Introduction and who we are
Brook Decorations (LONDON) Limited (“Brook Decorations”, “we”, “us” or “our”) is the controller of the personal data described in this policy. We respect your privacy and are committed to protecting your personal data. This policy explains what we collect, why we collect it, how long we keep it, and what rights you have under UK data protection law.
- Company: Brook Decorations (LONDON) Limited, registered in England and Wales, company number 3315715
- Registered address: Pipers Business Centre, 220 Vale Rd, Tonbridge, TN9 1SP
- Privacy contact: info@brookdecorations.co.uk
- Last updated: 14 October 2026
Who this policy applies to
This policy applies to our customers, to visitors to our website, and to partners and third-party service providers who work with us. “Personal data” means any information that can identify you directly or indirectly, such as your name, email address, postal address, telephone number or the content of a service request.
What personal data we collect, why, and our lawful basis
We only use your personal data where the law allows us to. The table shows each purpose and the lawful basis we rely on. Where we rely on legitimate interests, we have considered whether our interests are outweighed by your rights and freedoms, and you can ask us about that assessment.
| Who | Data we collect | Why we use it | Lawful basis |
| Website visitors | IP address, device and browser details, pages viewed (via cookies) | To improve our website and measure interest in our services | Legitimate interests (running and improving our business), or consent where a cookie requires it |
| Customers | Name, address, email, phone number, details of the work requested | To provide quotations | Steps taken at your request before a contract; legitimate interests |
| Customers | Contact details, history of work with us | To tell you about our products and services (see Marketing below) | Legitimate interests, supported by the “soft opt-in” for existing customers, or consent |
| Customers, partners | Name, address, invoices and payment records | To keep accounting and tax records | Legal obligation |
| Partners and service providers | Contact details, business details, bank details | To place orders and service requests with you, pay you and communicate with you | Performance of a contract; legitimate interests |
Most of the data we hold comes directly from you. If we receive your details from someone else, for example a partner or a person arranging work on your behalf, we will tell you where they came from when we first contact you.
Cookies and website analytics
Our website uses Google Analytics, a web analytics service provided by Google, to count visitors and see which pages are used. We use it only to produce statistics so that we can improve the website. We do not use it for advertising.
We give you clear information about these cookies on our website and a simple, free way to switch them off at any time, through our cookie settings or your browser settings. You can also use Google’s browser add-on to opt out of Google Analytics. Switching them off does not affect your use of the site. If we ever add cookies for advertising or social media, we will ask for your consent first.
How long we keep your data
We keep personal data only for as long as we need it for the purposes in this policy, then delete it or anonymise it.
| Data | How long we keep it |
| Accounting and payment records (invoices, BACS records) | 6 years after the end of the tax year, as tax law requires |
| Customer job records and contracts | 6 years after the work is completed, in case of a claim |
| Quotations that did not lead to an order | 2 years |
| Google Analytics data | 2 years |
| Partner and supplier records | For the length of our relationship, then 6 years |
Who we share your data with, and transfers abroad
We do not sell your personal data. We share it only with organisations that help us run the business, and only so that they can provide their service to us:
- IT, website hosting and email providers
- Our accountants and bookkeepers
- Our bank, for BACS payments
- Professional advisers such as solicitors and insurers, where needed
- The police, courts, HMRC or other authorities where the law requires it
We have written contracts with our service providers requiring them to keep your data secure and to use it only on our instructions.
We store your data in the UK. The exception is Google Analytics: Google may process website usage data outside the UK, including in the United States. Where it does, the transfer relies on safeguards approved under UK law, such as the UK–US data bridge. You can avoid this by switching off analytics cookies (see Cookies above).
Security and data breaches
We use physical, technical and organisational measures to protect your personal data from loss, misuse and unauthorised access or disclosure. These include password and key-based access controls on our servers, encryption of data sent through our website, and restricting access to staff who need it. No method of electronic storage is completely secure, so we cannot guarantee absolute security.
If a personal data breach is likely to put you at risk, we will tell the Information Commissioner’s Office within 72 hours of becoming aware of it. If the risk to you is high, we will also tell you without undue delay and explain what happened and what you can do. Customers can ask us for information about any incident that affects their data.
Your rights and how to complain
Under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, you have the right to:
- Be informed about how we use your data (this policy)
- Access a copy of the personal data we hold about you
- Correct data that is inaccurate or incomplete
- Erasure, in some circumstances (we may need to keep some records, for example for tax)
- Restrict how we use your data, in some circumstances
- Data portability, where we process your data by automated means under a contract or with your consent
- Object to processing based on legitimate interests, and to direct marketing at any time
- Withdraw consent where we rely on it, for example for non-essential cookies
- Not be subject to solely automated decisions that have a legal or similarly significant effect on you (we do not make any)
To use any of these rights, email info@brookdecorations.co.uk. We may ask you to prove your identity, and we may search for what is reasonable and proportionate when you make an access request. We will reply within one month. If your request is complex or you have made several, we can extend this by up to two further months, and we will tell you within the first month if we need to. There is no charge unless a request is clearly unfounded or excessive.
How to complain to us. If you are unhappy with how we have handled your personal data, email info@brookdecorations.co.uk or write to us at the address above, marking it “Data protection complaint”. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
How to complain to the regulator. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first, but you are free to contact the ICO at any time.
Automated decisions, changes and definitions
Automated decisions. We do not make decisions about you based solely on automated processing, including profiling, that have a legal or similarly significant effect on you.
Changes to this policy. We may update this policy from time to time. The date at the top shows when it was last changed. If we make a significant change, we will tell customers we have contact details for, and we will always publish the new version on our website.
Definitions.
- Personal data: any information that identifies you directly or indirectly, such as your name, email address, postal address, telephone number or details of a service request.
- Data protection laws: the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) and the Privacy and Electronic Communications Regulations 2003.
- Visitor: anyone who uses our website or services but is not a customer.
- This policy: this privacy notice.
