Privacy Policy

1. Who we are

This website is operated by SERORA BOUTIQUE LTD, a company registered in England and Wales under company number 17040935, with its registered office at 25 Effie Road, London, United Kingdom, SW6 1EL. We trade as Serora Boutique and supply furniture, rugs and lighting at wholesale to retailers, interior studios, marketplace sellers and resellers.

We are the data controller for the personal data described in this policy. That means we decide why and how it is used. You can reach us at [email protected] or on +44 7700 900482.

We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data we collect

Trade account and order details

When you open a trade account, request a price list or place a wholesale order, we collect the details you give us:

Your name and job title or role
Business email address and telephone number
Company name, registered address and VAT number where you have one
Delivery address, town or city and postcode
Order contents, quantities and any comment you add to the order

Details of your own customer, for direct dispatch

If you ask us to dispatch an order straight to the address of your end customer, we also process that person's name, delivery address and contact telephone number. We use those details only to complete the delivery you have instructed, and we act on your instructions as a processor for that part of the work. You remain responsible for having a lawful basis to pass those details to us and for telling your customer that a supplier will handle the delivery.

Correspondence

If you email or call us, we keep the message, our reply and any information you choose to include, so that we can deal with the enquiry and keep a record of what was agreed.

Technical data

Our hosting provider records standard server logs, which may include IP address, browser type and the pages requested. These logs are used for security and to keep the site running.

What we do not collect

We do not collect special category data, such as information about health, race, religion, political opinions, trade union membership, sex life or sexual orientation, and we do not collect criminal offence data. Please do not send us this kind of information.

The order form on this website does not send anything anywhere. It runs entirely in your browser so that you can build and price an order; nothing you type into it is transmitted to us or stored until you contact us by email or telephone.

3. Purposes and legal bases

We only use personal data where the law allows it. Our purposes and legal bases are:

Performance of a contract — setting up a trade account, preparing quotations, processing and dispatching orders, arranging delivery, handling returns and dealing with queries about an order.
Legitimate interests — responding to enquiries, keeping business records, checking the trade status of an applicant, preventing fraud and misuse, and improving our range and service. We balance these interests against your rights, and you can object at any time (see section 9).
Consent — where you have asked to receive range updates or price list emails from us. Consent is optional and can be withdrawn at any time.
Legal obligation — keeping accounting and VAT records, meeting product safety and consumer protection duties, and replying to lawful requests from a public authority.

We do not sell personal data and we do not share it for third party marketing. We share it with the following categories of recipient, only as far as they need it:

Carriers and pallet networks — name, delivery address and contact telephone number, so the consignment can be delivered and booked in. This includes deliveries sent directly to your customer.
Warehousing and fulfilment partners — order and delivery details for picking, packing and dispatch.
Manufacturers and suppliers — where a line is made to order or shipped from their site, the delivery details needed to complete that shipment.
Payment providers and banks — for invoicing and payment. Card details are handled by the payment provider, not by us.
Accountants and auditors — invoice and transaction records for bookkeeping, VAT and statutory accounts.
IT, hosting and email providers — who process data on our behalf under written terms.
Professional advisers, insurers and public authorities — where we are required to disclose information by law or need advice on a legal claim.

Where a third party acts as our processor, they are bound by a contract that requires them to act only on our instructions and to keep the data secure.

5. International transfers

We aim to keep personal data within the United Kingdom and the European Economic Area. Some of our suppliers and IT providers are based outside the UK, so data may be transferred abroad.

Where that happens, we rely on UK adequacy regulations for the destination country, or on the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, together with any additional safeguards needed. You can ask us for details of the safeguards used for a specific transfer.

6. How long we keep data

Enquiries that do not lead to an account — up to 12 months from the last contact.
Trade account records — for the life of the account and 6 years after it closes.
Order, invoice and VAT records — 6 years from the end of the financial year they relate to, as required by tax law.
Delivery details for direct dispatch — up to 12 months after delivery, so that claims and damage reports can be dealt with.
Marketing consent records — until consent is withdrawn, and then a minimal record of the withdrawal so we can honour it.
Server logs — normally up to 12 months.

When a retention period ends, we delete the data or anonymise it so that it can no longer identify anyone.

7. Security

We use technical and organisational measures appropriate to the risk. These include encrypted connections to this website, access controls and separate accounts for staff, restricting data to the people who need it, secure and backed-up systems, and written terms with the providers who process data for us.

No method of transmission or storage is completely secure. If a personal data breach is likely to result in a risk to people's rights, we will report it to the Information Commissioner's Office within 72 hours and tell the people affected where the law requires it.

8. Cookies

This website does not set advertising, analytics or tracking cookies, and it does not profile visitors. Your order basket is held in your browser's memory for the length of the visit and disappears when you close or reload the page; it is not stored on your device and is not sent to us.

Our host may set a strictly necessary cookie to keep the site secure and available. Cookies of that kind do not need consent under the Privacy and Electronic Communications Regulations. We load fonts from Google Fonts, which means your browser contacts a Google server and Google receives your IP address for that request.

You can block or delete cookies in your browser settings at any time. If we introduce cookies that are not strictly necessary, we will ask for your consent first.

9. Your rights

Under the UK GDPR you have the right to:

Access — get a copy of the personal data we hold about you.
Rectification — have inaccurate data corrected and incomplete data completed.
Erasure — ask us to delete data where there is no longer a good reason for us to keep it.
Restriction — ask us to pause our use of your data while a question about it is resolved.
Portability — receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller.
Object — object to processing based on legitimate interests, and object at any time to direct marketing.
Withdraw consent — where processing is based on consent.

To exercise a right, email [email protected]. We reply within one month and will tell you if we need longer because the request is complex. There is no fee unless a request is manifestly unfounded or excessive. We may ask for information to confirm who you are.

If you are the end customer of one of our trade clients and we hold your delivery details on their instruction, please contact the retailer you bought from. You can still write to us and we will pass the request on and help where we can.

Where we rely on consent, you can withdraw it at any time by emailing [email protected] or by using the unsubscribe link in any email we send. Withdrawing consent does not affect processing carried out before you withdrew it, and it does not affect data we keep for a contract or a legal obligation.

11. Complaints

If you are unhappy with how we handle your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO).

ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113, website ico.org.uk.

12. Age restriction

This is a trade-only website intended for businesses. It is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy to reflect changes in how we work or in the law. The date at the top of the page shows when it was last revised. Where a change materially affects how we use your personal data, we will tell account holders by email before it takes effect.

14. Contact us

SERORA BOUTIQUE LTD, company number 17040935
25 Effie Road, London, United Kingdom, SW6 1EL
Email [email protected]
Telephone +44 7700 900482
Website serora.boutique