Privacy policy

At Carpetrug, we respect your privacy and take the protection of your personal information seriously.

This Privacy Policy explains what information we collect, why we use it, how we keep it secure and what rights you have when shopping on our website or contacting us.

We handle personal information in accordance with applicable UK data protection laws, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and relevant subsequent amendments.

1. Who We Are

Carpetrug LTD, trading as Carpetrug, is responsible for deciding how and why personal information collected through our online store is used.

This makes us the data controller for the personal information described in this policy.

Business name: Carpetrug LTD
Trading name: Carpetrug
Company registration number: 17046568

Registered office:

6 Bromley Road
Shipley, BD18 4DS
United Kingdom

Email: [email protected]
Telephone: +44 1274 592728
Website: https://carpetrugco.com/

If you have questions about your personal information or wish to exercise your privacy rights, please contact us using the details above.

2. Personal Information We Collect

We collect the information needed to operate our online store, process purchases, deliver orders and respond to customer enquiries.

Depending on how you use our website, this may include the following information.

Customer and Order Information

When you place an order, we may collect:

Your full name.
Email address and telephone number.
Billing and delivery addresses.
Products ordered, including rug sizes and carpet measurements.
Order numbers, purchase dates and transaction details.
Payment status and transaction references.
Delivery, return and refund information.

Customer Account Information

If you create an account, we may collect:

Your name and email address.
Account login and authentication information.
Saved billing and delivery details.
Order history and account preferences.

Enquiries and Customer Support

When you contact us, we may collect:

Your name and contact information.
Messages submitted through our contact form or email.
Order numbers and details of your enquiry.
Information relating to commercial projects.
Photographs, room measurements or design images you choose to share.

Please avoid sending sensitive personal information unless it is necessary for your enquiry.

Website and Technical Information

When you visit our website, certain technical information may be collected, including:

IP address.
Browser and device information.
Operating system.
Pages visited and website interactions.
Cookie identifiers and consent preferences.
Security and diagnostic information.

Analytics and Advertising Information

Where applicable, Google Analytics 4 and Google Ads may process information relating to:

Website visits and traffic sources.
Product views and shopping activity.
Advertising interactions.
Purchase conversions and transaction identifiers.
Device and browser characteristics.
Cookie and advertising identifiers, where permitted.

The information collected depends on the services used, their configuration and your relevant consent choices.

3. Where We Obtain Personal Information

Most personal information comes directly from you when you:

Place an order.
Create an account.
Complete checkout.
Contact our customer service team.
Submit a contact form.
Provide images or other details for a project.
Make choices through our cookie consent banner.

We also collect certain information automatically through our website and its security, analytics and consent-management technologies.

We may receive payment confirmation, transaction references and relevant fraud-prevention information from Stripe, as well as delivery information from our shipping providers.

4. How and Why We Use Your Information

We only process personal information where we have an appropriate lawful basis.

How we use your information	Lawful basis
Processing and managing orders	Performance of a contract
Taking payments and arranging delivery	Performance of a contract
Handling returns and customer service	Contract and applicable legal obligations
Responding to pre-purchase enquiries	Steps before entering a contract
Responding to general enquiries	Legitimate interests, where appropriate
Maintaining accounting and tax records	Legal obligation
Protecting our website and preventing fraud	Legitimate interests and applicable legal obligations
Managing legal claims and disputes	Legitimate interests or legal obligations, as applicable
Non-essential Google Analytics processing	Consent
Consent-based Google Ads conversion measurement	Consent
Recording and respecting cookie choices	Compliance with legal requirements and legitimate interests, as applicable

Where we rely on legitimate interests, these include operating a secure and reliable online store, preventing misuse, responding to customers and protecting our legal rights.

We consider these interests alongside the rights and freedoms of the people whose information we process.

Where we rely on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that was lawful before it was withdrawn.

5. Orders, Payments and Delivery

We use WordPress and WooCommerce to operate our website and manage shopping baskets, orders and customer accounts.

Payment Processing

Online payments are processed through Stripe.

Stripe securely processes payment information and provides us with the transaction details needed to confirm and manage purchases.

We do not receive customers’ complete payment card numbers.

Stripe may process information for payment security, authentication and fraud prevention under its applicable terms and privacy arrangements.

Delivery Services

We share the information needed to deliver your order with Royal Mail or another delivery provider used to fulfil the purchase.

This usually includes your name, delivery address, contact information and relevant order or delivery instructions.

We only provide information reasonably necessary for the service.

6. Google Analytics 4

We use Google Analytics 4 (GA4), provided by Google, to understand how visitors use our website and identify ways to improve the shopping experience.

Google Analytics helps us understand:

How visitors find our website.
Which pages and products are viewed.
How customers navigate our store.
How visitors interact with shopping and checkout features.
General website performance and usage trends.

Depending on the configuration and relevant consent choices, Google Analytics may use cookies and process browser information, page interactions and other technical data.

For UK visitors, Google Analytics does not normally log or store individual IP addresses as part of its standard analytics reporting.

We use our cookie consent management system to manage permission for non-essential analytics cookies and related processing.

For more information about Google’s privacy practices, visit:

https://policies.google.com/privacy

7. Google Ads Conversion Tracking

We use Google Ads conversion tracking to understand how effectively our online advertising contributes to customer activity and purchases.

This helps us measure actions such as purchases made after someone interacts with a Google advertisement.

Depending on our configuration, Google Ads may process:

Advertising click identifiers.
Website interaction information.
Conversion events.
Purchase values.
Transaction identifiers.
Relevant browser and device information.

Google Ads may also use cookies and similar technologies to help measure conversions.

We manage consent for non-essential advertising storage and related processing through our website’s consent management system.

We do not authorise optional advertising-cookie storage where the relevant permission has been denied.

8. Cookies and Consent Management

Our website uses cookies and similar technologies for essential shopping functions, website security, analytics and advertising measurement.

We use:

WooCommerce: To provide shopping baskets, checkout and account features.
Complianz: To display our cookie consent banner and manage visitors’ preferences.
Google Site Kit: To connect our website with supported Google services.
Google Consent Mode: To communicate relevant consent choices to Google Analytics and Google Ads.

Our cookie consent banner allows visitors to accept, deny or manage optional cookies.

Strictly necessary cookies may be used without consent where permitted by law.

Depending on the Consent Mode implementation, limited requests without analytics or advertising cookies may still be sent to Google when optional storage is denied. These may communicate consent status and limited measurement information.

You can change or withdraw your consent choices through our website’s consent-management controls.

For further information, please read our Cookies & Website Storage Policy:

https://carpetrugco.com/cookies/

9. Who We Share Personal Information With

We share personal information only where it is reasonably necessary to operate our business, provide services, comply with the law or protect legitimate interests.

Depending on the service being provided, recipients may include:

Hostinger

Provides website hosting, technical infrastructure and business email services.

Privacy information:
https://www.hostinger.com/privacy-policy

Stripe

Processes payments and may carry out payment security and fraud-prevention checks.

Privacy information:
https://stripe.com/gb/privacy

Royal Mail and Other Delivery Providers

Receive the information necessary to transport and deliver customer orders.

Royal Mail privacy information:
https://www.royalmail.com/privacy-notice

Google

Provides Google Analytics 4 and Google Ads measurement services.

Privacy information:
https://policies.google.com/privacy

Other Necessary Recipients

We may share relevant information with professional advisers, accountants, regulators, law enforcement agencies or public authorities where there is an appropriate legal basis.

WooCommerce and Complianz also help us operate the website. Using these WordPress plugins does not necessarily mean that customer information is transferred to their developers.

Where an external provider processes personal information on our behalf, appropriate data protection arrangements apply.

We do not sell customer personal information to third-party data brokers.

10. How Long We Keep Personal Information

We keep personal information only for as long as necessary for the purposes described in this policy, including applicable legal, tax, accounting and contractual requirements.

Order and Financial Records

We retain relevant orders, invoices, transaction records and accounting information for the periods required by applicable law.

Certain UK company tax records generally need to be retained for at least six years after the end of the relevant accounting period, and sometimes longer where required.

Customer Accounts

We normally retain customer account information while an account remains active.

If an account is closed, we review the information for deletion, except where continued retention is needed for accounting records, legal claims, security or other legitimate requirements.

Contact Forms and Project Enquiries

Ordinary contact and project enquiries, including voluntarily uploaded design images, are normally deleted from our website within one calendar month of receipt.

Information may be retained for longer where necessary to manage an ongoing enquiry, resolve a dispute, establish or defend legal claims, or meet a legal obligation.

Deleting information from the website does not automatically remove copies held in business email accounts or backups. Those copies are retained only as necessary for their respective purposes.

Google Analytics and Advertising Data

Google Analytics event-level and user-level information is retained according to the retention settings configured in our GA4 property.

We use retention periods appropriate for website performance analysis and review these settings as necessary.

Google Ads conversion information is subject to the retention controls and rules of the relevant Google services.

Aggregated reports may remain available for longer than underlying user-level or event-level information.

Security Records and Backups

Security logs, diagnostic information and backups are retained according to our operational and security requirements, taking account of applicable provider schedules.

We periodically review retained information and remove it when it is no longer needed, unless a legal or other valid reason requires continued retention.

11. International Data Transfers

Some of our service providers may process or store personal information outside the United Kingdom.

Where information is transferred internationally and UK data protection law requires safeguards, we use an applicable legal transfer mechanism.

Depending on the destination and the arrangement, this may include:

UK adequacy regulations.
The UK Extension to the EU–US Data Privacy Framework, where applicable.
Approved contractual safeguards, including a UK International Data Transfer Agreement or relevant UK Addendum.

We assess applicable requirements and seek to ensure that appropriate protections are in place.

You may contact us to request further information about the safeguards relevant to your personal information.

12. Your Data Protection Rights

Under applicable UK data protection law, you may have the right to:

Access: Request a copy of the personal information we hold about you.
Correction: Ask us to correct inaccurate or incomplete information.
Erasure: Request deletion of your information where the law allows.
Restriction: Ask us to restrict the use of your information in certain circumstances.
Objection: Object to certain processing activities.
Portability: Request information in a structured, commonly used, machine-readable format where applicable.
Withdrawal of consent: Withdraw consent for processing that relies on it.

Your Right to Object

You may object to processing based on our legitimate interests.

You also have an absolute right to object to your personal information being processed for direct marketing.

Where an objection is made, we will handle it in accordance with applicable data protection law.

How to Exercise Your Rights

Please email:

[email protected]

We may ask for reasonable information to verify your identity before acting on certain requests.

We will respond without undue delay and within the applicable legal time limits, normally within one month. Where the law permits additional time, we will explain why.

13. Data Protection Complaints

If you are concerned about how we collect, use or protect your personal information, please contact us.

Email: [email protected]

Please explain your concern and provide any relevant details so that we can investigate.

We will:

Acknowledge receipt of your data protection complaint within 30 days.
Take appropriate steps to investigate without undue delay.
Keep you reasonably informed of progress.
Explain the outcome of our investigation without undue delay.

If you remain dissatisfied, or wish to raise a concern directly, you have the right to complain to the Information Commissioner’s Office (ICO).

ICO complaints information:

https://ico.org.uk/make-a-complaint/

14. Information Security

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration and disclosure.

These measures include appropriate account access controls, website security arrangements and the use of suitable hosting and payment services.

Access to personal information is limited to those who need it for legitimate business purposes.

While we take reasonable precautions, no website or online system can guarantee complete security.

If you believe your personal information has been compromised in connection with our services, please contact us promptly.

15. Information Needed to Place an Order

Certain personal information is necessary for us to process and deliver orders.

This generally includes your:

Name.
Billing and delivery address.
Email address.
Relevant contact details.
Necessary payment information.

Without the information required to process a purchase, we may be unable to accept, fulfil or deliver your order.

Providing optional project photographs or agreeing to non-essential analytics and advertising cookies is not required to purchase products from Carpetrug.

16. Automated Processing and Payment Checks

Our payment provider and financial institutions may use automated systems to assess payment security, authorise transactions and detect possible fraud.

Such checks may affect whether a payment can be completed.

Please refer to the relevant provider’s privacy information for further details about its processing activities and applicable rights.

If a payment or order problem occurs, you can contact us for assistance.

We do not use automated website analytics alone to make decisions that have legal or similarly significant effects on customers.

17. Updates to This Privacy Policy

We may update this Privacy Policy when our website, services, business practices or legal requirements change.

If we make material changes to how we use personal information, we will provide appropriate information before implementing new processing where required by law.

The latest version will be available on this page with an updated revision date.