1. General Information
This policy applies to the website operating at the following URL: https://sofasandfriends.co.uk/
The website operator and Data Controller is: Sofas and Friends LTD, 351 Purley Way
Operator’s contact email address: sales@
The Operator is the Administrator of your personal data in relation to data voluntarily provided on the website.
The website processes personal data for the following purposes:
This policy applies to the website operating at the following URL: https://sofasandfriends.co.uk/
The website operator and Data Controller is: Sofas and Friends LTD, 351 Purley Way
Operator’s contact email address: sales@
The Operator is the Administrator of your personal data in relation to data voluntarily provided on the website.
The website processes personal data for the following purposes:
- Managing the newsletter
- Operating the comment system
- Handling enquiries via the contact form
- Preparing, packaging, and dispatching goods
- Fulfilling ordered services
- Presenting offers or information
The website gathers information about users and their behaviour in the following ways:
- Through data voluntarily entered in forms, which are then stored in the Operator’s systems
- By storing cookie files on users’ devices
2. Selected Data Protection Methods Used by the Operator
- Login areas and personal data entry points are secured at the transmission layer (SSL certificate). This ensures that personal data and login details entered on the site are encrypted on the user’s computer and can only be read on the target server.
- Personal data stored in the database is encrypted so that only the Operator possessing the encryption key can read it, ensuring protection in case of a database breach.
- User passwords are stored in a hashed form, which is a one-way function, preventing their decryption. This is the current standard for storing user passwords securely.
- The Operator periodically updates administrative passwords.
- The Operator regularly creates data backups as a security measure.
- An essential element of data protection is the regular update of all software used by the Operator to process personal data, including the updating of software components.
3. Hosting
The website is hosted (technically maintained) on the servers of a third-party hosting provider.
The hosting company, for technical reliability, maintains logs at the server level. These logs may include:
The website is hosted (technically maintained) on the servers of a third-party hosting provider.
The hosting company, for technical reliability, maintains logs at the server level. These logs may include:
- Resources identified by URL (addresses of requested resources such as pages, files)
- The time of request submission
- The time of response dispatch
- The name of the client station – identification through the HTTP protocol
- Information about errors that occurred during the execution of the HTTP transaction
- The URL of the previously visited page (referer link) – if the transition to the website occurred via a hyperlink
- Information about the user’s browser
- Information about the IP address
- Diagnostic information related to the self-ordering process via recorders on the site
- Information related to email correspondence addressed to and sent by the Operator
4. Your Rights and Additional Information on Data Usage
In certain situations, the Administrator may transfer your personal data to other recipients, if necessary for the execution of the agreement concluded with you or to fulfil the Administrator’s obligations. This applies to the following categories of recipients:
In certain situations, the Administrator may transfer your personal data to other recipients, if necessary for the execution of the agreement concluded with you or to fulfil the Administrator’s obligations. This applies to the following categories of recipients:
- Hosting provider under a data processing agreement
- Couriers
- Postal operators
- Law firms and debt collection agencies
- Payment operators
- Authorised employees and collaborators who use data for website operation
- Companies providing marketing services for the Administrator
Your personal data is processed by the Administrator for no longer than necessary to perform actions related to them, as specified by separate regulations (e.g., accounting rules). Marketing data will not be processed for longer than three years.
You have the right to request from the Administrator:
You have the right to request from the Administrator:
- Access to your personal data
- Data rectification
- Data deletion
- Processing restriction
- Data portability
You also have the right to object to processing under clause 3.2 concerning processing for the purpose of legitimate interests pursued by the Administrator, including profiling. However, the right to object cannot be exercised if there are legally justified grounds for processing that override your interests, rights, and freedoms, particularly in establishing, pursuing, or defending claims.
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe that the processing of your personal data violates data protection regulations.
Providing personal data is voluntary but necessary for the operation of the website.
Automated decision-making, including profiling, may be conducted for service provision under an agreement and for direct marketing by the Administrator.
Personal data may be transferred to third countries under data protection laws, meaning it may be sent outside the European Union.
5. Information in Forms
You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe that the processing of your personal data violates data protection regulations.
Providing personal data is voluntary but necessary for the operation of the website.
Automated decision-making, including profiling, may be conducted for service provision under an agreement and for direct marketing by the Administrator.
Personal data may be transferred to third countries under data protection laws, meaning it may be sent outside the European Union.
5. Information in Forms
- The website collects information voluntarily provided by users, including personal data if supplied.
- The website may record connection parameters (time stamp, IP address).
- In some cases, the website may store information linking form data with the user’s email address.
- Data provided in the form is processed based on the function of the specific form, such as handling service requests or commercial contact.
6. Administrator Logs
User behaviour information on the website may be logged and used for website administration.
7. Key Marketing Techniques
User behaviour information on the website may be logged and used for website administration.
7. Key Marketing Techniques
- The Operator analyses website traffic statistics through Google Analytics (Google Inc., USA). No personal data is transferred, only anonymised data. This service uses cookies stored on the user’s device. Users can manage Google ad preferences via: Google Ads Preferences.
- The Operator uses remarketing techniques to tailor advertising content to user behaviour. However, this does not involve passing personal data to advertisers.
- The Operator employs Facebook Pixel, which allows Facebook (Facebook Inc., USA) to identify users registered on its platform who visit the website. The Operator does not share personal data with Facebook. This service also relies on cookies.
- The Operator uses automated solutions, such as sending emails to users who have visited a particular subpage, provided they have consented to marketing communications.
8. Cookie Policy
The website uses cookies, which are small text files stored on the user’s device. Cookies contain the name of the originating website, storage duration, and a unique identifier.
Cookies serve the following purposes:
The website uses cookies, which are small text files stored on the user’s device. Cookies contain the name of the originating website, storage duration, and a unique identifier.
Cookies serve the following purposes:
- Maintaining the user session (after logging in), so that users do not have to re-enter login details on each subpage
- Supporting the marketing techniques outlined above
The website uses two types of cookies:
- Session cookies, which are temporary and stored until the user logs out, leaves the site, or closes the web browser
- Persistent cookies, which are stored on the user’s device until they expire or are deleted
Web browsers typically allow cookies by default, but users can modify their settings to block or delete cookies. Disabling essential authentication and security cookies may hinder the website’s functionality.
Cookies may also be used by third-party services, such as Google (Google Inc.), Facebook (Facebook Inc.), and Twitter (Twitter Inc.).
9. Managing Cookies – How to Express and Withdraw Consent
If users do not wish to receive cookies, they can change browser settings. Disabling cookies essential for authentication, security, and user preferences may impair website functionality.
To manage cookie settings, choose your browser and follow the instructions:
Cookies may also be used by third-party services, such as Google (Google Inc.), Facebook (Facebook Inc.), and Twitter (Twitter Inc.).
9. Managing Cookies – How to Express and Withdraw Consent
If users do not wish to receive cookies, they can change browser settings. Disabling cookies essential for authentication, security, and user preferences may impair website functionality.
To manage cookie settings, choose your browser and follow the instructions:
- Desktop Browsers: Edge, Internet Explorer, Chrome, Safari, Firefox, Opera
- Mobile Devices: Android, Safari (iOS), Windows Phone
This policy template was generated free of charge for informational purposes based on industry best practices and applicable laws as of 14 August 2018. It is recommended to review and customise the policy to meet specific requirements. We do not take responsibility for the consequences of using this document, as the accuracy and relevance depend on individual circumstances. Please note that a Privacy Policy is only one aspect of protecting users’ personal data and privacy on a website.