Privacy Policy

1. Who we are

KETTRA LIMITED is the data controller for the personal data described in this policy. We are a company registered in the United Kingdom, company number 17442662, with a registered office at 61 Bridge Street, Kington, United Kingdom, HR5 3DJ. We sell rugs, runners, doormats and other floor coverings to private customers through our website at kettra.uk.

You can reach us about anything in this policy by e-mail at [email protected] or by telephone on +44 7418 623905.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data we collect

Order and delivery data

When you place an order we ask for the details needed to fulfil and deliver it:

• your full name;
• your e-mail address;
• your telephone number;
• your delivery address, including town or city and postcode;
• any notes you add to the order, such as access instructions for a pallet courier or the flight length for a cut stair runner;
• the items, sizes and quantities ordered and the order total.

Payment data

Payments are processed by an external payment provider. Card numbers, expiry dates and security codes are entered directly into the provider's systems and are never stored by us. We receive only the outcome of the transaction, a reference and, where applicable, the last four digits of the card so we can match a payment to an order or process a refund.

Correspondence

If you e-mail or telephone us about sizing, delivery, a return or a complaint, we keep the content of that correspondence together with your contact details so we can answer and, if needed, refer back to it.

Technical data

Our hosting provider records standard server log data, including IP address, browser type, referring page and the time of the request. This is used to keep the site available and secure.

Data we do not collect

We do not collect special category data — information about health, ethnicity, religion, political opinions, trade union membership, biometrics, sex life or sexual orientation — and we ask that you do not send it to us. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

3. Purposes and legal bases

• Performance of a contract: processing and despatching your order, arranging delivery, handling returns and refunds under the Consumer Contracts Regulations 2013, and contacting you about the order.
• Legitimate interests: answering enquiries that do not yet relate to an order, keeping records of correspondence, preventing fraud and misuse, and maintaining the security and reliability of the website. Our interest is running a shop that works correctly and responding to customers; we balance it against your rights and expectations.
• Legal obligation: keeping accounting and tax records, and complying with consumer protection law and with requests from competent authorities.
• Consent: any optional processing you actively agree to, such as non-essential cookies where these are used. Consent can be withdrawn at any time.

4. Sharing with third parties

We share personal data only where it is needed for the purposes above, and only with the following categories of recipient:

• Delivery and courier companies — your name, delivery address, postcode, telephone number and any access notes, so that a rug can be booked in and handed over. Large rugs travel by pallet courier, who will normally call or text before delivery.
• Payment providers — to take payment and process refunds.
• Hosting and IT service providers — who operate the servers and e-mail systems on which the data sits.
• Professional advisers — accountants and, where necessary, legal advisers, under a duty of confidentiality.
• Public authorities — where we are required by law to disclose information.

We do not sell personal data and we do not share it with third parties for their own marketing purposes.

5. International transfers

We aim to keep personal data within the United Kingdom and the European Economic Area. Where a service provider processes data outside those areas, we rely on UK adequacy regulations or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with any additional safeguards the transfer requires. You can ask us for details of the safeguards applied to a particular transfer.

6. Retention periods

• Order and transaction records: six years from the end of the financial year in which the order was placed, to meet accounting and tax requirements.
• Delivery and returns records: for as long as the order record is kept, so that a return or a claim can be traced.
• General correspondence: up to two years from our last exchange, unless it relates to an order or a complaint, in which case it is kept with the order record.
• Server logs: normally up to twelve months.

When a retention period ends, data is deleted or irreversibly anonymised.

7. Security

The website is served over an encrypted connection. Access to order data is limited to the people who need it to do their job and is protected by individual accounts and strong authentication. Systems are kept up to date and backups are taken regularly. No method of transmission or storage is completely secure, but we take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access, and we will notify you and the Information Commissioner's Office where a breach meets the thresholds in the UK GDPR.

8. Cookies

This website uses only what is strictly necessary to work. Your basket exists in the memory of the page you have open: nothing about it is written to cookies, local storage or session storage, and closing the tab clears it. Our hosting provider may set an essential cookie for security or load balancing. If we later introduce analytics or any other non-essential cookie, we will ask for your consent first through a banner and you will be able to refuse or withdraw consent without losing access to the site. You can also block or delete cookies in your browser settings.

9. Your rights

Under the UK GDPR you have the right to:

• Access — obtain confirmation of whether we process your data and receive a copy of it;
• Rectification — have inaccurate data corrected and incomplete data completed;
• Erasure — have data deleted where we no longer need it, subject to records we must retain by law;
• Restriction — ask us to limit processing while a question about accuracy or lawfulness is resolved;
• Portability — receive data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller;
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time;
• Withdraw consent — where processing is based on consent.

To exercise any of these rights, e-mail [email protected]. We respond within one month and may ask for information to confirm your identity. Exercising your rights is free of charge unless a request is manifestly unfounded or excessive.

10. Withdrawing consent

Where we rely on consent, you can withdraw it at any time by e-mailing us or by changing your cookie choice in the browser. Withdrawal does not affect the lawfulness of processing carried out before it, and it does not affect processing we carry out on another legal basis, such as keeping an order record for tax purposes.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.

12. Age restriction

Our shop is intended for adults. We do not knowingly sell to, or collect personal data from, anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

13. Changes to this policy

We may update this policy when our processing, our suppliers or the law change. The current version is always published on this page, with the date it was last updated shown below. Significant changes affecting how we use your data will be highlighted on the site.

14. Contact

KETTRA LIMITED, company number 17442662
61 Bridge Street, Kington, United Kingdom, HR5 3DJ
E-mail: [email protected]
Telephone: +44 7418 623905

Last updated: 14 September 2026