Privacy Policy

Last updated: 9 August 2026

Who we are

Concreet makes handmade concrete homeware and furniture in the North East of England. For the purposes of the UK GDPR and the Data Protection Act 2018 we are the data controller for the personal data described in this policy.

You can reach us at concreteartisanuk@gmail.com.

To be completed by Concreet: the registered trading name and business address, and — if the business is a registered company — the company number. UK GDPR requires a controller's identity and contact details to be stated. If the business needs to register with the ICO, add the registration number here.

What we collect

When you place an order

Your name, email address, delivery address, billing address and order details. Payment is taken by Stripe; your card details are entered on Stripe's own checkout page and are never sent to or stored on this website.

When you send an enquiry

Your name, email address, telephone number if you give one, and whatever you write in the message. Enquiries are handled by Netlify Forms.

When you browse the site

Our host, Netlify, records standard server log information — IP address, browser type, pages requested — for security and to keep the site running.

Why we use it, and our lawful basis

• To fulfil your order — processing, packing, dispatching and supporting it. Lawful basis: performance of a contract.
• To answer your enquiry — replying to what you asked. Lawful basis: legitimate interests, namely responding to people who contact us.
• To keep accounting records — retaining transaction records as tax law requires. Lawful basis: legal obligation.
• To keep the site secure — detecting and preventing abuse. Lawful basis: legitimate interests.

We do not sell your data, and we do not send marketing email unless you have asked us to.

Who we share it with

• Stripe Payments Europe, Ltd. — payment processing. See Stripe's privacy policy.
• Netlify, Inc. — website hosting and form handling. See Netlify's privacy policy.
• Google Fonts — typefaces are loaded from Google's servers, which means your browser's IP address is visible to Google when a page loads.
• Delivery carriers — the name and address needed to deliver your order.

Some of these providers process data outside the UK. Where they do, transfers are covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

To be confirmed by Concreet: this site also loads a third-party AI voice assistant (Vapi). If it is kept, name the provider and its privacy policy here, and describe what it records — voice assistants routinely process audio, which is personal data.

Cookies

This site sets no advertising or analytics cookies. Your basket is kept in your browser's own local storage — it stays on your device, is never transmitted to us, and clearing your browser data removes it. Stripe sets cookies on its own checkout pages, which are necessary for the payment to work and for fraud prevention.

How long we keep it

Order and transaction records are kept for six years after the end of the relevant tax year, as UK tax law requires. Enquiries are kept for up to two years and then deleted. Server logs are kept for a short period by our host.

Your rights

Under UK data protection law you have the right to ask us to give you a copy of your data, correct it, delete it, restrict how we use it, provide it in a portable format, or object to our using it. Where we rely on consent, you can withdraw it at any time.

Email concreteartisanuk@gmail.com and we will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

If we change this policy we will update the date at the top of the page.