Privacy Policy.

Who we are

NG Bespoke is the trading name of NG Bathrooms Ltd (Company No. 12306176), registered in England & Wales. We are the data controller for any personal data you provide to us through this website or our showroom.

• Address: Manor Farm Buildings, Vicarage Ln, Little Budworth, Tarporley, CW6 9BY
• Phone: 01625 30 60 30
• Email: [email protected]
• VAT No.: 343059904

What data we collect, and why

Information you give us through our forms

When you fill out any form on our site (contact, brochure request, or showroom appointment), we collect only what's needed for that specific purpose:

• Contact form: name, email address, phone number (optional), and the contents of your message. Used to reply to your enquiry.
• Brochure request form: name, email, postal address, and postcode. Used to post your brochure.
• Showroom appointment form: name, email, phone, postcode (optional), and your preferred date/time. Used to confirm your visit and prepare the showroom for the project type you're interested in.

We never use form data for anything you didn't ask us to do. We don't add you to a marketing list, we don't share your details with anyone outside the business, and we don't use the information for automated decision-making or profiling.

Information we collect automatically

Like most websites, our hosting provider (Cloudflare) processes basic technical information about every visit — your IP address, the pages you requested, the browser you used, and the time of the request. This is logged for security and performance reasons and is not used to identify or profile individual visitors.

Information you give us in person

If you visit the showroom, we may take notes of what you discussed with our designers (room measurements, style preferences, indicative budget). This is held only for the purpose of preparing a quote or a design — it is not shared outside the business.

Lawful basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Consent (Article 6(1)(a)) — when you submit a form, you actively tick the consent box agreeing to us holding your contact details to respond to your enquiry. The consent text is recorded alongside your submission for our records.
• Legitimate interest (Article 6(1)(f)) — for the technical logging Cloudflare performs to keep the site running and secure.
• Performance of a contract (Article 6(1)(b)) — once you become a customer, we process your data to design, supply and install your project.

Who we share your data with

We share your data only with the following service providers, all of which act as "data processors" on our behalf and only process your data for the specific purposes described:

• Cloudflare (hosting, CDN, security) — processes technical request data and runs the Turnstile anti-bot challenge on our forms. Cloudflare's privacy policy.
• Our internal lead-management system — form submissions are routed to a secure database hosted in the UK, accessible only by NG Bespoke staff.
• Email service providers — when one of our team replies to your enquiry, your email address is processed by our email provider in the normal way email is delivered.
• Royal Mail (or equivalent) — if you requested a brochure, your postal address is used to send it.
• Google (Analytics and Ads) — if you accept analytics and advertising cookies, Google processes your visit for site measurement and, where you arrived from one of our adverts, to report that the advert led to an enquiry. The contents of your form are never sent to Google. Google's privacy policy.
• Elfsight — we currently use a small Elfsight widget to display our public Instagram feed. Loading the widget shares your IP address with Elfsight and Instagram. Elfsight's privacy policy.

We do not sell, rent, trade or otherwise transfer your personal data to any third party for marketing or any other purpose.

How long we keep your data

• Enquiry data (people who contacted us but didn't become a customer): kept for up to 24 months from the date of last contact, then deleted.
• Customer data (people who commissioned a project): kept for the duration of the project plus seven years afterwards (HMRC record-keeping requirement for invoices and contracts).
• Cloudflare technical logs: retained for short periods (typically a few days) under Cloudflare's standard policy.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct any inaccurate or incomplete data
• Erase your data (the "right to be forgotten")
• Restrict how we process your data
• Object to processing carried out under legitimate interest
• Receive a copy of your data in a portable format
• Withdraw consent at any time, where we relied on consent

To exercise any of these rights, email [email protected] with the subject line "Privacy request". We will respond within one calendar month.

Cookies and similar technologies

We use Google Analytics 4, loaded through Google Tag Manager, to understand how visitors use the site so we can improve it. We also use Google Ads conversion tracking to see which of our adverts led to an enquiry. Both analytics and advertising cookies are denied by default and are only set after you accept via the cookie banner shown on your first visit (Google Consent Mode). Before you make a choice, no analytics or advertising cookies are stored.

• Google Analytics cookies (_ga and _ga_<container>) — set only if you accept analytics. They help us measure page views and how the site is used. If you decline, they are never set and analytics runs in a cookieless, non-identifying mode.
• Google Ads conversion cookies (e.g. _gcl_aw) — set only if you accept. If you arrived from one of our Google adverts, these remember that click so that, if you go on to submit a form, we can see the advert worked. They record the advert click and the fact an enquiry was made — not what you typed into the form. If you decline, they are never set.
• Your consent choice — remembered in your browser's localStorage (not a cookie). This is strictly necessary so we can honour your preference and not ask you again on every visit.
• Cloudflare security cookies (e.g. __cf_bm) — used to detect and block automated bot traffic. These are considered "strictly necessary" under PECR and don't require consent.
• Cloudflare Turnstile — when you submit a form, a small challenge runs to confirm you're not a bot. This may set a short-lived cookie. No data about you is sent to Google or anywhere else.
• Elfsight / Instagram cookies — only set if you scroll to the Instagram feed at the bottom of the homepage. These are third-party cookies set by Instagram for displaying media.

You can change or withdraw your choice at any time using the "Cookie preferences" link in the site footer, which re-opens the banner. Clearing this site's cookies and local storage in your browser also resets the choice, and you can disable cookies in your browser settings — doing so won't prevent the site from working.

Security

The site is served exclusively over HTTPS. Form submissions are sent to our backend over an encrypted connection. Form data is stored in a database that requires authentication and is only accessible to NG Bespoke staff who need it to do their jobs. We restrict access on a need-to-know basis and review it periodically.

No system is perfectly secure. If you believe your data may have been compromised, please contact us immediately.

Children's data

This website is not intended for children. We do not knowingly collect personal data from anyone under 16. If you believe we may have collected data about a child, please contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision. Material changes will be flagged on the homepage; minor wording or contact-detail updates will not.

Complaints

If you have a concern about how we handle your data, please contact us first at [email protected] — we'd rather hear about it and put it right.

You also have the right to complain directly to the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF