Privacy & Legal

Last updated August 2026

WHO WE ARE AND WHAT WE DO

Who We Are

We are Sanderson Design Group PLC (“we” or “us”). We are a limited company registered in England and Wales under registration number 00061880 and we have our registered office at Voysey House, Sandersons Lane, London, United Kingdom, W4 4DS. We are registered with the UK supervisory authority, Information Commissioner’s Office (“ICO”) in relation to our processing of Personal Data under registration number Z6406626.

Controller

Unless we notify you otherwise, we are the controller of the Personal Data we process about you. This means that we decide what Personal Data to collect and how to process it.

Purpose of This Privacy Notice

Who This Privacy Notice Applies To

What Personal Data Is

Personal Data We Collect

How We Collect Your Personal Data

Purposes of processing and applicable lawful bases

Sharing Your Personal Data

International Transfers

Data Retention

Automated Decision Making

Your Rights

Complaints

How to Contact Us

2. Purpose of This Privacy Notice

This privacy notice explains who we are, what personal information we collect and how it is used. It also explains what rights you have. It is designed to tell you about our practices regarding the collection, use and disclosure of personal information which may be provided to us through our website or collected through other means such as in person by us, by an online form, email or telephone communication.

3. Who This Privacy Notice Applies to

This privacy notice applies to you if:

You visit our website;
You enquire about our products and/or services; and
You sign up to receive newsletters and/or other promotional communications from us.

4. What Personal Data Is

‘Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier.

5. Personal Data We Collect

We collect the following types of personal data:

Personal details such as name, title and company name.
Contact information such as email address, telephone number, billing address, delivery address and correspondence address.
Account information such as account credentials, order history, saved preferences and account settings (where applicable).
Customer and transaction information such as enquiries, quotations, orders, purchases, payment information, delivery details and records of customer service interactions.
Business relationship information such as your employer, job title, areas of interest and records of communications relating to our products and services.
Marketing information such as your marketing preferences, subscription details, consent records and records of your interactions with our marketing communications.
Website usage information such as pages visited, products viewed, searches performed, referring websites and other information about how you use our website.
Technical information such as IP address, browser type and version, operating system, device identifiers and other technical information relating to your use of our website.
Cookie and similar technology information such as cookie identifiers, session information and online identifiers collected through cookies and similar technologies.
Email engagement information such as whether marketing emails have been opened, links clicked, the date and time of interactions, and associated technical information including IP address, device type and email client (where applicable and permitted by law).
Location information such as approximate geographic location derived from your IP address or delivery information provided by you.
Security information such as authentication records, website logs and information collected to maintain the security of our website, systems and services.

6. How We Collect Your Personal Data

We collect most of the Personal Data directly from you in person, by telephone, text or email and/or via our website.

However, we may also collect your Personal Data from third parties such as:

• reputable companies who provide related services

• others to whom you have provided consent

• publicly available sources such as social media platforms

7. Purposes of processing and applicable lawful bases

We will only use your Personal Data when the law allows. We may collect and use the following types of personal data about you for the purposes explained below.

Purpose of processing	Lawful Basis
To respond to enquiries, provide information about our products and services, and manage communications with customers, suppliers and other business contacts.	Legitimate interest – it is necessary to respond to enquiries and manage our business relationships effectively.
To provide information about our products, services and business activities in response to requests received through our website.	Legitimate interests – it is necessary to provide relevant information and respond to requests from prospective customers and other website users.
Advertising the business through various channels such as email, telephone, social media etc. to improve awareness and increase revenue	It is necessary to promote the business through various channels such as social media, email, telephone and social media.
To send electronic marketing communications, newsletters and updates about our products, services and business activities, where permitted.	Legitimate interest (B2B) and Consent (B2C) – It is necessary to promote our services to increase sales revenue.
To monitor engagement with email communications, evaluate the effectiveness of campaigns, improve future communications, and generate reporting and analytics.	Legitimate interest or Consent - where information is accessed or stores information on the recipient's terminal equipment.
To operate, maintain, monitor and improve our website, including analysing website usage and performance.	Legitimate interests – it is necessary to ensure our website operates effectively and to improve its functionality and user experience.
To maintain the security, integrity and availability of our website and systems, including detecting and preventing misuse, fraud and security incidents.	Legitimate interests – it is necessary to protect our website, systems and business operations from security threats and unauthorised activity.
To comply with legal obligations and establish, exercise or defend legal claims.	Legal Obligation
To place cookies on our domain	See our cookie notice here. For more information.

8. Sharing Your Personal Data

Your Personal Data may be disclosed internally to appropriate departments such as marketing and sales. Only that information which is necessary to enable us to fulfil our duties is processed.

Third parties with whom we might share your Personal Data

We share your Personal Data with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so. This may include our third-party service providers for reasons including web hosting,

Obligations on third parties with whom we share your Personal Data

All our third-party service providers with whom we share your Personal Data are required to take appropriate security measures to protect your Personal Data in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your Personal Data for specified purposes and in accordance with our instructions.

9. International Transfers

Your Personal Data may be processed outside of the UK. This is because the organisations we use to provide our service to you are based outside the UK.

We have taken appropriate steps to ensure that when your Personal Data is processed in a country outside the UK, it does not have a materially lower level of protection than that guaranteed in the UK. We do this by ensuring that:

Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation), or
We enter into an International Data Transfer Agreement (“IDTA”) with the receiving organisation and adopt supplementary measures, where necessary. (A copy of the IDTA can be found here https://ico.org.uk/media2/migrated/4019538/international-data-transfer-agreement.pdf; or
When transferring your Personal Data to America, we may rely on the UK-US Data Bridge, where appropriate.

10. Data Retention

We only retain your personal information for as long as is necessary to fulfil the purposes for which it was collected, including meeting any legal, regulatory, accounting or reporting requirements.

The length of time we retain your personal information will depend on the nature of the information, the purpose for which it was collected and our legal obligations. Retention periods may vary depending on the type of information and your interactions with our website and services.

For further information about the retention periods that apply to your personal information, please contact us using the details provided in the "How to Contact Us" section.

11. Automated Decision Making

We do not make any decisions about you based solely on automated decisions.

12. Your Rights

You have certain rights in relation to the processing of your Personal Data, including to:

Right to be informed
You have the right to know what personal data we collect about you, how we use it, for what purpose and in accordance with which lawful basis, who we share it with and how long we keep it. We use our privacy notice to explain this.
Right of access (commonly known as a “Subject Access Request”)
You have the right to receive a copy of the Personal Data we hold about you.
Right to rectification
You have the right to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure (commonly known as the right to be forgotten)
You have the right to ask us to delete your Personal Data.
Right to object to processing
You have the right to object to us processing your Personal Data. If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.
Right to restrict processing
You have the right to restrict our use of your Personal Data. This means you can ask us to suspend the processing of your Personal Data, in certain circumstances, such as where you contest the accuracy of the Personal Data.
Right to portability
You have the right to ask us to transfer your Personal Data to another party.
Automated decision-making
You have the right not to be subject to a decision based solely on automated processing which will significantly affect you.
Right to withdraw consent
If you have provided your consent for us to process your Personal Data for a specific purpose, you have the right to withdraw your consent at any time. If you do withdraw your consent, we will no longer process your information for the purpose(s) you originally agreed to, unless we are permitted by law to do so.

How to exercise your rights

You will not usually need to pay a fee to exercise any of the above rights. However, we may charge a reasonable fee if your request is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, you may contact us using the details set out below within the section called ‘How to contact us and our Data Protection Officer’. We may need to request specific information from you to confirm your identity before we can process your request. Once in receipt of this, we will process your request without undue delay and within one month. In some cases, such as with complex requests, it may take us longer than this and, if so, we will keep you updated.

13. Complaints

You have the right to complain if you consider that we have not complied with the data protection law when handling your Personal Data. We will acknowledge receipt of your complaint within 30 days, investigate the matter without undue delay, and keep you informed of the progress and outcome. If you wish to complain please use the contact details given below under “How to contact us and our Data Protection Officer”. We will do our best to resolve the matter to your satisfaction.

If you are not satisfied with the outcome of your complaint, you can complain with the relevant supervisory authority. The supervisory authority in the UK is the Information Commission who can be contacted online at:

Or by telephone on 0303 123 1113

For supervisory authorities in other countries within the EU see the link below:

https://edpb.europa.eu/about-edpb/about-edpb/members_en

14. How to Contact Us

For further information regarding your personal data or about Sanderson’s approach to data protection in general please contact our Data Protection Officer at:

Voysey House,

Sandersons Lane,

London,

W4 4DS

(e) privacy@sandersondesigngroup.com

(t) + 44 (0) 203 457 5862