Privacy Notice

Last updated: 10 July 2026

1. Who we are

UK Stairs is operated by UK Creative Designs, trading as UK Creative Castings and UK Stairs.

For the purposes of UK data protection law, UK Creative Designs is the data controller responsible for the personal information described in this notice.

Our contact details are:

Trading name: UK Stairs
Email: hello@ukstairs.co.uk
Telephone: 01760 788 491

This privacy notice applies to:

• the UK Stairs website;
• staircase enquiries and brochure requests;
• quotations, orders and contracts;
• staircase design, surveys, manufacture, delivery and installation;
• customer, supplier and contractor communication;
• UK Stairs App and related business tools; and
• communication through email, telephone, WhatsApp and social media.

2. The personal information we collect

The information we collect depends on how you contact us and the services you request.

Enquiry and contact information

This may include:

• your name;
• email address;
• telephone number;
• postal address or site address;
• site postcode;
• preferred staircase style;
• project description;
• estimated dates and project stage;
• messages and communication records; and
• details submitted through our contact or brochure forms.

Project information

When preparing a quotation or working on a staircase project, we may collect:

• plans, sketches, architectural drawings and specifications;
• photographs and videos of the property or staircase area;
• dimensions, floor levels and survey information;
• access, parking and site-contact details;
• approved drawings and design decisions;
• quotation, order and payment information;
• invoices and accounting records;
• delivery and installation records;
• snagging, warranty and aftercare information; and
• correspondence with you and other people involved in the project.

Plans and photographs may contain personal information or location metadata. Please remove any information that is not needed before sending files to us.

Other project contacts

A customer may provide details for an architect, builder, engineer, project manager, site contact, family member or other person involved in a project.

This may include their name, role, business name, email address and telephone number.

Please make sure you have authority to give us another person’s details.

Website and technical information

When you visit our website, we may collect:

• IP address;
• browser and device type;
• operating system;
• pages viewed;
• date and time of visits;
• referring website or advertising campaign;
• approximate location derived from an IP address;
• cookie identifiers;
• form-security information; and
• website error and security logs.

We provide more information in our Cookie Policy.

Marketing information

We may record:

• whether you have requested a brochure;
• whether you have agreed to receive marketing;
• your marketing preferences;
• advertising campaign information; and
• whether you opened or interacted with an email, where this feature is used.

UK Stairs App information

UK Stairs App is restricted to authorised users.

The app may process:

• authorised-user names, email addresses and roles;
• account and authentication information;
• login times, IP addresses and security logs;
• enquiries, customer and project records;
• quotations, drawings, invoices and documents;
• supplier, contractor and installer information;
• internal notes and business communication;
• content prepared for approved business accounts;
• activity and audit records; and
• third-party account identifiers or authorisation tokens where an authorised user connects a supported platform.

Authorised users must only enter information that UK Stairs needs for legitimate business purposes.

Where the app connects to a third-party service, that provider’s privacy notice and terms also apply.

3. Where we obtain personal information

We normally obtain personal information directly from you.

We may also receive information from:

• your architect, builder, engineer or project manager;
• another customer or person connected with the project;
• suppliers, installers and subcontractors;
• referral partners;
• social media and messaging platforms;
• advertising and analytics providers; and
• publicly available sources where this is reasonable and relevant.

4. How and why we use personal information

We use personal information for the following purposes.

Responding to enquiries and preparing quotations

We use your information to understand your project, contact you, assess whether we can help and prepare a quotation.

Our lawful bases are:

• taking steps at your request before entering into a contract; and
• our legitimate interests in responding to enquiries and running our business.

Managing staircase orders and projects

We use information to:

• prepare designs and drawings;
• arrange surveys;
• confirm specifications;
• manufacture, deliver and install staircases;
• communicate with project contacts;
• manage changes and approvals;
• process payments; and
• provide warranty and aftercare services.

Our lawful bases are:

• performing our contract with you;
• taking steps before entering into a contract;
• complying with legal obligations; and
• our legitimate interests in managing projects and providing our services.

Site access and safety

We may use site-contact, access and property information to arrange surveys, deliveries and installation safely.

Our lawful bases are:

• performing our contract;
• complying with health and safety and other legal duties; and
• our legitimate interests in protecting our workers, contractors, customers and property.

Accounting and legal records

We use personal information to maintain invoices, tax records, payment records and other business documents.

Our lawful bases are:

• compliance with legal obligations; and
• our legitimate interests in maintaining accurate records, recovering debts and dealing with legal claims.

Website security and fraud prevention

We use technical information to protect our website, forms, app, users and business systems from spam, fraud, misuse and unauthorised access.

Our lawful bases are:

• compliance with our data-security duties; and
• our legitimate interests in protecting our systems and business.

Website analytics and advertising

Subject to your cookie choices, we may use analytics and advertising services to measure website use, understand advertising performance and improve our pages.

Our lawful basis for placing or accessing non-essential cookies and similar technologies is normally your consent.

Where permitted by law, we may use limited statistical technologies without consent. We will provide a simple way for you to object where the relevant legal exception requires this.

Marketing

We may send information about UK Stairs services where:

• you have asked us to contact you;
• you have given consent;
• the law permits us to contact an existing customer about similar services; or
• we contact a business representative where our legitimate interests apply.

You can unsubscribe at any time by using the unsubscribe option in the message or contacting us.

Testimonials and project photographs

We may publish customer testimonials, completed-project photographs or videos where we have permission or another valid lawful basis.

We will seek clear permission before publishing information that directly identifies a private individual.

Operating UK Stairs App

We use app information to manage UK Stairs projects, quotations, documents, suppliers, internal workflows, authorised users and business content.

Our lawful bases are:

• performing contracts;
• complying with legal obligations; and
• our legitimate interests in managing, securing and recording our business operations.

5. Our legitimate interests

Where we rely on legitimate interests, these may include:

• responding to enquiries;
• preparing and following up quotations;
• managing customer and supplier relationships;
• maintaining project and design records;
• improving our services;
• protecting our website, app and systems;
• preventing fraud and misuse;
• managing complaints and disputes;
• recovering debts;
• defending legal claims; and
• marketing relevant services where the law permits.

We consider the effect on your rights before relying on legitimate interests.

6. Information you must provide

You do not have to provide personal information simply to browse our website.

We need certain information to prepare a quotation, enter into a contract, design a staircase, arrange a survey, deliver products or provide installation services.

If you do not provide the required information, we may be unable to provide the requested service.

Authorised app users must provide the information needed to create and secure their accounts.

7. Special category information

We do not normally ask for health information or other special category personal data.

You may need to tell us about a disability, medical need or access requirement where this affects a site visit, delivery or installation. We will only use this information where necessary and where the law permits.

Please do not send special category information unless it is relevant and required.

8. Children’s information

Our services are not aimed at children.

We do not knowingly collect personal information directly from children unless this is necessary for a project and supplied by a parent, guardian or other authorised adult.

9. Who we share personal information with

We may share relevant information with:

• staircase manufacturers and material suppliers;
• surveyors, designers, engineers and technical advisers;
• installers, subcontractors and site workers;
• delivery and courier companies;
• architects, builders and project managers;
• banks and payment providers;
• accountants, insurers and professional advisers;
• debt-recovery and legal service providers;
• website, hosting, email, cloud-storage and IT providers;
• UK Stairs App hosting and support providers;
• website analytics, advertising and form-security providers;
• social media and messaging platforms where you choose to contact us or connect an account;
• government departments, regulators, courts, police or other authorities where required by law; and
• a buyer, adviser or successor if we sell or restructure part of the business.

Examples of technology providers may include Google, Cloudflare, WordPress service providers, Meta, WhatsApp, TikTok and other platforms, depending on which services are active or selected.

Suppliers, installers and subcontractors only receive the information reasonably required to complete their part of the project.

We do not sell personal information.

10. International transfers

Some technology, cloud, analytics, advertising and social media providers may process information outside the United Kingdom.

Where required, we protect restricted international transfers by using:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved standard contractual clauses;
• contractual and security measures; or
• another transfer method permitted by UK data protection law.

You may contact us for more information about the safeguards used for a particular provider.

11. Cookies and similar technologies

We use cookies, local storage, tags and similar technologies to:

• operate and secure the website;
• remember privacy choices;
• protect forms from spam;
• maintain authorised app sessions;
• understand website use; and
• measure advertising, where you have agreed.

Essential technologies may operate without consent where they are necessary to provide a service you have requested or meet another legal exception.

We will not load non-essential analytics or advertising technologies that require consent until you make a positive choice.

You can accept, reject or manage non-essential technologies through the cookie banner. You can change your choices later through the cookie-preference control on the website.

See our separate Cookie Policy for the current cookie names, providers, purposes and durations.

12. Embedded content and external links

Our website may contain links to or content from other websites and platforms.

External services may collect information when you open their content, use an embedded feature or follow a link. Their own privacy notices and cookie settings apply.

Where possible, we will prevent non-essential embedded services from loading until you choose to use or allow them.

13. How long we keep personal information

We keep information only for as long as reasonably required.

Our usual retention periods are:

• Enquiries and quotations that do not proceed: normally two years after the last meaningful contact.
• Customer, contract and project records: normally six years after project completion or the end of the customer relationship.
• Approved drawings, survey information and technical project files: normally six years after completion, or longer where needed for warranty, insurance, building-safety or legal reasons.
• Contracts made as deeds or records connected with longer legal claims: up to 12 years where applicable.
• Invoices, payments and accounting records: normally six years from the relevant financial period.
• Site photographs and installation records: normally six years after completion, unless retained as an authorised portfolio example.
• Marketing records: until you unsubscribe or we no longer need them. We may retain a limited suppression record so we do not contact you again.
• App accounts: for as long as the user remains authorised. We may retain security and audit records after access ends where needed to protect the business or investigate misuse.
• Connected-platform authorisations: until the connection is removed, revoked or no longer required.
• Cookie and analytics information: for the period stated in the Cookie Policy and the relevant service settings.
• Complaints and data-rights requests: normally six years after closure where needed to demonstrate compliance.

We may keep information longer where required by law, a court order, an insurance requirement, an active dispute or a legal claim.

We may delete information sooner where we no longer need it.

14. How we protect personal information

We use reasonable technical and organisational measures to protect personal information.

These may include:

• account access controls;
• passwords and authentication measures;
• restricted app permissions;
• encrypted connections;
• backups;
• security monitoring;
• malware and spam protection;
• audit records; and
• limiting access to people who need the information for their work.

No internet, email or storage system can provide complete security. Please contact us promptly if you believe information has been lost, disclosed incorrectly or accessed without permission.

15. Automated decisions

We do not normally make decisions about customers based solely on automated processing where the decision has a legal or similarly significant effect.

Analytics, advertising and spam-detection systems may automatically assess technical information, but they do not decide whether we will supply you with a staircase.

16. Your data protection rights

Depending on the circumstances, you may have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information;
• ask us to restrict how we use information;
• object to certain uses of information;
• receive certain information in a portable format;
• withdraw consent at any time where we rely on consent; and
• complain about how we have handled your information.

These rights are not absolute. We may need to keep or continue using information where the law permits or requires it.

We may ask for information to confirm your identity before dealing with a request.

17. Your right to object

You have the right to object at any time to the use of your personal information for direct marketing.

You may also object where we rely on legitimate interests. We will stop using the information unless we have compelling lawful grounds to continue or need it for a legal claim.

To object, email hello@ukstairs.co.uk.

18. Withdrawing consent

Where we rely on consent, you may withdraw it at any time.

You can:

• use the unsubscribe option in a marketing message;
• change your cookie choices through the website;
• disconnect a third-party account from UK Stairs App where that feature is available; or
• email hello@ukstairs.co.uk.

Withdrawing consent does not affect processing that took place before withdrawal.

19. Data protection complaints

You can make a data protection complaint by emailing hello@ukstairs.co.uk.

Please use the subject line “Data protection complaint” and explain:

• what happened;
• which information is involved;
• what you would like us to do; and
• any relevant dates or supporting documents.

We will acknowledge your complaint within 30 days.

We will make appropriate enquiries, keep you informed where needed and tell you the outcome without undue delay.

You may also complain to the Information Commissioner’s Office.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

You do not have to complete our complaint process before contacting the Information Commissioner’s Office.

20. Changes to this notice

We may update this privacy notice when our services, systems, providers or legal obligations change.

The current version will always appear on this page with its last-updated date.

Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of the people affected.

21. Contact us

For privacy questions, rights requests, objections or complaints, contact:

UK Stairs
Email: hello@ukstairs.co.uk
Telephone: 01760 788 491