6 years with the order, because they are the evidence in any dispute or warranty question.
- Proof of delivery (signature, name, photo, delivery point) — basis: contract, and our legitimate interest in being able to prove we delivered. Kept for 6 years with the order.
- Cookie and consent decisions — basis: legal obligation. Records are append-only: a new choice supersedes the old one rather than overwriting it, so the history of what you were asked and what you chose stays intact.
- Marketing lists and email engagement — basis: consent, or the existing-customer soft opt-in. Kept until you opt out, which we action immediately.
- Analytics and advertising — basis: consent only. Nothing loads or fires before you allow the category, on our side or in your browser.
- Staff accounts and the audit trail — basis: contract and legitimate interest in financial control. Audit records are kept 6 years.
Every change to a price, a refund or an override is written to an audit record showing who did it and why. That is a control on us, not surveillance of you.
Subprocessors (hosting, SES, S3, Stripe, self-hosted Postgres/Meilisearch, Apple/Google wallet)
- Amazon Web Services — hosting, database, cache, file storage, content delivery and transactional email, in the London (UK) region.
- Stripe — card payments and refunds. Stripe holds the card details; we hold only a payment reference, and the brand and last four digits of a card you choose to save.
- Google — tag delivery and analytics, only if you allow analytics or marketing cookies.
- Microsoft — site usage insight, only if you allow analytics cookies.
- Advertising platforms (for example Meta, TikTok, Pinterest, LinkedIn) — where those accounts are configured and only if you allow marketing cookies.
- Apple and Google — where you add a wallet pass. The pass carries your name and account number only.
- Our accounting software — invoices, payments and credit notes are pushed for bookkeeping.
- Our database, search index and job queue are self-hosted on our own infrastructure — no third party processes that data.
Search on this site runs entirely on our servers: your search terms go to us, never directly to a third party. The site chat is ours too. We use no third-party fonts and no CAPTCHA, so simply loading a page does not call anyone else.
Your rights — access, deletion/anonymisation, DSAR export
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. Where we rely on consent you can withdraw it at any time. Ask us at shop@sw-glass.co.uk or call us on 0207 751 0011 and we will respond within one month.
Access. We produce an export bundle covering your account, orders, documents, consent records and delivery records, and hand it to you as a single file.
Deletion. We cannot delete an invoice — the law requires us to keep it for 6 years. What we do instead is anonymise: your name, email, phone and address are removed from the records we hold, while the invoice keeps the figures it must keep. Any saved card mandate is deleted outright, which structurally stops any future charge. Your cookie consent record is kept as the evidence the regulations require, with the IP address cleared and your identity replaced by an anonymous marker.
If we ever suffer a breach that puts your rights at risk, we report it to the ICO within 72 hours and tell the people affected.
How to contact us / complain
Talk to us first at shop@sw-glass.co.uk or call us on 0207 751 0011 — most data questions are quicker to sort out directly, and a named person will pick it up within one business day.
If we get it wrong, you have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. You do not have to come to us first, though we would like the chance to fix it.
This policy is kept under review
We review this notice as the platform changes and update it here. The date it was last updated is shown at the top of the page, and material changes are flagged when you next visit.
This policy is kept under review; contact us with questions at shop@sw-glass.co.uk or call us on 0207 751 0011.
