Last updated

July 2026

Privacy notice

This notice explains how Valley Upholstery Ltd ("we", "us") handles personal data. We're the data controller for everything described below.

What we collect

• Quote and contact form submissions: name, email or phone, postcode (optional), service type, your message, and any photos you choose to upload for a quote.
• Email and WhatsApp correspondence: anything you send us by email, WhatsApp or write to us about, including photos you choose to send for a quote.
• Phone calls: we don't record calls; we may keep notes of what you've asked us to quote.
• Cloudflare Web Analytics (always on): page views, referrers and approximate location at city level. Cookieless and privacy-respecting; never personally identifiable.
• Google Analytics 4 (only if you accept cookies): page views, on-site clicks, form submissions, device and browser type. GA4 sets cookies (_ga, _ga_*) and processes your IP address in transit. We do not use advertising features and we do not link this data to your name. Off by default until you click "Accept analytics" in the cookie banner.

Why we collect it

• To respond to your enquiry and prepare a quote (lawful basis: legitimate interests / steps before entering a contract).
• To deliver work you've ordered and contact you about it (lawful basis: contract).
• To meet our legal obligations -- invoicing, VAT records, warranty (lawful basis: legal obligation).
• Cookieless analytics, to understand how the website is used so we can improve it (lawful basis: legitimate interests).
• Cookied analytics (Google Analytics 4) only when you have given consent (lawful basis: consent under PECR Reg 6 and UK GDPR Art. 6(1)(a)). You can withdraw consent at any time through "Cookie settings" in the footer.

Who sees it

• The Valley Upholstery team -- only people working on your job.
• Resend (transactional email; EU-hosted) -- to deliver quote-form submissions to our inbox and to send you a copy of your enquiry.
• Cloudflare, Inc. (hosting, DNS, R2 file storage, Turnstile bot protection, cookieless Web Analytics) -- handles request routing, quote-photo uploads and analytics.
• Google LLC (Google Analytics 4) -- only if you have accepted cookies. Google processes data in the United States.
• HMRC and our accountant for invoicing and tax records.
• That's it. We never sell your data, and we don't share it with marketing partners.

International transfers

Cloudflare's network is global, so personal data may be processed at the edge location closest to you. Cloudflare's transfers from the UK rely on the UK Extension to the EU-US Data Privacy Framework and Standard Contractual Clauses. Resend is EU-hosted and transfers from the UK to the EU rely on the UK adequacy regulations. Google (used only if you accept analytics cookies) processes data in the US under the same UK Data Privacy Framework extension.

How long we keep it

• Quote enquiries and quote photos: up to 12 months from your last contact, then deleted from R2.
• Order records (for warranty, accounting, VAT): six years from the end of the relevant tax year, as legally required.
• Cookieless analytics (Cloudflare Web Analytics): aggregated; no per-visit retention.
• Cookied analytics (Google Analytics 4): retention configured to the minimum permitted by GA4 (currently 2 months at user level).
• Anything else: deleted as soon as it's no longer needed.

Your rights

Under UK GDPR you have the right to access, correct, delete or restrict processing of your data, to object to processing or request portability, and to withdraw consent. Email sales@valleyupholstery.co.uk and we'll respond within one calendar month.

You can also complain to the Information Commissioner's Office if you're not happy with how we've handled your data.

Cookies

This site sets cookies only when they are strictly necessary, or after you have given consent.

• Strictly necessary, always on: Cloudflare Turnstile may set a short-lived bot-protection cookie when you submit a form. PECR Reg 6(4)(b) does not require consent for cookies that are essential for a service you have requested.
• Optional, only after you click "Accept analytics": Google Analytics 4 sets _ga and _ga_* cookies (typical two-year lifetime). You can withdraw consent at any time via "Cookie settings" in the footer; new GA cookies stop being set immediately.

We do not use advertising cookies, social pixels, or session-recording tools.

Contact us about privacy