Privacy policy

Privacy Policy

Cambridge Skylights Limited

Last updated 17 October 2026

This policy explains how Cambridge Skylights Limited uses personal information when you visit cambridgeskylights.co.uk, contact us, request a quotation, buy from us or deal with us as a trade contact. It also explains your choices and data protection rights.

1 Who is responsible for your information

Cambridge Skylights Limited is the controller of the personal information described in this policy. We are registered in England and Wales under company number 13533197.

Registered office: Allia Future Business Centre Cambridge, King Hedges Road, Cambridge, Cambridgeshire, CB4 2HY, United Kingdom.

For privacy queries, rights requests or complaints, email info@cambridgeskylights.co.uk, telephone 01223 782 348, or write to Privacy Enquiries, Cambridge Skylights Limited, Units 1 and 2, Valley Farm Business Park, 1 Station Road, Meldreth, SG8 6JP, United Kingdom.

We handle personal information under the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, as amended, including by the Data (Use and Access) Act 2025.

2 Information we collect and its sources

Information you provide includes your name, email address, telephone number, billing and delivery addresses, company details, order and quotation details, product requirements, messages, reviews, photographs and documents you choose to send. Please avoid sending unnecessary sensitive information.

Transaction information includes products ordered, payments, refunds, payment status and relevant payment references. Payment providers process card details through their own secure systems. We receive the transaction information needed to manage your payment and order; access to full payment details depends on the payment method and provider.

Delivery and collection information may include your nominated recipient or site contact, access instructions, delivery communications, tracking information, signatures and proof of delivery. If you give us someone else's details, tell them that you have done so and direct them to this policy.

We receive information through our website, contact forms, email, telephone, chat, social media and trade enquiries. We may also receive relevant information from payment providers, couriers, suppliers fulfilling an order, your authorised representative and public business sources. For information obtained indirectly, we provide the required privacy information within a reasonable period and no later than one month, our first communication or our first disclosure, as applicable, unless a lawful exception applies.

Website and device information can include IP address, browser and device details, pages viewed, referral and advertising identifiers, interactions, purchases and cookie or similar identifiers. The information collected depends on the technologies in use and your privacy choices.

Call tracking can associate a telephone enquiry with a website visit or advertising source and record call metadata such as time and duration. If a telephone call is recorded, we will tell you at the start and explain its purpose.

3 Why we use information and our legal bases

We use different legal bases for different purposes. Where we rely on legitimate interests, we consider the necessity of the processing and balance those interests against your rights and reasonable expectations.

Purpose	Legal basis
Answer your product enquiry, prepare a quotation at your request, and accept, fulfil or refund your order.	Taking steps at your request before a contract or performing our contract with you. For a representative of a business customer, our legitimate interests in managing that business relationship.
Arrange delivery, collection, customer support and guarantee administration.	Performing our contract with you; legitimate interests in providing support and managing trade contacts. Legal obligation where a statutory duty applies.
Keep tax and accounting records, meet product-safety duties, and respond to binding legal requests.	Compliance with legal obligations.
Protect accounts and payments, prevent fraud and advertising abuse, secure our systems, and establish or defend legal claims.	Our legitimate interests in protecting customers, preventing loss and protecting our legal rights; legal obligation where applicable. Device technologies still require consent where PECR requires it.
Understand website use and advertising results, personalise advertising and measure conversions.	Consent for optional tracking and related personalised advertising. Separate essential security processing relies on the basis explained above.
Send email or text marketing about our products.	Consent; or legitimate interests where the products and services soft opt-in lawfully applies, as explained below.
Manage genuine reviews, improve support, and handle call metadata or recordings where used.	Legitimate interests in understanding customer experience and resolving enquiries, subject to transparency and any consent required for tracking. Marketing reuse of identifiable content requires an appropriate separate basis.

 

4 Marketing choices

We send marketing emails or texts to individuals where you have consented, or where the products and services soft opt-in applies. For that exception, we must have obtained your details directly during a sale or genuine negotiations for a sale, market only our similar products or services, and have offered a clear opt-out when collecting your details and in every subsequent message.

Simply contacting us does not automatically mean that you have agreed to marketing. We do not treat all historic enquiries or contact-form submissions as a marketing list. Different PECR rules can apply to corporate subscribers, but data protection rights and objections still apply to named business contacts.

You can stop marketing at any time by using the unsubscribe option or contacting us. You do not need to create an account or log in. We may retain limited information on a suppression list to respect your choice.

You have an absolute right to object to the use of your personal information for direct marketing, including related profiling. This is separate from any right to object to other processing.

Order confirmations, delivery updates and necessary responses to your enquiries are service communications. Marketing preferences do not prevent us from sending these when needed.

5 Cookies analytics and advertising

Our website uses cookies and similar technologies, including pixels, tags and local storage. Essential technologies support functions such as the basket, checkout, security and remembering privacy choices. Optional technologies can help measure website use, attribute calls or purchases, show personalised advertising or provide additional features.

Before using technologies that require consent, we ask for your choice. You can accept, reject or choose optional categories and change or withdraw consent through the website's cookie settings. Browsing the site or accepting our sales terms does not by itself give consent to optional tracking.

Some limited uses of storage or access technologies can qualify for a statutory exception. Where we rely on an exception, we must meet its conditions, including clear information and a simple way to object where required. An exception for limited statistical use does not automatically cover advertising or cross-site profiling.

Our technology providers include Shopify for the store and its integrations; Google Analytics, Google Ads and Google Tag Manager; Meta services such as Facebook and Instagram; TikTok; Analyzify for measurement; CallRail for call attribution; FraudBouncer for traffic protection; LiveChat for customer conversations; Loox for reviews; Lookfy for gallery features; and Pandectes for consent management. A feature's availability and the information it receives depend on the enabled integrations, its purpose and your choices. A provider's name here does not mean every feature of its services is enabled.

Advertising and conversion tools can receive information about pages, enquiries and purchases, device or advertising identifiers and, where enabled with the required permission, contact identifiers such as an email address transformed using hashing for matching. Hashing does not necessarily make information anonymous. We do not upload an enquiry list for customer-audience matching merely because someone has contacted us.

We provide details of individual technologies, their providers, purposes and lifetimes through our cookie settings. You can also ask us for that information using the contact details above. Browser settings offer additional controls, although blocking essential technologies may affect the store.

Third-party privacy information is available from Shopify at https://www.shopify.com/legal/privacy, Google at https://policies.google.com/privacy, Meta at https://www.facebook.com/privacy/policy and TikTok at https://www.tiktok.com/legal/page/eea/privacy-policy/en. Those notices explain the providers' own processing and do not replace our responsibility for information we control.

6 Who receives information

We share only information relevant to the purpose with service providers and other recipients as appropriate. These include our ecommerce and hosting providers, payment and fraud-prevention providers, couriers and delivery-planning services, suppliers fulfilling or supporting your order, email and customer-service providers, review platforms, consent and measurement providers, and professional advisers such as accountants, insurers and solicitors.

Advertising providers receive information only where we have a lawful basis and any required consent. We may also disclose information to regulators, law-enforcement bodies, courts or other parties where legally required or necessary and lawful to protect rights or safety.

If the business is sold or reorganised, relevant information may be shared with advisers and a prospective or actual successor, subject to appropriate safeguards and the applicable legal basis.

Providers acting as processors must handle information under appropriate contractual instructions. Some providers, including payment and advertising platforms, also act as independent controllers for specified purposes. We do not sell customer contact lists.

7 Processing outside the United Kingdom

Some providers process information outside the UK, including in the European Economic Area, Canada and the United States. The applicable locations depend on the service and its subprocessors.

Where a restricted international transfer takes place, we use a lawful transfer mechanism. This may be UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where the recipient is properly certified and the transfer is covered, or appropriate contractual safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, with the required assessment and additional safeguards where needed.

Contact us for information about the safeguards relevant to your information and how to obtain a copy, with confidential material redacted where appropriate.

8 How long we keep information

We keep personal information only for as long as it is needed for the purpose for which it was collected, subject to legal requirements. Different records have different retention needs.

Accounting and transaction records are generally kept for six years from the end of the financial year they relate to, or longer where tax law requires. We limit the personal information retained to what is needed for those records.

Order, guarantee and product-safety records are retained for the applicable support or guarantee period, any relevant legal claim period and any mandatory traceability or safety requirement. An active complaint, legal hold or claim can justify longer retention of relevant material.

For enquiries and quotations that do not become orders, we consider whether the enquiry is still active, whether meaningful follow-up is reasonably expected, when we last had substantive contact and whether any dispute or legal requirement justifies retention. We delete or anonymise records once these purposes no longer justify keeping them.

Marketing contact records are reviewed against consent, objections, engagement and the ongoing relevance of the relationship. Minimal suppression records may be kept for as long as needed to avoid contacting someone who has opted out. Cookie and device retention depends on the relevant technology; provider and expiry information is available in cookie settings.

Relevant backup copies are removed through the normal backup cycle and are protected from routine use while awaiting deletion.

9 Security and automated decisions

We use appropriate technical and organisational measures to protect personal information, restrict access to those who need it and require appropriate safeguards from providers. No online system can be guaranteed completely secure.

Security and payment tools may assess activity automatically, flag fraud risk or temporarily block suspicious activity. Advertising tools may group website activity or interests to personalise advertising where permitted. You can contact us if a security decision prevents a genuine order.

If an automated decision about you has a legal or similarly significant effect, the applicable data protection safeguards apply. Where required, we will explain the decision and its significance, provide meaningful information about the logic involved, and enable you to make representations, contest the decision and obtain human intervention.

10 Your rights

Depending on the circumstances and legal basis, you may ask to access your personal information, correct inaccurate information, erase information, restrict its use or receive certain information in a portable format. You may object to processing based on legitimate interests for reasons relating to your situation.

You can withdraw consent at any time without affecting the lawfulness of earlier processing. You can always object to direct marketing and related profiling. To exercise a right, contact us using the details above.

We normally respond without undue delay and within one month. We may need proportionate identity checks or clarification, and may extend the period where the law permits, explaining the reason and timing. Requests are normally free; we will explain any lawful exception. Rights are not absolute: for example, we may need to retain information required for tax records or legal claims.

Information needed to fulfil an order must be provided for us to accept or complete it. Optional marketing consent is not required to buy from us.

11 Privacy complaints

If you are concerned about how we use your information, contact us by email, telephone or post. You do not need a special form. We will acknowledge a data protection complaint within 30 days, investigate and take appropriate steps without undue delay, keep you informed and explain the outcome.

You can complain to the UK data protection regulator, the ICO, at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113. You do not lose that right by contacting us, and nothing in this policy prevents you from exercising legal rights or remedies.

12 Children external links and updates

Our store is intended for adults and is not directed at children. If you believe a child has provided personal information inappropriately, contact us so we can investigate and take appropriate action.

Other websites and platforms have their own privacy practices. Check their notices when you follow external links or deal with them directly.

We may update this policy to reflect changes in our services or legal requirements. We will show the revised date and provide additional notice where required. A policy update does not itself provide consent for a new use of your information.