Who is responsible
Elford Sheds Ltd (company 08668589) is the data controller for personal information collected through this website, quotations, orders, workshop records, delivery records and customer support. Our registered office is The Yard, Botley Road, North Baddesley, Southampton, Hampshire, SO52 9DP. Contact us at info@elfordsheds.co.uk or 01794 523388.
What we collect
- Customer-account details, email-verification status and password-reset security records. Passwords are stored only as strong one-way hashes.
- Contact, delivery and site-access details.
- Saved specifications, quotes, approvals and typed signatures.
- Order, invoice, deposit, balance and transaction references. Complete card details are handled by the hosted payment provider and are not stored by Elford.
- Production, delivery, fitting, proof photographs and customer-service notes.
- Staff account and security audit information for authorised employees.
Why we use it
We use information to provide your requested account and document services; to answer enquiries and prepare a quote at your request; to enter into and perform a contract; to take payment, manufacture, deliver and support buildings; to meet tax, accounting and consumer-law duties; and for legitimate interests such as preventing misuse, securing the service and improving operations. Where consent is the appropriate basis, you can withdraw it.
Who receives it
Information is available to authorised Elford staff and to service providers needed for hosting, payment processing, email, delivery or professional advice. Providers receive only what is needed for their role. We do not sell customer information.
International processing
If a service provider processes information outside the UK, we require an appropriate UK data-transfer safeguard where the law requires one.
How long we keep it
We keep sales, payment and accounting records for the period required by law, normally six years for relevant business records. Specification, production, delivery, photograph and support records are kept only as long as needed for the order, warranty, safety, legal claims or repeat service. Portal links expire automatically; used or expired account tokens, obsolete security-attempt records and old operational data are routinely removed.
Your rights
You may ask for access, correction, deletion, restriction, portability or objection where the relevant data-protection right applies. We may need to verify your identity and may retain information where a legal obligation or legal claim requires it. You may complain to the UK Information Commissioner's Office if you remain concerned.
Cookies, browser storage and external media
Necessary browser storage keeps features such as your basket and privacy choice working. Customer and staff access use secure, HTTP-only session cookies; the customer cookie lasts up to 30 days unless you sign out sooner.
The yard map is supplied through an external service. It remains disconnected until you choose Allow external media or select Allow and load on the blocked panel. If loaded, the service may receive technical information such as your IP address, browser details and referring page, and may set its own cookies or similar storage. Direct directions links connect to the chosen navigation service only when you follow the link.
Your external-media choice is stored on your device. You can withdraw or change it at any time through Cookie settings in the site footer. Rejecting optional media does not affect the catalogue, basket, account or ordering features. We do not set advertising cookies.
Security
We use encrypted transport, signed and revocable sessions, individual roles, hashed passwords, request throttling, expiring secure links and activity records. No internet service can promise absolute security, so we also monitor operational errors and maintain tested recovery procedures.