Privacy Policy

Privacy Notice – At a Glance

We respect your privacy and are committed to protecting your personal data.

What we use your data for

We use your information to:

• Process and deliver your orders.
• Manage your account and provide support.
• Improve your shopping experience.
• Send marketing (only where permitted)
• Keep our business and customers safe.

What we collect

We may collect:

• Contact details (name, email, address, phone)
• Payment and order information
• Website usage data (cookies and browsing behaviour)
• Preferences and marketing choices

How we share your data

We share your data only where necessary, for example with:

• Delivery companies
• Payment providers
• IT and website service providers
• Marketing and analytics providers

We never sell your personal data.

How long we keep your data.

• Orders: up to 6 years (legal/tax requirements)
• Accounts: while active and up to 2 years after inactivity
• Marketing: until you opt out or withdraw consent

Your rights

You can:

• Access, correct or delete your data.
• Object to marketing.
• Withdraw consent at any time.

Email: DPO@pavers.co.uk

Full Privacy Notice (Detailed Version)

Who we are.

Pavers Limited (“we,” “us,” “our”) is the data controller responsible for your personal data.

Contact details.

Data Protection Officer

Pavers Ltd

Michael House

Hackness Road

Northminster Business Park

Upper Poppleton

York

YO26 6QR

Email: DPO@pavers.co.uk

What personal data we collect

We may collect and process the following categories of personal data:

• Identity data (e.g. name, date of birth)
• Contact data (e.g. address, email, phone number)
• Transaction data (orders and purchases)
• Payment data (processed securely by payment providers)
• Account information.
• Marketing preferences
• Website usage (cookies, IP address, browsing activity)
• Communications and correspondence
• CCTV and security recordings (where applicable)
  

How and why, we use your personal data.

Process and deliver orders

• Data Used: Contact, payment, transaction
• Legal Basis: Contract

Manage accounts

• Data Used: Contact, account
• Legal Basis: Contract

Customer service

• Data Used: Contact, communications
• Legal Basis: Contract / Legal obligation

Marketing

• Data Used: Contact, preferences
• Legal Basis: Consent / Legitimate interests

Improve website and services

• Data Used: Usage data
• Legal Basis: Legitimate interests

Fraud prevention and security

• Data Used: Transaction, CCTV
• Legal Basis: Legitimate interests / Legal obligation
  

Lawful bases explained.

We rely on the following lawful bases:

• Contract – to provide the products or services you have requested.
• Consent – for marketing where required.
• Legitimate interests – such as improving our services, preventing fraud, and promoting relevant products to existing customers.
• Legal obligation – to comply with laws and regulations.

Where we rely on legitimate interests, we ensure this does not unfairly impact your rights.

How we share your data

We may share your data with:

• Delivery and logistics providers
• Payment processors
• IT, hosting, and system providers
• Marketing and analytics partners
• Regulators or law enforcement where required.

We may also share data within our group of companies.

Third-party services we use.

We work with trusted third parties to support our services:

• Experian (Club Canvasse) – Used to better understand customer behaviour and improve marketing effectiveness. Data shared is limited and used in aggregated form.
• Trustpilot – We may invite you to leave a review. If you submit one, Trustpilot processes your data under its own privacy notice.
• SMS providers – Used to send transactional and marketing messages (if you have opted in). You can opt out at any time.
• Friendly Captcha – Used to prevent spam and automated abuse, based on our legitimate interest in maintaining website security.

We share data with these providers based on contract, consent, or legitimate interests depending on the service.

International transfers

Some of our providers may be based outside the UK.

Where this happens, we ensure safeguards are in place such as:

• UK adequacy regulations
• International Data Transfer Agreements (IDTA)

Data retention

We keep your data only for as long as necessary:

• Financial and order records: up to 6 years
• Customer accounts: active period + up to 2 years inactivity
• Marketing data: until you withdraw consent or opt out.
• CCTV: typically, up to 30 days

Cookies and tracking

We use cookies to operate and improve our website. These include:

• Essential cookies (required for site functionality)
• Analytics cookies (to understand usage)
• Marketing cookies (to personalise content and advertising)

For more information, see our Cookie Policy.

Automated decision-making

We do not carry out automated decision-making that has legal or similarly significant effects on you.

Security

We take appropriate technical and organisational measures to protect your personal data, including access controls, secure systems, and monitoring.

Your rights

You have the right to:

• Access your data.
• Correct inaccurate information.
• Request deletion.
• Restrict processing.
• Object to processing (including marketing)
• Request data portability.
• Withdraw consent at any time.

To exercise your rights, please contact us using the details above.

Complaints

If you have concerns about how we handle your data, please contact us first.

You can also complain to the Information Commissioner’s Office (ICO): https://www.ico.org.uk/make-a-complaint

Children

Our services are not intended for children, and we do not knowingly collect their data.

Updates to this notice

We may update this privacy notice from time to time. The latest version will always be available on our website.

Last updated: June 2026