STERLING GRID SECURITY LTD – GROUP PRIVACY POLICY

This Privacy Policy governs the processing of personal data by Sterling Grid Security Ltd. We operate a "house of brands" model where several specialist home and property improvement brands are hosted on a unified backend infrastructure. These specialist brands include:

• Plan Pros (Productised architectural design and planning support drawings)
• Kitchen-Pros (Made-to-measure replacement kitchen components and doors)
• Pergola Pros (Engineered aluminium pergolas and outdoor living structures)
• Sterling Grid Products (Physical domestic energy and utility infrastructure concepts)

All web domains for these brands forward into a single consolidated Shopify architecture managed exclusively by the data controller. References in this policy to "we", "us", or "our" mean Sterling Grid Security Ltd.

In addition to standard consumer transactions, our specialised project workflows require the collection of unique technical data streams:

A. Identity & Contact Data

• Full name, billing address, shipping address, email address, and telephone numbers.

B. Financial & Transactional Data

• Details of payments made at our unified e-commerce checkout. (Please note: We utilise fully compliant, encrypted third-party payment processors. Full credit/debit card numbers do not enter or remain on our local servers).

C. Spatial, Property & Architectural Data (Plan Pros & Pergola Pros)

• Customer-Submitted Measurements: Dimensional data, room configurations, and millimeter-specific installation requirements.
• Imagery: Mandatory site photographs uploaded via post-purchase forms for structural suitability, masonry alignment, and landing zone viability assessment.
• Official Mapping Data: Official Ordnance Survey (OS) mapping data, Land Registry references, postcodes, and house numbers used to construct council-ready location plans.

D. Site Logistics & Access Data (Pergola Pros)

• Precision logistical profiles provided in our interactive online design and quotation tools. This includes declarations regarding localised site obstructions, narrow pathways, steps, gates, ground hardstanding stability, and low-hanging overhead obstructions (such as electrical cables, balconies, or soffits).

Under UK GDPR Article 6, we are required to identify a lawful basis for each type of personal data we process:

Identity & Contact Data
Purpose: Order fulfilment, customer accounts, direct communication
Lawful Basis: Performance of a Contract

Financial & Transactional Data
Purpose: Processing secure checkout payments
Lawful Basis: Performance of a Contract

Spatial & Architectural Data (Plan Pros)
Purpose: Creating council-ready planning drawings and millimetre-exact specifications
Lawful Basis: Performance of a Contract

Site Logistics & Access Data (Pergola Pros)
Purpose: Evaluating HIAB/Moffett delivery routes and pre-delivery safety assessment
Lawful Basis: Performance of a Contract & Legitimate Interest

Analytics & Performance Trackers
Purpose: Optimising user experience across our brand websites
Lawful Basis: Explicit Consent

Marketing Communications
Purpose: Sending promotional content where opted in
Lawful Basis: Explicit Consent

We never sell customer or project data to outside brokers. To successfully manage your project, data is selectively shared with vetted data processors:

Our platform runs securely on Shopify Basic. Your billing information, customer accounts, and cart data are processed securely via standard Shopify backend applications.

Because native configurations require dedicated extensions to handle file handshakes, text uploads, and technical data exports, customer-uploaded self-surveys and photographic datasets are securely handled via integrated post-purchase software applications mapped directly to your Shopify Order ID.

Unlike basic parcel courier delivery, our premium pergola configurations require deployment via heavy truck-mounted cranes (HIAB) or specialised truck-mounted forklifts (Moffett). Your site access summaries, telephone number, photographs, and obstacle notes are shared directly with our logistics partners to execute pre-delivery safety checks and land materials directly onto your site safely.

We exchange address data with our mapping validation channels, including the Ordnance Survey (OS) data streams, to verify boundaries and export council-ready application files.

All data processed across our operational brands is hosted within high-security environments utilising industry-standard encryption protocols.

• Technical Drawing Data: Architectural layouts, OS mapping records, and structural calculations are preserved for a period required to fulfill ongoing revision options and verify the enforcement of structural or product warranties.
• Logistics Imagery: Property access images and obstacle assessment uploads are stored securely until delivery is successfully completed and signed off by the safety controller, then permanently deleted within 30 days of confirmed delivery sign-off.

Under UK data protection law, you possess explicit rights regarding your data:

The Right of Access: You can request a complete copy of the personal data held on your customer file across all our trading verticals.

The Right to Rectification: You have the right to request that we correct inaccurate or incomplete personal data. Please note: while your statutory right to correct personal data remains absolute, correcting underlying engineering measurements or logistical access descriptions after our 24-hour manufacturing freeze window cannot retroactively alter physical fabrication or dispatch pipelines. Any changes at this stage will be subject to the operational remedies set out in our Terms & Conditions.

The Right to Erasure ("Right to be Forgotten"): You can request deletion of data where it is no longer required for active contract fulfilment, statutory corporate financial audits, or active warranty tracking.

The Right to Restrict Processing: You may object to cross-vertical data sharing under legitimate interest, though doing so may prevent us from certifying multi-product compatibility.

The Right to Object: You have the right to object to the processing of your personal data where we rely on legitimate interest as our lawful basis. You may also object at any time to the use of your personal data for direct marketing purposes. To object, contact us at info@sterlinggridsecurity.co.uk.

The Right to Data Portability: Where we process your personal data based on your consent or to perform a contract, and that processing is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (such as CSV or JSON). You may also request that we transmit that data directly to another controller where technically feasible. To submit a portability request, contact us at info@sterlinggridsecurity.co.uk.

The Right to Lodge a Complaint: If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

To exercise any of these rights, please contact our privacy compliance officer directly at info@sterlinggridsecurity.co.uk.

As our core e-commerce infrastructure relies on Shopify Inc (headquartered in Canada and the United States) and our auxiliary applications operate on globally distributed cloud architectures, personal data we collect from you will be transferred to and stored at destinations outside the United Kingdom.

Whenever we transfer your personal data out of the UK, we ensure an equivalent level of protection is maintained by implementing at least one of the following safeguards:

• We transfer data only to countries deemed by the UK Government to provide an adequate level of protection for personal data.
• Where transfers occur to other countries, we utilise UK International Data Transfer Agreements (IDTA) or Standard Contractual Clauses (SCCs) approved for use in the UK, which afford your personal data the same protections it has within the UK.

The primary recipients of international transfers are Shopify Inc (e-commerce infrastructure) and Google LLC (analytics and business services). Both maintain active data protection frameworks and transfer mechanisms compliant with UK adequacy requirements.

For further information on international transfer safeguards, contact us at info@sterlinggridsecurity.co.uk.

We retain your personal data only for as long as necessary for the purposes it was collected. Our specific retention periods are as follows:

• Contact form enquiries: 24 months from date of submission
• Order and transaction data: 7 years from date of purchase (required by HMRC for tax records)
• Architectural drawings and OS mapping data (Plan Pros): Duration of any active warranty or planning consent plus 2 years
• Site photographs and access data (Pergola Pros): Deleted within 30 days of successful delivery sign-off
• Customer account data: Duration of active account plus 24 months following last activity
• Marketing consent records: Until consent is withdrawn plus 12 months

To deliver our services, we share your personal data with the following trusted third-party processors. All processors are contractually bound to handle your data securely and only for the purposes we specify:

• Shopify Inc — E-commerce platform and checkout infrastructure. Privacy policy: shopify.com/legal/privacy
• Consentmo — Cookie consent management. Privacy policy: consentmo.com/privacy-policy
• Google LLC — Analytics and business profile services. Privacy policy: policies.google.com/privacy
• Ordnance Survey — Mapping data for Plan Pros location plans. Privacy policy: ordnancesurvey.co.uk/legal
• Specialist logistics contractors — Site access data and delivery photographs shared with HIAB/Moffett operators for Pergola Pros deliveries, solely for pre-delivery safety assessment.