Privacy Policy for Thornfield Chair Studio

Effective date: 26 June 2026

1. Introduction and company information

This Privacy Policy explains how Thornfield Chair Studio collects, uses, stores, shares, and protects personal data when you visit our website, contact us, place an order, request a quotation, or otherwise interact with us. We are committed to handling personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), and other applicable UK data protection laws.

Data controller: Thornfield Chair Studio

Registered / business address: Thornfield Chair Studio, 27 King Street, Improve, Kent, TN24 8QL, UK

Email: [email protected]

Phone: +44 20 7946 8372

Thornfield Chair Studio is a chair business that may design, manufacture, sell, deliver, and support chairs and related products and services. This policy applies to personal data relating to customers, prospective customers, website visitors, suppliers, contractors, and other individuals who interact with us.

2. Data collection and processing

We may collect and process the following categories of personal data:

Identity data: name, title, company name, and similar identifiers.
Contact data: billing address, delivery address, email address, telephone number, and correspondence details.
Transaction data: details of purchases, quotations, invoices, payment status, delivery information, and order history.
Account and profile data: login details if an account is created, preferences, saved addresses, and communication preferences.
Technical data: IP address, browser type, device identifiers, operating system, time zone setting, and website usage information.
Usage data: pages visited, products viewed, referral source, interaction with our website, and session activity.
Marketing and communications data: your preferences in receiving marketing from us and your communication history.
Customer service data: enquiries, complaints, feedback, call notes, and records of communications with us.
Special category data: we do not generally seek to collect special category data. If you choose to provide such information to us, we will only process it where permitted by law and where a valid condition applies.

We collect personal data directly from you when you contact us, place an order, request a quote, subscribe to updates, complete forms, or communicate with us by phone, email, or other channels. We may also collect data automatically through cookies and similar technologies, and from third parties such as payment providers, delivery partners, analytics providers, and publicly available sources where lawful.

3. Purpose of data processing

We process personal data for the following purposes:

to provide our products and services, including chair sales, custom orders, quotations, and customer support;
to process payments, refunds, invoices, and account administration;
to arrange delivery, installation, collection, or after-sales support;
to communicate with you about enquiries, orders, service updates, and complaints;
to manage our website, improve user experience, and analyse performance;
to send marketing communications where permitted by law or where you have consented;
to maintain business records, accounting records, and tax compliance;
to detect, prevent, and investigate fraud, misuse, security incidents, and other unlawful activity;
to comply with legal and regulatory obligations;
to establish, exercise, or defend legal claims.

4. Legal basis for processing

We only process personal data where we have a lawful basis under UK GDPR. Depending on the context, our legal bases may include:

Contract: where processing is necessary to enter into or perform a contract with you, such as fulfilling an order or responding to a request for a quotation.
Legal obligation: where processing is necessary to comply with applicable laws, including tax, accounting, consumer, and product safety obligations.
Legitimate interests: where processing is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. This may include improving our services, securing our systems, managing customer relationships, and preventing fraud.
Consent: where you have given us clear consent, for example for certain marketing communications or non-essential cookies.
Vital interests: in rare cases where processing is necessary to protect someone’s life.
Public task: generally not applicable to our business, but included where required by law.

Where we rely on legitimate interests, we assess the impact on your rights and only use your data where appropriate safeguards are in place.

5. Data sharing and third parties

We may share personal data with trusted third parties where necessary for the purposes described in this policy. These may include:

Payment service providers to process card and online payments;
Delivery and logistics partners to deliver products and manage returns;
IT, hosting, and cloud service providers to store and support our systems and website;
Analytics and advertising providers to help us understand website usage and improve our services;
Professional advisers such as accountants, insurers, lawyers, and auditors;
Customer relationship and communication tools used to manage enquiries and service communications;
Regulators, law enforcement, courts, and public authorities where disclosure is required or permitted by law.

We require third parties to process personal data only in accordance with our instructions, applicable law, and appropriate confidentiality and security obligations. We do not sell your personal data.

6. Data transfer to third countries

Some of our service providers may be located outside the United Kingdom, including in countries that may not provide the same level of data protection as the UK. Where we transfer personal data internationally, we will ensure that appropriate safeguards are in place, such as:

an adequacy regulation or adequacy decision recognised under UK law;
the UK International Data Transfer Agreement (IDTA);
the UK Addendum to the EU Standard Contractual Clauses; or
other lawful transfer mechanisms permitted under UK data protection law.

Where required, we will also carry out transfer risk assessments and implement additional technical and organisational measures to protect your data.

7. Storage duration

We keep personal data only for as long as necessary for the purposes for which it was collected, including to satisfy legal, accounting, tax, reporting, and dispute resolution requirements. Retention periods may vary depending on the type of data and the purpose of processing.

Customer and transaction records: typically retained for up to 6 years after the end of the relevant business relationship, unless a longer period is required by law.
Marketing data: retained until you unsubscribe, withdraw consent, or object, subject to any necessary suppression records.
Enquiry and correspondence records: retained for as long as needed to handle the enquiry and for a reasonable period thereafter.
Technical and analytics data: retained for a limited period in line with our cookie and analytics settings.

When personal data is no longer required, we will securely delete, anonymise, or archive it in accordance with our retention procedures.

8. User rights

Under UK data protection law, you may have the following rights in relation to your personal data:

Right of access: to request a copy of the personal data we hold about you and information about how we process it.
Right to rectification: to request correction of inaccurate or incomplete personal data.
Right to erasure: to request deletion of your personal data in certain circumstances.
Right to restriction: to request that we limit the processing of your personal data in certain circumstances.
Right to data portability: to receive certain personal data in a structured, commonly used, machine-readable format and to request transfer to another controller where technically feasible.
Right to object: to object to processing based on legitimate interests, and to object at any time to direct marketing.

These rights are not absolute and may be subject to legal exceptions. To exercise any of these rights, please contact us using the details in the Contact Information section below. We may need to verify your identity before responding.

9. Withdrawal of consent

Where we rely on your consent to process personal data, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

You can withdraw consent by using any unsubscribe link provided in our communications, adjusting your cookie preferences where applicable, or contacting us directly at [email protected].

10. Right to complain

If you have concerns about how we handle your personal data, we encourage you to contact us first so that we can try to resolve the issue.

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner’s Office (ICO):

Website: https://ico.org.uk

Telephone: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom

11. Data security

We take appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, misuse, alteration, disclosure, or destruction. These measures may include access controls, encryption where appropriate, secure storage, staff confidentiality obligations, system monitoring, and regular review of our security practices.

While we work hard to protect your data, no system can be guaranteed to be completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will act in accordance with applicable legal requirements, which may include notifying you and the ICO where required.

12. Contact information

If you have any questions about this Privacy Policy or our use of personal data, or if you wish to exercise your rights, please contact:

Thornfield Chair Studio
27 King Street, Improve, Kent, TN24 8QL, UK
Email: [email protected]
Phone: +44 20 7946 8372

13. Changes to privacy policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational requirements. Any updates will be posted on this page with a revised effective date where appropriate.

We encourage you to review this Privacy Policy periodically to stay informed about how Thornfield Chair Studio protects your personal data.

6/26/2026 Home