Privacy Policy

What this Privacy Policy covers

SW1 Lightworks respects your privacy and is committed to handling personal information fairly, lawfully and securely. This policy explains what information we collect, why we use it, who we may share it with, how long we keep it and the rights available to you.

It applies when you visit or use our website, create a customer or trade account, buy or return a product, save an item, make a project enquiry, apply for a trade account, communicate with us, subscribe to marketing or otherwise interact with SW1 Lightworks.

We use “personal information” to mean information that identifies you, relates to you or could reasonably be linked with you. It does not include information that has been irreversibly anonymised.

SW1 Lightworks Limited is the data controller

SW1 Lightworks Limited is the controller of the personal information described in this policy. This means we decide why and how that information is used.

Our company details are:

• Company: SW1 Lightworks Limited, company number 17012346.
• Registered office: Unit 4, Drakes Court, Eagle Road, Langage Industrial Estate, Plymouth, Devon, PL7 5JY.
• Privacy email: [email protected].

You can use the contact details in section 21 to ask a question, exercise a data-protection right or make a complaint.

The information depends on how you interact with us

It may include:

• Identity information: your name, title, username or account identifier.
• Contact information: billing and delivery addresses, email address, telephone number and communication preferences.
• Account information: login details, encrypted password credentials, account settings, saved items, wish lists and order history.
• Order and transaction information: products ordered, prices, discounts, payment status, invoices, delivery details, returns, refunds and warranty claims.
• Trade and business information: business or practice name, job title, company number, VAT information, website, business address, number of employees, trade type, project sector and information supplied to support a trade-account application.
• Project information: project names, sites, plans, specifications, budgets, timescales, product selections, quotations, samples and correspondence.
• Payment information: payment method, transaction reference and limited payment metadata. Complete card details are normally collected and processed by our payment provider rather than stored by SW1 Lightworks.
• Customer-service information: emails, calls, messages, complaints, photographs, installation details and other information you provide in relation to an enquiry, delivery, return, fault or warranty matter.
• Marketing information: subscriptions, consent records, preferred channels, campaign interactions and unsubscribe requests.
• Technical and usage information: IP address, device and browser information, approximate location derived from IP address, website activity, referring pages, session information, cookie identifiers and security logs.
• Fraud and risk information: information used to assess payment, account or transaction risk, including delivery mismatch indicators and results returned by fraud-prevention providers.
• Public and third-party information: business information from public registers, professional websites, social platforms or a business you work for, where relevant to a trade application or project relationship.

Information may come from you, our systems or relevant third parties

We collect information:

• directly from you, including through forms, account registration, checkout, trade applications, project enquiries, telephone calls, email and in-person discussions;
• automatically when you use our website or account, through server logs, cookies and similar technologies;
• from payment, delivery, fraud-prevention, website and customer-service providers;
• from your employer, colleague, architect, designer, contractor, installer or another person involved in a project;
• from public sources such as Companies House, professional websites and business directories; and
• from associated group companies or suppliers where this is necessary to support an enquiry, fulfil an order or manage a project.

If you provide information about another person, you should make sure you are authorised to do so and, where appropriate, direct them to this policy.

Every use of personal information requires a lawful basis

The main bases we rely on are:

• Contract: the processing is necessary to enter into or perform a contract with you.
• Legal obligation: the processing is necessary to comply with law, tax, accounting, consumer-protection or regulatory requirements.
• Legitimate interests: the processing is necessary for a genuine business interest and those interests are not overridden by your rights and interests.
• Consent: you have made a clear choice, which you may withdraw at any time.

Where we rely on legitimate interests, these may include operating an efficient retail and trade business, supporting customers and projects, improving our website, protecting systems and transactions, recovering debts and understanding commercial performance. We consider the likely impact on individuals before relying on this basis.

We will not use personal information for a materially different and incompatible purpose without first assessing the legal position and, where required, providing additional information or asking for consent.

Where information is marked as mandatory, it is normally needed to create an account, assess a trade application, enter into a contract, process an order, arrange delivery or meet a legal requirement. If you do not provide it, we may be unable to provide the relevant account, quotation, product or service. Optional information helps us tailor the experience but is not required unless we explain otherwise.

Customer and trade accounts

You may be able to create a customer account to manage orders, addresses, saved products and preferences. Trade users may also apply for access to trade pricing, services, specifications, downloads and project support.

We use account information to authenticate users, provide account functionality, administer trade eligibility, maintain records and protect the account from unauthorised access. You are responsible for keeping your login details confidential and should contact us promptly if you believe an account has been compromised.

A trade application may be reviewed using the information you provide, public business records and other reasonable checks. We do not intend to make decisions producing legal or similarly significant effects solely by automated means. Where an automated risk indicator is used, it supports rather than replaces appropriate human review.

Orders, delivery, returns and warranties

When you place an order, we use your identity, contact, transaction and delivery information to accept payment, confirm the order, allocate stock, arrange delivery and provide service updates. We may share the minimum information needed with payment providers, couriers, warehouses, suppliers or installers involved in fulfilment.

For returns, damaged or incorrect items, refunds and warranty claims, we may ask for photographs, serial or batch details, installation information, purchase evidence and a description of the issue. We use this to assess the request, arrange collection or replacement, investigate product quality and meet our contractual and legal responsibilities.

Some products may be supplied, prepared or supported by third-party manufacturers. Where their involvement is necessary, we may share relevant order or technical information with them. We will not share more personal information than is reasonably needed for that purpose.

Saved products and project enquiries

Our website may allow you to save products, create wish lists or retain a basket. These features may use your account and, where you are not signed in, cookies or local device storage. Saved items may be used to restore your selections, support a quotation or help us understand aggregate product interest.

Project enquiries may include drawings, schedules, specifications, budgets, photographs, site details and information about multiple project participants. We use that information to develop recommendations, prepare quotations, coordinate samples and support delivery. Please avoid including personal information in project documents unless it is relevant and necessary.

Marketing communications remain your choice

You may choose to receive product news, collection launches, availability updates, editorial content, invitations, offers or other marketing from SW1 Lightworks by email, SMS or another channel we make available.

We will send electronic marketing where you have consented or where applicable law permits us to contact an existing customer about similar products or services. We do not make agreement to marketing a condition of opening a trade account or purchasing a product.

You can unsubscribe at any time by using the link in an email, replying with the stated opt-out instruction, changing available account preferences or contacting us. We may keep a minimal suppression record so that we continue to respect your choice.

Website analytics, cookies and similar technologies

Our website is built using WordPress and WooCommerce. It uses cookies and similar storage or access technologies to operate essential functions, keep the website secure, remember choices, support baskets and accounts, measure performance and, where enabled, understand how visitors use the site.

Some technologies are necessary for the website or a service you request. Other technologies may be used only after consent or where a specific legal exception applies. Where an objection mechanism is required, we will provide a simple way to use it.

Our cookie banner and separate Cookie Policy will identify the technologies in use, their providers, purposes and durations. Your choices can be revisited through the cookie settings link on the website.

Analytics or session-insight tools may collect information such as pages visited, interactions, device type and technical identifiers. We configure these tools to reduce unnecessary collection and use them to improve the website and service. We do not intend to use session recordings to capture payment-card details, passwords or free-text information that should be excluded or masked.

Payments are primarily processed by Stripe

Online payments are primarily processed by Stripe. SW1 Lightworks normally receives confirmation of the payment, a transaction reference and limited information needed for accounting, refunds and fraud management. Complete card details are generally entered into and handled within Stripe’s secure payment environment rather than stored by us.

Stripe, banks and fraud-prevention services may process information under their own legal responsibilities and privacy notices. They may use automated checks to assess risk, authenticate a payment or prevent fraud. A payment may be delayed or declined by Stripe or the relevant card issuer.

Stripe’s own privacy notice provides further information about how it processes personal information when providing payment services.

We do not sell personal information

We may share it where necessary with:

• website, ecommerce, hosting, cloud-storage, IT support and cybersecurity providers, including GSL Media where it has development or support access;
• payment processors, banks and fraud-prevention providers;
• warehouses, couriers, delivery partners, installers and returns providers;
• manufacturers, suppliers and product specialists involved in an order, quotation, project or warranty matter;
• email, SMS, customer-relationship, helpdesk, survey and marketing providers;
• analytics, consent-management and website-performance providers;
• professional advisers, including accountants, auditors, insurers and lawyers;
• associated group companies, including where shared systems, fulfilment or support services are used;
• government bodies, regulators, courts, law-enforcement agencies or other authorities where required or permitted by law; and
• a buyer, investor, lender or adviser involved in a genuine corporate transaction, subject to appropriate confidentiality and safeguards.

Service providers acting on our instructions are required to handle information securely and only for agreed purposes. Some recipients, such as payment providers, banks, couriers or professional advisers, may also act as independent controllers for aspects of their work.

We may use anonymised or aggregated information for analysis, planning and reporting where individuals are not identifiable.

International customers and transfers

SW1 Lightworks is established in the United Kingdom and intends to serve customers and project partners in the UK and international markets. Customers may place orders, contact us or access the website from outside the UK.

Some service providers, group companies, suppliers or support teams may be located outside the UK, or may store or access information from another country. Where UK transfer rules apply, we will use an approved mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved contractual clauses, or another lawful safeguard or exception. Where required, we will assess whether additional measures are needed.

If we expand active targeting or operations in the European Economic Area, United States, Gulf states or other territories, we may provide additional regional notices or rights and appoint a representative where the applicable law requires it. This policy remains focused on SW1’s obligations under UK data-protection law.

How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet contractual, tax, accounting, warranty, consumer-protection and legal requirements. Retention can also depend on whether a dispute, complaint, safety issue or legal claim is ongoing or reasonably anticipated.

We may retain information for longer where law requires it, a regulator or court directs us to do so, or it is needed to establish, exercise or defend legal claims. We may retain anonymised information without a fixed time limit because it no longer identifies an individual.

Protecting personal information

We use appropriate technical and organisational measures designed to protect personal information against accidental loss, unauthorised access, misuse, alteration or disclosure. These measures may include encrypted connections, access controls, role-based permissions, multi-factor authentication, secure payment processing, system updates, backups, logging, staff procedures and supplier due diligence.

No online service can guarantee absolute security. You should use a strong and unique password, keep account credentials confidential, sign out on shared devices and contact us promptly if you suspect unauthorised access or receive a suspicious communication claiming to be from SW1 Lightworks.

Where a personal-data breach occurs, we will investigate, take appropriate steps to limit harm and notify affected individuals and the Information Commissioner where the law requires us to do so.

Your rights under UK data-protection law

Depending on the circumstances, you may have rights to:

• be informed about how your personal information is used;
• ask for access to the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information in certain circumstances;
• ask us to restrict how information is used in certain circumstances;
• receive certain information in a structured, commonly used and machine-readable format, and ask us to transmit it to another organisation where technically feasible;
• object to processing based on legitimate interests and object at any time to direct marketing;
• withdraw consent at any time, without affecting processing carried out before withdrawal; and
• ask for safeguards in relation to a decision made solely by automated means that produces legal or similarly significant effects, where applicable.

These rights are not absolute and may not apply in every case. We may need to verify your identity before acting on a request. We will respond within the period required by law and will explain if we cannot comply in full.

You will not normally have to pay a fee. A reasonable fee may be charged, or a request may be refused, where the law permits this because a request is manifestly unfounded or excessive.

Data-protection complaints

You may make a data-protection complaint using the contact details in section 21. Please explain what happened, what information is involved and what outcome you are seeking.

We will acknowledge a data-protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay. We may ask for information needed to understand or verify the complaint, and we will keep a record of how it was handled.

You also have the right to complain to the Information Commissioner’s Office. Its website is www.ico.org.uk. We would appreciate the opportunity to address your concerns directly first, but you are not required to contact us before approaching the ICO.

Our products and services are intended for adults

We do not knowingly create accounts for, market to or collect personal information directly from children. If you believe a child has provided information to us without appropriate involvement from a parent or guardian, please contact us.

Other websites and services control their own practices

Our website may link to manufacturers, social-media platforms, payment services or other third-party websites. Those organisations control their own use of personal information. We recommend reading their privacy information before providing information or using their services. SW1 Lightworks is not responsible for the privacy practices of independent third parties.

Changes to this policy

We may update this policy to reflect changes to our business, website, providers, products, international operations or the law. The current version will be published on our website with its review date. Where a change is significant, we may also provide an account notice, email or other prominent communication.

Privacy questions, rights requests or complaints

Please email us at [email protected] using the option that best matches your enquiry.