Privacy Policy
Privacy Policy
How Rugsville handles your personal data under UK GDPR and the Data Protection Act 2018. What we collect, why we collect it, how long we keep it, who we share it with, and how to exercise your rights.
1. Who controls your data
Data Controller: Rugsville (trade name)
Email: support@rugsville.co.uk
Operations: Online retailer with workrooms in the United States and India, shipping to UK addresses.
Rugsville is the data controller for personal data collected through this website and during your purchase. We process UK customer data in line with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and ICO guidance.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account & identity | Name, email, phone, billing & delivery address, account password (hashed) | You provide at checkout / signup |
| Order & transaction | Order details, last 4 digits of payment card, payment method, transaction reference | Order & payment processor |
| Browsing & usage | Pages viewed, products of interest, basket contents, device/browser type, IP address | Site interaction (with consent for non-essential) |
| Marketing | Email-list status, preferences, opt-in date | You opt in |
| Support & correspondence | Emails, photos sent for damage claims, order notes | You provide when contacting us |
3. Why we process & lawful bases
Under UK GDPR Article 6, we must identify a lawful basis for each processing activity:
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Process your order, take payment, ship the rug, handle returns | Contract performance — Art. 6(1)(b) |
| Keep accounting records, fraud prevention, regulatory disclosures | Legal obligation — Art. 6(1)(c) |
| Improve site UX via analytics, customer support records | Legitimate interest — Art. 6(1)(f) (with opt-out) |
| Marketing email, retargeting cookies, non-essential cookies | Consent — Art. 6(1)(a) & PECR |
5. International transfers
Because Rugsville operates from workrooms in the United States and India, your data is transferred outside the UK as part of fulfilling your order. UK GDPR requires appropriate safeguards for these transfers.
We rely on:
- UK adequacy regulations where applicable (e.g. UK–US Data Bridge for participating US processors)
- UK International Data Transfer Agreements (IDTA) or the UK Addendum to the EU SCCs for transfers to India and other non-adequacy jurisdictions
- Encryption in transit (TLS 1.3) and at rest where applicable
- Data minimisation — only the data needed to fulfil the order is transferred
6. How long we keep your data
| Category | Retention period | Why |
|---|---|---|
| Account & order records | 7 years post-order | UK tax law (HMRC requires 6 years + current) |
| Payment records | 7 years | Anti-fraud, accounting, dispute resolution |
| Browsing analytics | 13 months | Aggregate trend analysis |
| Marketing list | Until you withdraw consent | Consent-based |
| Customer support correspondence | 3 years post-issue | Quality assurance, legal evidence if needed |
| Logs (security, audit) | 12 months | Security incident investigation |
7. Your rights under UK GDPR
The UK GDPR gives you the following rights as a data subject:
- Access (Art. 15)
- Get a copy of all personal data we hold about you, in a portable format.
- Rectification (Art. 16)
- Correct inaccurate or incomplete data we hold.
- Erasure (Art. 17)
- Have your data deleted — subject to UK tax record-keeping rules where applicable.
- Restriction (Art. 18)
- Limit how we process your data while a query is open.
- Portability (Art. 20)
- Receive your data in a machine-readable format to move elsewhere.
- Object (Art. 21)
- Stop us using your data for marketing or profiling. We respect this absolutely for marketing.
- Automated decisions (Art. 22)
- Not be subject to a decision based solely on automated processing. We don't use automated decision-making.
- Withdraw consent
- Where processing is based on consent, you can withdraw at any time.
8. How to exercise your rights
Email support@rugsville.co.uk with subject line “Data request” plus the right you wish to exercise. We respond within 30 days (the UK GDPR statutory window), free of charge for reasonable requests.
If you're not satisfied with our response you can complain to the UK Information Commissioner's Office (ICO): ico.org.uk · helpline 0303 123 1113. The ICO is the UK regulator for data protection.
9. Cookies & tracking
We use cookies and similar technologies. Strictly necessary cookies operate without consent; all other cookies require your consent under PECR. See our Cookie Policy for the full list, lifespans and how to manage your preferences.
10. Marketing
We only send marketing emails if you opt in. Every email has a one-click unsubscribe link, and you can withdraw consent at any time by emailing support@rugsville.co.uk. We do not share your data with marketing partners without your explicit opt-in.
11. Children's data
Our service is intended for adults. We do not knowingly collect personal data from anyone under 16 years old without parental consent (the UK GDPR threshold).
12. Changes to this policy
We may update this policy as our service evolves or the law changes. The latest version is always at this URL with the “last updated” date below. Material changes are notified to existing customers by email.