Privacy policy

1. Who we are

SETRUM LIMITED sells beds, walking gear, carriers, bowls, toys and grooming accessories for pets. We are the data controller for the personal data described in this policy.

• Legal entity: SETRUM LIMITED
• Registered in: England and Wales, company number 17405318
• Registered office: 3 Valley Road, Walsall, England, WS3 3EY
• Email: ceo@setrum.uk
• Telephone: +44 7911242261

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data we collect

Order and account data

• Your name, email address and telephone number
• Delivery address and billing address, plus any delivery instructions you leave for the courier
• What you ordered, order value, order and tracking numbers, and the sizes or colours you chose
• Returns, refunds, replacements and any warranty claims
• If you create an account, your login email and a securely hashed password

Payment data

• No payment is taken on this website. Once we have confirmed your order we send a payment link, and our payment provider handles the transaction. We do not see or store your full card number: we receive the payment result, the card type and the last four digits so we can match a payment to an order and process refunds.

Correspondence and preferences

• Messages you send us by email or phone about an order, and our replies
• Whether you have asked to receive our marketing emails, and when you signed up or unsubscribed
• Any product review or photo you choose to submit

Technical data

• Basic information recorded by our hosting provider when a page is served, such as IP address, browser type and the time of the request

We do not collect special category data (such as health, biometric or political data), and we do not ask for it. Please do not send us card numbers, passwords or other payment credentials by email.

3. Purposes and legal bases

We only use your data where the law allows it. The bases we rely on are:

• Performance of a contract: taking and confirming your order, taking payment, delivering the goods, keeping you updated on dispatch, and handling returns, refunds and faulty items.
• Legitimate interests: answering questions you send us, keeping records of what was ordered and agreed, preventing and investigating fraudulent orders, keeping our site secure, and improving our range and service. Where we rely on legitimate interests we have weighed them against your rights, and you can object at any time.
• Consent: sending you marketing emails about sales, new arrivals and restocks, and publishing a review you have submitted. You can withdraw consent at any time.
• Legal obligation: keeping accounting and VAT records, and meeting our duties under consumer protection and product safety law.

The basket and the checkout form on this website run entirely in your browser. Nothing you type is stored on the site or sent anywhere automatically: pressing "Place order" composes a message in your own email client containing the basket contents and the delivery details you entered, and it reaches us only if you choose to send it. The newsletter field on the home page works the same way. Closing or reloading the page clears the basket.

4. Who we share data with

We do not sell your data. We share it only with categories of recipients that help us run the shop:

• Delivery companies — the name, address, phone number and delivery notes needed to get your parcel to you
• Payment providers — to take payment securely and to issue refunds
• Suppliers — where an item ships directly from a supplier's warehouse, the delivery details for that parcel
• IT, hosting and email providers — as part of running the website and storing our correspondence
• Accountants and auditors — order and transaction records
• Professional advisers, insurers and regulators — where we are required to disclose data or need to establish or defend a legal claim

Where a recipient acts as our processor, we put a written contract in place requiring them to keep the data secure and to use it only on our instructions.

5. International transfers

We are based in the United Kingdom and prefer to keep data here. Some of our suppliers and service providers operate outside the UK. Where personal data is transferred abroad, we rely on UK adequacy regulations for the destination country, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the transfer needs. You can ask us for details of the safeguards used for a specific transfer.

6. How long we keep data

• Enquiries that do not lead to an order: up to 12 months from the last contact
• Account details: for as long as your account is open, and for six years after your last order
• Order, invoice and accounting records: six years after the end of the financial year they relate to, as required by tax law
• Marketing consent records: until you withdraw consent, plus a short period so we can show when and how consent was given or withdrawn
• Server logs: short-term retention set by our hosting provider

When a retention period ends we delete the data or anonymise it so it can no longer identify anyone.

7. Security

We use appropriate technical and organisational measures to protect your data: encrypted connections to our website and mail systems, hashed passwords, access controls so that staff only reach the records they need, managed and updated devices, and backups of our order records. No system is completely secure, but we review our measures regularly and will notify you and the Information Commissioner's Office where a breach requires it.

8. Cookies

This website does not set analytics, advertising or profiling cookies, and it does not store anything in your browser about your visit. We load a web font from Google Fonts, which means your browser requests that file from Google's servers and Google receives your IP address as part of that request. Our hosting provider keeps standard server logs as described above. If we ever add cookies that are not strictly necessary, we will ask for your consent first and update this policy.

9. Your rights

Under the UK GDPR you have the right to:

• Access — ask for a copy of the personal data we hold about you
• Rectification — have inaccurate or incomplete data corrected
• Erasure — ask us to delete data where there is no longer a good reason for us to keep it
• Restriction — ask us to pause our use of your data while a query about it is resolved
• Portability — receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time
• Withdraw consent — where our processing is based on consent

To exercise any of these rights, email ceo@setrum.uk. We will respond within one month. That period can be extended by two further months for complex requests, and we will tell you if that happens. We may ask you to confirm your identity before we release data. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

10. Withdrawing consent

Where we rely on your consent — for example to send you sale and restock emails — you can withdraw it at any time using the unsubscribe link in any message we send, or by emailing ceo@setrum.uk. Withdrawing consent does not affect processing carried out before you withdrew it, and it does not stop us sending messages about an order you have already placed, such as a dispatch or delivery notification.

11. Complaints

If you are unhappy with how we have handled your data, please contact us first so we can put it right. You also have the right to complain to the UK supervisory authority:

• Information Commissioner's Office (ICO)
• Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk

12. Age restriction

You must be at least 18 to place an order or open an account with us. Our website is not directed at children, and we do not knowingly collect data about anyone under 13. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy when our processes, suppliers or legal obligations change. The current version is always published on this page, and the date at the top shows when it was last revised. Where a change materially affects how we use your data, we will tell account holders by email.

14. Contact us

Questions about this policy, or about the data we hold about you, should go to SETRUM LIMITED, 3 Valley Road, Walsall, England, WS3 3EY, or by email to ceo@setrum.uk.