STERLING GRID SECURITY LTD – GROUP PRIVACY POLICY

This Privacy Policy governs the processing of personal data by Sterling Grid Security Ltd. We operate the specialist trading names Plan Pros, Kitchen Pros, Pergola Pros and Shutter Pros. References in this policy to "we", "us" or "our" mean Sterling Grid Security Ltd.

Our public brand websites are hosted on Cloudflare Pages and use Cloudflare Web Analytics for aggregate page, referral and performance measurement. Product browsing, carts, checkout, customer accounts and the legal-policy pages are provided through our Shopify store. Some enquiry and upload forms are provided by Tally and some Pergola Pros forms send email through EmailJS. This policy covers those connected services as well as the Shopify store.

Depending on the service you use, we may collect:

Identity and contact data

• Name, billing and delivery address, email address and telephone number.
• Business name, company number and trade information if you apply for a trade account.

Order and payment data

• Order, invoice, payment-status and transaction records. Card details are handled by Shopify and its payment providers and are not stored by us.

Project, property and technical data

• Measurements, room or window configuration, chosen products, finishes, accessories, project descriptions and installation requirements.
• Photographs, sketches, plans and other files uploaded for Shutter Pros, Kitchen Pros, Pergola Pros or Plan Pros enquiries and orders.
• For Plan Pros, property address, postcode, Ordnance Survey mapping data and Land Registry references used to prepare planning documents.
• For Pergola Pros, access routes, gates, steps, ground conditions and overhead obstructions used to assess delivery and installation suitability.

Website and communications data

• Messages, enquiry history, support and chat records, cookie choices, and technical information such as device, browser, approximate location and IP address where a provider needs it to deliver or secure its service.

Under UK GDPR Article 6, we use the following lawful bases:

• Contract and steps at your request before a contract: to answer an enquiry or quote request, prepare drawings or specifications, create and fulfil an order, take payment and provide support.
• Legal obligation: to keep tax and accounting records, respond to lawful requests and meet consumer, product-safety and data-protection duties.
• Legitimate interests: to secure our websites and accounts, prevent fraud, maintain service records, manage deliveries and improve operations where those interests are not overridden by your rights.
• Consent: for optional cookies, YouTube content and electronic marketing where consent is required. You may withdraw consent at any time without affecting earlier lawful processing.

A required acknowledgement beside an enquiry form confirms that you have seen the privacy notice and want us to respond; we do not rely on that acknowledgement as consent where processing is necessary to provide the quote or service you requested.

We do not sell personal data. We share it with service providers and other recipients only where needed to answer your request, provide the service, fulfil an order, protect our systems or meet a legal obligation. The providers and purposes are described below.

Shopify provides our product catalogue, cart, checkout, customer accounts and order records. Shopify and its payment providers process billing and payment information; we do not store card details.

Tally hosts selected enquiry and upload forms and stores their submissions in the European Union until we delete them. Form data is sent by webhook to our Google Workspace lead records; two Pergola Pros forms also have direct Google Sheets connections. Uploaded files may therefore be held in Tally and Google Workspace while we assess or deliver the project.

Pergola Pros product-quote and showroom forms use EmailJS to pass the details you enter to our connected Google Workspace email account. EmailJS's "Do not save private data" setting is enabled on both templates, so new form contents are processed for delivery and are not kept in EmailJS request history. The delivered email remains in our Google Workspace account under the retention schedule below.

Some pergola deliveries use truck-mounted cranes (HIAB) or truck-mounted forklifts (Moffett). We share the site-access summary, contact number, photographs and obstacle notes needed by the selected logistics provider to assess access and complete delivery.

We exchange address data with our mapping validation channels, including the Ordnance Survey (OS) data streams, to verify boundaries and export council-ready application files.

We use role-based account access, multi-factor authentication where available, HTTPS encryption in transit, reputable service providers and access limited to people who need the information for their work. No internet service is risk-free, so we review access and provider settings and respond to suspected incidents under our data-protection procedures.

Tally submissions and copies in Google Workspace are reviewed against the retention schedule below. Deleting a Tally submission moves it to Tally's Trash; Tally states that it is permanently deleted from backups within 90 days unless the Trash is emptied sooner.

Depending on the circumstances and the lawful basis, UK data-protection law may give you the right to:

• ask for access to your personal data;
• ask us to correct inaccurate or incomplete personal data;
• ask us to erase personal data where there is no overriding reason to keep it;
• ask us to restrict processing in certain circumstances;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain information you gave us in a structured, commonly used, machine-readable format, or ask us to transfer it where technically feasible; and
• withdraw consent at any time where we rely on consent.

A data correction cannot undo manufacturing or delivery work already completed from information previously supplied, but we will correct the personal data we hold and explain any operational effect. Some rights have legal exceptions, including where records must be kept for tax, accounting, contractual or legal-claim purposes.

To exercise a right, email info@sterlinggridsecurity.co.uk or use our privacy request form. We normally respond within one month. If you are unhappy with our response, you can complain to the Information Commissioner's Office at ico.org.uk or call 0303 123 1113.

Tally states that form data is stored in the European Union. Other providers we use, including Shopify, Cloudflare, Google Workspace, EmailJS, Klaviyo, Consentmo and EnableAll, may process data in the United Kingdom, European Economic Area, Canada, Singapore, the United States or other countries used by their approved sub-processors.

Where UK data-protection law requires a safeguard for an international transfer, we rely on the provider's contractual data-protection terms, the UK International Data Transfer Agreement or UK Addendum to Standard Contractual Clauses, or an applicable UK adequacy regulation. You may ask us for more information about the relevant safeguard by emailing info@sterlinggridsecurity.co.uk.

We keep personal data only for as long as needed for the purpose described, a legal requirement, or the establishment, exercise or defence of legal claims. Our working schedule is:

• Enquiries, Tally submissions, delivered enquiry emails and related uploads: up to 24 months from the last substantive contact, unless they become part of an order or must be kept for a dispute.
• Order, invoice and transaction records: generally 7 years from the end of the relevant accounting period.
• Plan Pros drawings and mapping records: while a planning matter, revision service or guarantee is active, then normally 2 further years, subject to any legal claim.
• Pergola delivery access images: deleted within 30 days after successful delivery sign-off unless needed for a live claim, safety matter or order record.
• Customer accounts: while active and normally 24 months after the last activity, except order records kept for the period above.
• Marketing records: until consent is withdrawn or you object, with a minimal suppression record kept so that we respect that choice.
• Microsite privacy-choice cookie: 180 days, after which the site asks again. Shopify and its apps may use different periods described in the Shopify cookie controls.

Tally's free service does not automatically apply our business retention schedule. We therefore review and delete Tally and connected Google Workspace records manually. Tally says deleted submissions remain recoverable in its Trash for up to 90 days unless the Trash is emptied sooner.

We use the following providers and recipients where relevant to the service you use:

• Shopify Inc — storefront, product catalogue, cart, checkout, payments, customer accounts and Shopify Inbox chat. Shopify privacy policy.
• Cloudflare Inc — hosting, content delivery, security and privacy-first aggregate Web Analytics for the public brand microsites. Cloudflare states that Web Analytics does not collect or use visitors' personal data. Cloudflare privacy policy.
• Tally BV — enquiry and upload forms, form-response storage and webhooks. Tally privacy notice.
• Google LLC / Google Workspace — business email, Apps Script webhook processing, lead spreadsheets, file storage, YouTube content where permitted, and analytics where enabled and consented. Google privacy policy.
• EmailJS Pte. Ltd. — delivery of the Pergola Pros product-quote and showroom forms to our email account. Private-data history storage is disabled. EmailJS privacy policy.
• Consentmo (iSense) — cookie choices, consent records and privacy requests on the Shopify store. Consentmo privacy policy.
• EnableAll / AccessEaze — accessibility toolbar on the Shopify store. EnableAll privacy policy.
• Klaviyo — onsite marketing features and marketing communications where enabled and lawfully permitted. Klaviyo privacy notice.
• Ordnance Survey and mapping providers — address and mapping data for Plan Pros location plans. Ordnance Survey privacy notice.
• Manufacturing, professional and logistics contractors — the order, specification, contact and site-access information needed to manufacture, advise on or deliver your project.

We do not sell personal data.