Privacy Policy

Handrail Creations Limited (“we”, “us”, “our”, or “the Company”) is committed to protecting the privacy and security of your personal information. This policy explains how we collect, use, share and protect personal data, and explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy applies to personal data we collect through our website (www.handrailcreations.co.uk), and in the course of our business activities, including dealings with customers, suppliers, contractors and job applicants.

Who we are

Company name: Handrail Creations Limited
Company number: 08845931 (registered in England and Wales)
Registered address / principal place of business: Victoria Works, Lorne Street, Bolton, BL4 7LZ
Email: info@handrailcreations.co.uk
Telephone: 01204 370 559

We are the “controller” of the personal data described in this policy, meaning we decide how and why it is processed.

Information we collect

We may collect and process the following categories of personal data:

Contact details- name, email address, postal address, telephone number
Enquiry and project information- details you provide when requesting a quote, placing an order, or discussing a project, such as property address, design requirements, drawings and photographs
Account and transaction information- billing details, order history and payment information
Recruitment information- CVs, application forms, references and interview notes, if you apply for a role with us
Technical and usage data- IP address, browser type, device information, pages visited and referring website, collected automatically when you use our website
Communications- records of correspondence if you contact us by email, phone, post or via social media

Where you provide information about a third party (for example, a site contact or another decision-maker), please make sure you have their agreement to share it with us.

How we use your information

We use personal data for the following purposes:

To respond to enquiries and provide quotations
To deliver, manage and invoice for our products and services
To manage our relationship with customers, suppliers and contractors
To maintain and improve our website, and understand how it is used
To send marketing communications, where you have agreed to receive them or where we have a legitimate interest in doing so and you have not opted out
To consider and process job applications
To comply with our legal, accounting, health and safety, and regulatory obligations
To prevent fraud and protect the security of our systems

Our legal basis for processing

Under UK GDPR, we rely on one or more of the following legal bases, depending on the purpose:

Contract- where processing is necessary to provide a quote, fulfil an order or manage a contract with you
Legitimate interests- where processing helps us run, promote and improve our business in a way you would reasonably expect, and which does not override your rights and interests
Consent- for example, for certain marketing communications or non-essential cookies, which you can withdraw at any time
Legal obligation- where we must process data to comply with the law, such as tax, employment or health and safety requirements

Use of artificial intelligence (AI) tools

We use AI-powered tools to support parts of our business, such as drafting and editing documents, summarising information, assisting with customer communications, and improving internal processes. Where we use such tools:

We use them as an aid to our own staff, who remain responsible for reviewing output and for any decisions made about you
We do not use AI tools to make decisions about you that have a legal or similarly significant effect, without meaningful human review
We take reasonable steps to avoid submitting unnecessary or excessive personal data to these tools, and to use providers with appropriate data protection and confidentiality terms in place
Some AI providers we use are based outside the UK, including in the United States- see ‘International transfers’ below for how we protect data in those cases

If our use of AI tools changes in a way that materially affects how your personal data is processed, we will update this policy.

Separately, some of the software platforms we use to run our business- including AI-powered platforms used to build and operate internal systems such as our customer and operations portal- may themselves store and process personal data, including outside the UK. This is addressed under ‘International transfers’ below.

Sharing your information

We do not sell, rent or trade your personal data. We may share personal data with:

Trusted service providers and contractors who perform services on our behalf (for example, IT hosting and support, accountancy, website management, AI-powered productivity tools, delivery and installation partners), under appropriate confidentiality and data protection terms
Professional advisers, such as solicitors, accountants and insurers, where necessary
Regulators, law enforcement or other authorities, where we are required to do so by law or to protect our legal rights
A buyer or successor, in the event of a sale, merger or reorganisation of the business

Any third party that processes personal data on our behalf is required to keep it secure and to use it only for the purposes we specify.

International transfers

Some of the organisations we work with- including certain cloud software, hosting and AI providers- are based, or store and process data, outside the UK, including in the United States and other countries.

Where personal data is transferred outside the UK, we take steps to ensure it receives an appropriate level of protection. This includes relying on:

The UK’s data protection ‘adequacy’ regulations, where the destination country is recognised as providing an adequate level of protection
The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, incorporated into our contracts with relevant providers
Other safeguards recognised under UK GDPR, such as the UK–US Data Bridge, where applicable to a particular provider

For example, our customer and operations portal is built on Base44, a US-hosted platform. Personal data held within the portal is stored and processed on US-based infrastructure, and we have accepted the provider’s data processing terms covering the relevant transfer safeguards.

You can contact us using the details above if you would like further information about the safeguards in place for a specific transfer.

Cookies

Our website may use cookies and similar technologies to help it function and to understand how visitors use the site. Cookies are small text files stored on your device. You can control or delete cookies through your browser settings; please note that disabling cookies may affect how some parts of the website work.

Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy, including to satisfy any legal, accounting or reporting requirements. Retention periods vary depending on the type of data and the reason it was collected (for example, financial records are typically retained for at least six years for tax purposes). When data is no longer required, we securely delete or anonymise it.

Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or disclosure, including access controls, encryption where appropriate, and staff awareness of data protection obligations. While we take reasonable steps to protect your data, no method of transmission or storage is completely secure.

Your rights

Under UK GDPR, you have the right to:

Be informed about how your data is used
Access a copy of the personal data we hold about you
Have inaccurate data corrected
Request deletion of your data in certain circumstances
Restrict or object to certain processing, including direct marketing
Request that we transfer your data to another organisation, in certain circumstances (data portability)
Withdraw consent at any time, where we rely on consent as our legal basis

To exercise any of these rights, please contact us using the details above. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, or by calling 0303 123 1113, although we would welcome the opportunity to address your concerns directly first.

Children’s data

Our website and services are intended for businesses and adult consumers. We do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements, including our use of AI tools and any new international transfer arrangements. We encourage you to review this page periodically. This policy was last updated on the date shown at the top.

Contact us

If you have any questions about this policy or how we handle your personal data, please contact us:

Email: info@handrailcreations.co.uk
Telephone: 01204 370 559
Post: Handrail Creations Ltd, Victoria Works, Lorne Street, Bolton, BL4 7LZ