Privacy Policy

1. Who we are and how to contact us

This website is operated by Craft Wales, at Unit 14, Duffryn Business Park, Ystrad Mynach, Hengoed, CF82 7RJ. Craft Wales is responsible for deciding how personal information collected through this website is used.

You can email info@craft-wales.co.uk or ring 01443 858 113 about this policy or your information.

Legal entity and company registration number: [TO BE CONFIRMED]
ICO registration number: [TO BE CONFIRMED]
Data protection contact: [TO BE CONFIRMED]

2. Information you give us

The enquiry form collects your name, organisation, email address, phone number, the kind of project you want, who it is for, the site town or postcode, your message, any photographs of the site you choose to upload, and your agreement to being contacted. Optional fields can be left blank. We save the enquiry, any uploaded photographs and the time it arrives in our private website storage.

The concept tool asks for your name, organisation, email address, optional phone number and agreement to contact. At present, the name, organisation, phone number and checkbox are checked in your browser but are not saved as an enquiry by this tool. Your email address is sent to our server to calculate a one-way fingerprint which records how many pictures you have requested. The allowance records store that fingerprint and request identifiers, not your readable email address.

Your structure choices and any notes are sent to the picture-generation service. If you upload a site photograph, it is sent to that service to create a concept. Uploaded photographs are not kept in this website's database or photo library; they are processed for the request. This does not establish how long the external picture service may keep processing records or images.

Please do not include sensitive personal information in messages or notes. Avoid uploading photographs showing identifiable children, other people or private documents.

3. Why we use your information

We use enquiry details to respond, discuss your project, arrange a site visit and prepare a quotation. Where you are enquiring about a contract for yourself, the proposed lawful basis is taking steps at your request before entering a contract. For enquiries on behalf of an organisation, the proposed basis is our legitimate interest in responding to business enquiries.

We use the concept tool's email fingerprint to enforce the picture allowance and prevent misuse. The proposed basis is our legitimate interest in providing a usable service and controlling abuse. Information needed for legal obligations may be processed on that basis.

The contact checkbox records your permission to reply about your enquiry. It is not a subscription to marketing emails. We do not use this checkbox as permission for unrelated marketing.

[LAWFUL BASES AND LEGITIMATE INTEREST ASSESSMENTS TO BE CONFIRMED BEFORE LAUNCH]

4. How long we keep information

We should keep information only for as long as it is needed for the enquiry, any resulting work and applicable legal or record-keeping obligations. The client has not yet agreed the retention periods. The current enquiry and concept allowance records have no automatic deletion schedule, so we cannot promise that they are deleted after a particular period.

Enquiry retention period: [TO BE CONFIRMED]
Concept allowance record retention period: [TO BE CONFIRMED]
External picture-service retention: [TO BE CONFIRMED]

5. Who receives information

Our website hosting and database services process information to run the site and store enquiries. The concept tool sends your choices, notes and any uploaded photograph through Lovable's picture service to its image-processing provider. Your email address is used by our server for the allowance check; it is not included in the picture instructions.

Google receives connection information when your browser loads embedded maps or the site's fonts. Clicking a social or other external link takes you to a service with its own privacy policy. Service providers may process information outside the UK.

Information may also need to be shared where required by law. Any sharing with advisers or other suppliers must be limited to what is necessary for the relevant purpose.

[SERVICE PROVIDERS, PROCESSING AGREEMENTS AND INTERNATIONAL TRANSFER SAFEGUARDS TO BE CONFIRMED BEFORE LAUNCH]

6. Cookies and similar technology

Cookies are small files saved by your browser. Browser storage can serve a similar purpose. The homepage currently shows an essential-cookie notice. Dismissing it closes the notice for that page visit; it does not record a lasting preference or prevent third-party content from loading.

Embedded Google Maps and Google Fonts connect your browser to Google. Maps may use cookies or similar technology under Google's own policy. Your browser settings can restrict or delete cookies, although this may affect embedded content.

[COOKIE INVENTORY AND ANY REQUIRED CONSENT CONTROLS MUST BE VERIFIED AND COMPLETED BEFORE LAUNCH]

7. Your rights

Under UK data protection law, you may ask to see your personal information, correct inaccurate information, request deletion or restrict its use. Depending on the circumstances, you may also object to processing and ask for a portable copy of information you provided.

Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing. Some rights have exceptions, including where we need to keep records to meet a legal obligation. Contact us using the details above; we may need to confirm your identity. We normally respond within one month, subject to the extensions allowed by law.

8. Complaints and changes

Please contact us if you are concerned about how your information is handled. You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, through the ICO complaints service or on 0303 123 1113.

We will update this policy if the way the site handles information changes. The date above shows when this draft was last updated.