Privacy Policy

Who we are

UK Doors & Rooflights Co. is the trading name of Lux Window Systems Ltd, registered in England & Wales, company number 15458780, at Richmond House, 61 Hatherley Road, Cheltenham, England, GL51 6EG.

We are the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are responsible for looking after it.

For anything to do with your data, including access and deletion requests, contact Amy Mazzella: amymazzella@ukdoorsandrooflights.co, or 07467790607.

What we collect

Account details: your name, email address, company name, phone number, and the delivery and billing addresses you save. Your password is stored only as a one-way hash, so nobody here can read it.

Orders: the configurations you build, the prices calculated for them, your order history and status, and the reference for the payment. We do not see or store your card number, expiry or security code at any point. Those go directly to Stripe.

Quote requests: your name, email, phone if you give it, the configuration you were pricing, and anything you type in the message box.

Marketing sign-ups: if you take the welcome offer, your name, email, company name, phone if given, whether you are buying as a company or an individual, and the discount code we issue you.

If you message us on WhatsApp: the message you send and the phone number you send it from.

Analytics, only if you accept analytics cookies: pages viewed, and events such as adding a configuration to your basket, starting checkout, completing an order, or requesting a quote. Where the event is an order, that includes the order reference and its value.

Technical data: your IP address is held briefly in memory to rate limit our pricing, quote and sign-in endpoints against abuse. It is not written to the database and is not used to identify you.

Why we use it, and our lawful basis

To take and fulfil your order, provide your account and order history, and answer your questions about an order. Lawful basis: performance of a contract with you.

To respond to quote requests and enquiries, including by email, phone or WhatsApp. Lawful basis: taking steps at your request before entering a contract.

To send you marketing email and your welcome discount code. Lawful basis: your consent, given when you sign up, and withdrawable at any time.

To measure how the site is used so we can improve it. Lawful basis: your consent, given through the cookie banner. Declining is the default and nothing is measured until you accept.

To keep the site secure, prevent abuse of our pricing and sign-in endpoints, and investigate problems. Lawful basis: our legitimate interests in running a secure service, balanced against your rights.

To keep accounting and tax records. Lawful basis: our legal obligations under UK tax and company law.

Who we share it with

Made for Trade, our supplier, who manufacture what you order. To fulfil an order we pass them the specification and the delivery address. They are a separate controller for what they then do with it.

Stripe, who take the payment. Your card details go to Stripe directly and are never handled by our systems.

Resend, who deliver our transactional email: order confirmations, quote replies, password resets and discount codes.

Brevo, who hold our marketing mailing list, if you have signed up to it.

Google, through Google Analytics, if you accept analytics cookies. This includes the value and reference of a completed order.

Meta, if you choose to message us on WhatsApp. That conversation is covered by their privacy policy as well as this one.

Neon, who host our database, and Railway, who host the website itself.

We do not sell your personal data, and we do not share it for anyone else's marketing.

Where your data is held

Our database is hosted in the United Kingdom. Our transactional email is sent from within the European Economic Area.

Some of the companies above are based outside the UK, most notably Stripe, Google and Meta. Where personal data is transferred outside the UK, it is protected by the safeguards those transfers require, such as the UK addendum to the standard contractual clauses or an adequacy decision covering the country concerned.

How long we keep it

Orders, invoices and payment records: six years after the end of the financial year the order falls in. We are required to keep business and VAT records for six years, and the same period is the limit for bringing a claim on a contract, so we keep them for that long and no longer.

Your account: for as long as you have one. If you have not ordered or signed in for three years we will anonymise the account, keeping only the financial record above, which by then carries no login and no contact details.

Quote requests that do not become orders: two years. Extension and renovation projects routinely run longer than a year between the first price and the work starting, so a shorter period would mean losing the history of a live job.

Marketing list: until you unsubscribe. We also review the list every two years and remove anyone who has not opened or clicked anything in that time, rather than mailing people who have plainly lost interest.

Analytics: 14 months, which is the longest Google Analytics retains data at this level of detail.

WhatsApp conversations: two years, the same as any other enquiry.

You can ask us to delete your data sooner than any of this, and we will, except where we are legally required to keep a record of a transaction.

Marketing, and how to stop it

We only send marketing email to people who have asked for it. Every marketing email carries an unsubscribe link, and using it takes effect immediately.

Unsubscribing from marketing does not stop the emails we have to send about an order you have placed, such as your confirmation or a delivery update. Those are part of fulfilling the contract, not marketing.

Cookies

We use essential cookies to keep you signed in and remember your basket. These are always on, because the site cannot work without them.

Analytics cookies are set only if you accept them, and declining is the default. You can change your mind at any time on our cookie policy page, which carries the control as well as the explanation.

Fitting videos do not contact YouTube until you press play, and the WhatsApp button loads nothing from Meta until you use it. Our cookie policy sets all of this out in full.

Your rights

You have the right to ask us for a copy of the personal data we hold about you, to have anything inaccurate corrected, and to have your data deleted where we are not required to keep it.

You can also ask us to restrict how we use your data, object to us using it on the basis of our legitimate interests, and receive the data you gave us in a portable, machine-readable form.

Where we rely on your consent, for marketing or analytics, you can withdraw it at any time. That does not affect anything done before you withdrew it.

To exercise any of these, contact Amy Mazzella on the details at the top of this page. We will respond within one month. There is no charge.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first and we will try to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. Complaining to us first does not affect that right.

Changes to this policy

We update this policy when what we do with your data changes. This version is dated 8th September 2026. Where a change materially affects you, we will say so rather than quietly amend the page.