Privacy Policy

1. Who We Are

We are Arlowe Hardware Ltd., a company registered in England and Wales (company number 17052700). Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ.

For any questions about how we handle your personal data, contact us at hello@arlowehardware.com.

This policy was last updated on 2 April 2026.

2. What Data We Collect

We collect personal data when you interact with us in the following ways:

When you place an order

Full name
Email address
Phone number (if provided)
Billing address
Delivery address
Order details and transaction history

When you create an account

Full name
Email address
Saved addresses
Order history

When you contact us

Name and email address
Any information you include in your message

When you subscribe to our newsletter

Email address

When you apply for a trade account

Business name
Business type
Website or social media profile (if provided)
Contact name and email
Phone number (if provided)
Country
Project description (if provided)

Automatically when you browse our website

IP address
Browser type and version
Pages visited and time spent
Referring website
Device type

We do not collect any special category data (such as health information, religious beliefs, or biometric data).

3. How We Use Your Data

We use your data for the following purposes and legal bases under UK GDPR:

Purpose	Legal Basis
Processing and fulfilling your orders	Performance of a contract
Sending order confirmations, dispatch notifications, and delivery updates	Performance of a contract
Processing payments via PayPal and Klarna	Performance of a contract
Responding to your enquiries	Legitimate interest
Sending our newsletter (The Arlowe Edit)	Consent
Analysing website usage via Google Analytics	Legitimate interest
Measuring advertising effectiveness via Google Ads, Meta, and Pinterest	Legitimate interest / Consent
Detecting and preventing fraud	Legitimate interest
Complying with legal and tax obligations	Legal obligation
Improving our website and services	Legitimate interest

4. Who We Share Your Data With

We share your personal data only with trusted third parties who are necessary to operate our business. We do not sell your data to anyone.

Third Party	Purpose	Location
PayPal	Payment processing (card payments, PayPal, Apple Pay, Google Pay)	United States (EU-US Data Privacy Framework)
Klarna (via Kustom)	Buy now, pay later and card payment processing	Sweden / EU
Omnisend	Email marketing and newsletters	United States (Standard Contractual Clauses)
Google (Analytics and Ads)	Website analytics and advertising measurement	United States (EU-US Data Privacy Framework)
Meta (Facebook/Instagram)	Advertising measurement and attribution	United States (EU-US Data Privacy Framework)
Pinterest	Advertising measurement and attribution	United States (EU-US Data Privacy Framework)
Royal Mail	UK order delivery and tracking	United Kingdom
DPD	EU and international order delivery	United Kingdom / EU
Rocket.net	Website hosting	United Kingdom
Postmark	Transactional email delivery (order confirmations, etc.)	United States

Where data is transferred outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

5. Cookies

Our website uses essential cookies for core functionality, as well as analytics and marketing cookies to understand site usage and measure advertising effectiveness. For full details of every cookie we use, see our Cookie Policy.

6. Data Retention

We retain your data only for as long as necessary:

Order data: 6 years from the date of purchase, as required by HMRC for tax and accounting purposes.
Account data: Until you request deletion of your account.
Newsletter subscribers: Until you unsubscribe. You can unsubscribe at any time using the link in any email.
Contact form enquiries: 12 months from the date of your last message.
Trade account applications: Duration of the trade relationship, plus 6 years.

7. Your Rights

Under UK GDPR, you have the following rights:

Right of access – Request a copy of the personal data we hold about you.
Right to rectification – Ask us to correct inaccurate or incomplete data.
Right to erasure – Ask us to delete your data where there is no compelling reason for continued processing. Note: we may need to retain some data for legal or tax obligations.
Right to restrict processing – Ask us to suspend processing of your data in certain circumstances.
Right to data portability – Request a copy of your data in a structured, machine-readable format.
Right to object – Object to processing based on legitimate interest or direct marketing.
Right to withdraw consent – Where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email us at hello@arlowehardware.com. We will respond within 30 days.

8. Marketing

We will only send you marketing emails if you have opted in via our newsletter signup. Every email includes an unsubscribe link. We will never share your email address with third parties for their marketing purposes.

9. Children

Our website is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Security

We take appropriate technical and organisational measures to protect your personal data, including:

SSL/TLS encryption on all pages
Payment data handled exclusively by PCI DSS certified payment processors (PayPal, Klarna)
Access to personal data restricted to authorised personnel only
Regular security updates to our hosting and software

While we take every reasonable precaution, no method of transmission over the internet is 100% secure. We cannot guarantee the absolute security of your data.

11. Changes to This Policy

We may update this privacy policy from time to time. The revised version will be posted on this page with an updated date. We will not materially reduce your rights under this policy without notifying you by email.