Privacy Policy - MonkleyFurniture

1. Who we are and how to contact us

MonkleyFurniture (“we”, “us”, “our”) is the controller of the personal data processed through the website www.monkleyfurniture.co.uk. We are based in the United Kingdom and we are responsible for deciding how and why your personal data is used.

If you have questions about this Privacy Policy or how we use your data, contact us at: privacy@monkleyfurniture.co.uk

2. Data protection officer (DPO)

We have appointed a Data Protection Officer to oversee questions in relation to this Privacy Policy and our data protection practices.

Email: dpo@monkleyfurniture.co.uk
Subject line suggestion: “For the attention of the Data Protection Officer”

3. Scope and the laws that apply

This Privacy Policy applies to personal data we collect and process when you visit our website, contact us, create an account, place an order, subscribe to marketing, interact with our social media, or otherwise engage with us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). If you are located in the European Economic Area (EEA), we will apply standards consistent with the EU GDPR to your personal data.

4. What data we collect

We may collect and process the following categories of personal data:

Identity and contact details: name, email address, telephone number, billing and delivery addresses.
Account details: username, password, preferences, saved items.
Order and transaction data: items purchased, order history, delivery information, and payment status. Payment card details are processed directly by our payment service provider and are not stored by us.
Communications: messages sent to us by email or forms, call notes, feedback, and reviews.
Marketing preferences: your choices about receiving marketing and your cookie consent choices.
Technical and usage data: IP address, device and browser information, operating system, pages viewed, time and date of visits, clickstream data, and interactions with site features. This may be collected via cookies and similar technologies.
Location data: general location based on IP address (city/region level).
Images and content you provide: for example, if you send photos for product queries or reviews.

We do not intentionally collect special categories of personal data (such as health, ethnicity, or biometric data) and we ask that you do not provide such information to us.

5. How we collect your data

Direct interactions: when you place an order, create an account, subscribe to emails, or contact us.
Automated technologies: through cookies, server logs, and similar technologies when you use our site.
Third-party sources: delivery partners, payment processors (confirmation of payment status), analytics providers, and anti-fraud services.

6. Why we use your data and our legal bases

We use your personal data for the following purposes and under these legal bases:

To provide the website and its features: to load pages, remember your basket, and keep the site secure. Legal basis: legitimate interests (running our website) and, for strictly necessary cookies, PECR exemption.
To process orders and deliver products: to confirm orders, take payment via our payment provider, arrange delivery, and provide customer service. Legal basis: performance of a contract; legal obligations for invoicing and tax.
To manage your account: to create, maintain, and secure your account and preferences. Legal basis: performance of a contract; legitimate interests (account management and security).
Customer support and communications: to respond to queries and handle returns or complaints. Legal basis: performance of a contract; legitimate interests (providing support).
Marketing: to send you news, offers, and updates by email or similar channels. Legal basis: consent. Where permitted under PECR (soft opt-in for our existing customers), legitimate interests. You can opt out at any time.
Analytics and improvements: to understand site usage and improve products and services. Legal basis: consent for non-essential cookies/analytics; legitimate interests for anonymised, strictly necessary measurement.
Security, fraud prevention, and misuse detection: to keep our services safe and prevent abuse. Legal basis: legitimate interests; legal obligations where applicable.
Legal and compliance: to meet record-keeping, tax, and regulatory requirements and to establish or defend legal claims. Legal basis: legal obligations; legitimate interests.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

7. Cookies and similar technologies

Cookies are small files placed on your device. We use:

Strictly necessary cookies: essential for site operation (for example, to remember your basket or sign-in). These do not require consent under PECR.
Performance/analytics cookies: help us understand how our site is used so we can improve it. Set only with your consent.
Functionality cookies: remember your preferences. Set only with your consent.
Advertising/measurement cookies: if used, they help measure the effectiveness of marketing. Set only with your consent.

When you first visit, you will be asked to set your cookie preferences. We will not set non-essential cookies unless you consent. You can change your preferences at any time via the cookie banner or by adjusting your browser settings to refuse or delete cookies. Blocking some cookies may impact site functionality.

Cookie durations vary. Session cookies expire when you close your browser; persistent cookies typically last between 1 month and 13 months. We retain records of your cookie consent for up to 6 years to demonstrate compliance.

8. Sharing your data

We only share your personal data when necessary, with appropriate safeguards, and for the purposes set out in this policy:

Service providers acting as processors: website hosting and maintenance, content management, security and anti-fraud, email service providers, customer support tools, analytics services (for consented users), and IT service providers.
Payment service providers: to process payments and prevent fraud. They act as independent controllers for card details.
Delivery and logistics partners: to fulfil and track your deliveries.
Professional advisers: lawyers, auditors, and accountants where needed.
Authorities and regulators: where required by law or to protect rights, property, or safety.
Business transfers: in the event of a merger, acquisition, or asset sale, subject to confidentiality and data protection requirements.

We do not sell your personal data.

9. International data transfers

Your personal data is generally stored in the UK. If we transfer personal data outside the UK or EEA, we will ensure an adequate level of protection by using one or more of the following safeguards:

UK adequacy regulations for the destination country.
UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.
EU Standard Contractual Clauses where applicable.

You can request information about our transfer safeguards by contacting dpo@monkleyfurniture.co.uk.

10. Data security

We use appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, least-privilege principles, secure configurations, and regular monitoring. While we work hard to protect your data, no system is completely secure.

11. How long we keep your data

We keep personal data only as long as necessary for the purposes set out in this policy, including to comply with legal, accounting, or reporting requirements. Typical retention periods are:

Customer accounts: for as long as the account remains active and for up to 24 months after inactivity; key records may be retained longer where required by law or to resolve disputes.
Orders and transaction records: 6 years after the end of the financial year in which the transaction occurred (to comply with tax and accounting obligations).
Customer support enquiries: up to 24 months after resolution.
Marketing preferences and email subscription records: for as long as you are subscribed and for up to 6 years after you unsubscribe to demonstrate compliance.
Security and system logs: typically up to 12 months, unless needed longer for investigations.
Cookie consent records: up to 6 years.

When retention periods expire, we will securely delete or anonymise your data.

12. Your rights

Under data protection law, you have rights which you can exercise at any time:

Access: request a copy of your personal data.
Rectification: correct inaccurate or incomplete data.
Erasure: ask us to delete your data in certain circumstances.
Restriction: ask us to limit how we use your data in certain cases.
Portability: receive your data in a structured, commonly used, machine-readable format and have it transferred to another controller where technically feasible.
Object: object to processing based on legitimate interests and to direct marketing (including profiling for marketing) at any time.
Withdraw consent: where we rely on consent, you may withdraw it at any time.

To exercise your rights, contact privacy@monkleyfurniture.co.uk. We may need to verify your identity. We aim to respond within one month. In complex cases, this may be extended by up to two additional months; we will inform you if this applies. Some rights may be limited by legal obligations.

13. Marketing communications

We will send you marketing communications only if you have consented or if you are an existing customer and the communication relates to similar products or services (soft opt-in under PECR). You can opt out at any time by using the unsubscribe option in our emails or by contacting privacy@monkleyfurniture.co.uk. Opting out will not affect service messages such as order confirmations or important account notices.

14. Children’s privacy

Our website is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has provided personal data to us, please contact privacy@monkleyfurniture.co.uk so we can delete it.

15. Automated decision-making

We do not use personal data for automated decision-making that produces legal or similarly significant effects on you.

16. Social media

If you interact with us on social media, the platform provider will also process your personal data. That processing is subject to the privacy policies and settings of the relevant platform. We receive interaction statistics and messages according to your settings and our legitimate interests in engaging with customers.

17. Third-party websites

Our website may reference third-party content or services. If you follow any such references, those third parties will have their own privacy practices. We encourage you to read their privacy information before providing any data.

18. How to complain

Please contact us first at privacy@monkleyfurniture.co.uk and we will do our best to resolve your concern. You also have the right to lodge a complaint with the UK regulator, the Information Commissioner’s Office (ICO):

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113

19. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, technologies, or legal requirements. When we make changes, we will update the “Last updated” date below. We encourage you to review this page periodically.

Last updated: 21 January 2026

20. Contact details

For privacy-related queries, to exercise your rights, or to request a copy of safeguards for international transfers, please contact:

Email (general privacy): privacy@monkleyfurniture.co.uk
Email (Data Protection Officer): dpo@monkleyfurniture.co.uk