Privacy policy
Last updated: 23 October 2026
This notice explains how Interiors By Sutton Ltd uses personal information when you visit interiorsbysutton.com, order goods or samples, use Tufty or our rug builder, book a consultation, contact us, take part in recorded telephone calls or receive marketing. It addresses the UK GDPR, Data Protection Act 2018 and applicable electronic-communications rules.
1 Who controls your information
Interiors By Sutton Ltd is the controller for the processing described here, except where a provider independently controls processing for its own stated purposes. Company number 14113713; VAT number 504794775. Our registered office is 11 Deakins Road, Birmingham, West Midlands B25 8DX. Our trading and privacy correspondence address is Unit A7, Radshape Business Park, Shefford Road, Birmingham B6 4PL, United Kingdom. Contact support@interiorsbysutton.com or 0121 369 0727.
2 Information we collect and its sources
You provide contact and delivery details, account information, purchases, carpet dimensions, rug designs, appointment instructions, messages, reviews and other correspondence. Recorded calls contain your voice, what is discussed and call details such as time, duration and telephone number. Tufty receives the messages and relevant shopping preferences you give it. Do not send full payment-card details, passwords or unnecessary sensitive information through chat, WhatsApp or ordinary email.
We receive payment and order confirmations from Shopify and payment providers, fulfilment updates from manufacturers and carriers, and relevant review information from Trustpilot. Checkout and payment providers handle card information through their payment systems.
Browsing and enabled features can provide IP address, browser and device details, identifiers, approximate location, referring pages, page interactions, basket activity and privacy choices. Optional Google Analytics and Google Ads processing depends on your applicable choices. We do not intentionally request special-category information for ordinary flooring purchases.
3 Purposes and lawful bases
For quotations, purchases, samples, accounts, consultations, delivery and refunds, we process necessary information to take steps you request before contracting and perform our contract. Necessary identity, order and delivery details are required to fulfil an order; without them we may be unable to supply it.
For ordinary enquiries, security, fraud prevention, service records, complaints and establishing or defending legal claims, we rely on our legitimate interests in running and protecting the business and serving customers, where these are not overridden by your rights. Some processing also supports a contract or legal obligation. We assess necessity, proportionality and your reasonable expectations.
For tax, accounting and other legal duties, we rely on compliance with legal obligations. We retain or disclose information only where the relevant requirement applies.
For Google Analytics, Google Ads and associated optional tracking, we obtain consent where required. Section 12 below explains cookie purposes and controls. We do not treat purchasing or accepting terms as consent to optional tracking.
For marketing emails, texts or WhatsApp messages, we use consent where required. If the products and services soft opt-in applies, we use it only where we collected your details directly during a sale or negotiation, market our own similar products and gave an opt-out when collecting the details and in every message. The related data-protection basis may be legitimate interests. You can object to direct marketing at any time.
For proportionate review invitations and handling genuine customer reviews, our basis is our legitimate interest in obtaining feedback and improving service, subject to applicable electronic-marketing rules. A message containing promotions is assessed as marketing rather than automatically treated as an administrative review request.
4 Recorded telephone calls
We record telephone calls to maintain an accurate record of enquiries, instructions and agreements, investigate complaints, prevent fraud and establish or defend legal claims. Our data-protection basis is our legitimate interests in accurate business records and protecting customers and the business, subject to a necessity and balancing assessment. A particular legal duty may also require retention of relevant evidence.
We tell callers that recording takes place and explain its purposes at the start of the call. Please do not disclose full card details or sensitive information unnecessarily. Ask about an unrecorded alternative if you object, or contact us by email or post. We consider objections under the applicable rules; an objection is not an automatic right to erase evidence that must lawfully be retained.
Recordings and relevant call information are accessible only to authorised people who need them, including our communications provider and appropriate advisers or insurers where necessary. They are reviewed against the enquiry, order, complaint, fraud or legal-claim purpose. Routine recordings are not kept indefinitely simply because storage is available. A recording needed for a dispute may be retained for that dispute and applicable legal period. Section 9 explains the wider retention criteria.
5 Tufty AI, shopping assistance and design enquiries
Information used. Tufty processes your questions and its replies, relevant product and variant selections, measurements, units, room requirements, basket or proposed checkout information, session identifiers and activity times. While you use an active conversation, it can receive the current and recent public shopping pages on our website, page titles, product references and on-site search terms so it can understand what you are asking about. This is shopping context from our website, not access to your general browser history or other websites. You may also supply contact details and an enquiry, rug design or appointment requirements. Avoid unnecessary information about others, payment credentials, passwords and sensitive personal details.
Purposes and lawful bases. We use this information to answer requests, suggest relevant products, calculate or explain selections, prepare a basket or draft checkout, restore a requested conversation and provide human support. Necessary steps you request towards a purchase and performance of a contract use the contract or pre-contract basis where applicable. Ordinary support, proportionate service checks, security and preventing abuse use our legitimate interests in operating a reliable shop, balanced against your rights. Necessary legal records use the relevant legal-obligation basis. Optional marketing and tracking have separate rules and choices; opening chat is not consent to unrelated marketing.
AI and service providers. When the AI feature is enabled, relevant messages and shopping context are sent to OpenAI through its API to generate replies and, where used, an enquiry summary. Supabase hosts the Tufty backend and conversation database. Google Workspace handles support email, and Shopify processes relevant basket, draft-order, customer and order information for requested shopping functions. These providers receive the information needed for their role and operate under their applicable service arrangements. Section 8 explains international processing and safeguards. Do not assume that chat is private to your device or that an AI-generated summary is necessarily accurate.
Asking the flooring team. When you submit the contact form, we email your name, email address, telephone number and message together with the full available saved conversation, including both your questions and Tufty's replies, to support@interiorsbysutton.com. The enquiry can also include a summary, measurements, requirements, discussed products, current and recent shop pages and relevant proposed checkout information where available. This lets staff respond without asking you to repeat the conversation. A summary is labelled as AI-generated and must be checked against the transcript. Rug enquiries include the design and measurements you submit. You can instead contact us directly without using Tufty.
Session storage and retention. The requested chat uses browser local storage and a device-held security key in IndexedDB to remember and protect the conversation across pages. The resumable session expires after 24 hours without meaningful interaction. Expired backend conversations are scheduled for removal; this expiry is not a promise that every associated record or browser copy is erased at that exact moment. Browser storage can remain until overwritten or cleared using your browser controls. An enquiry already emailed to our team, an order created in Shopify and records needed for a complaint, security issue or legal obligation have separate retention purposes under section 9. Deleting browser data or closing chat does not delete those records. Contact us to exercise your data rights.
Spam and security checks. We use automated checks on message content, submission patterns, timing and request volumes to reduce spam and misuse. Our limiter uses keyed representations of network and, for enquiry limits, email identifiers, together with session information; these are security identifiers, not a claim that all related data is anonymous. Infrastructure providers may also process network and technical logs. Checks may reject or temporarily limit a genuine request. Contact us by email or telephone if you need help; a chat block does not itself reject an existing order or a trade application.
Your choices and review. Tufty provides recommendations and shopping assistance; it does not itself accept an order or determine a trade application. You review a basket or checkout before purchasing. You can ask our team to review an answer, correct inaccurate personal information or consider a disputed automated restriction. Any applicable safeguards and rights for solely automated decisions with legal or similarly significant effects remain available. See section 10 for access, correction, deletion, objection and complaint rights, section 12 for storage controls, and section 24 of our Terms of Service for the assistant's limitations.
6 Recipients and independent services
We share information needed for the relevant purpose with Shopify, payment providers, manufacturers and suppliers, carriers, AI and hosting providers for Tufty and design tools, communications and telephone-recording providers, IT suppliers, and professional advisers or insurers. Authorities receive information where disclosure is lawfully required or justified. A genuine business sale or restructuring may involve necessary disclosure subject to appropriate safeguards.
For manufacturer-direct samples or goods, we share the delivery details, requested products and necessary contact information with that supplier. We do not authorise unrelated supplier marketing merely because it fulfils your order.
Google receives information for enabled Analytics and Ads functions in accordance with your choices. WhatsApp processes information when you choose that communication channel. Trustpilot processes information needed for applicable review invitations and reviews. These providers may independently control some processing under their own notices. A social-media link does not by itself mean we operate that platform's advertising pixel on our store.
Shopify provides the storefront, checkout and associated services. Some Shopify services process information as an independent controller under its own notice. Contact us for processing we control and consult the relevant provider's notice for its independent uses. Using a provider does not remove our own obligations.
7 Cookies and marketing choices
See section 12 below for cookies, local storage and similar technologies. Strictly necessary functions can operate without consent where the legal exception applies. Optional analytics and advertising requiring consent are subject to your choices. You may withdraw consent and object to direct marketing without affecting earlier lawful processing.
Use the unsubscribe option in marketing or contact support@interiorsbysutton.com. We retain sufficient suppression information to respect your choice. Necessary order, delivery, security and support messages can continue. Choosing WhatsApp for an enquiry is not agreement to receive unrelated WhatsApp marketing.
8 International processing
Some providers process information outside the United Kingdom, including in the United States or other countries according to their service arrangements. Where we make a restricted transfer, we use an applicable legal mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, with the required assessment and additional safeguards where necessary. We do not rely on website use as blanket consent to unrestricted transfers.
Contact us for information about the safeguards relevant to your data and an appropriate copy, with lawful protection of confidential or third-party information. Provider privacy notices describe their independent processing and international arrangements.
9 Retention and security
We retain information for the time needed for its stated purpose and applicable legal requirements. Accounting and tax records are normally kept for six years from the end of the relevant company financial year, with longer retention where law or an ongoing matter requires it. This does not mean all browsing, chat or call data is kept for six years.
Enquiries, designs, conversations and call recordings are assessed against whether the enquiry remains active, whether they form part of an accepted order, support or complaint needs, evidence required for a claim, legal limitation periods and fraud risks. Records without a continuing justified purpose are deleted or anonymised. Marketing records are kept while their lawful purpose continues and suppression records for as long as needed to honour objections. Cookie and provider retention depends on the relevant technology and settings.
We use appropriate access restrictions, security measures and supplier arrangements. Account closure or a deletion request does not require destruction of records we must lawfully retain; we explain applicable exceptions. Backup copies remain subject to their secure replacement cycle and are not repurposed to avoid deletion. If a personal-data breach occurs, we assess and meet applicable notification duties.
10 Your rights and complaints
Subject to legal conditions and exceptions, you may request access, correction, deletion, restriction and portability of eligible information. You may object to processing based on legitimate interests and withdraw consent where relied upon. Your right to object to direct marketing is absolute. Contact us using the details in section 1.
We may request proportionate identity information to protect against wrongful disclosure. Rights requests are normally free and answered without undue delay and within one month. Any lawful extension, clarification process, refusal or charge is explained under the applicable rules.
You can make a data-protection complaint by email, telephone or post. We acknowledge it within 30 days, investigate appropriately, keep you informed and communicate the outcome without undue delay. You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/ or on 0303 123 1113. Other applicable regulatory and court remedies remain available.
11 Children and changes
Our shop and assistant are intended for adults buying flooring. If a child has supplied information unnecessarily, contact us so we can assess it. External sites have their own notices. We update this policy when practices or legal requirements change and provide additional notice where required. A later notice does not retrospectively authorise a use requiring fresh consent.
Provider privacy notices
Shopify Consumer Privacy Policy
12 Cookies and similar technologies
Interiors By Sutton Ltd uses cookies and similar technologies on interiorsbysutton.com. These can include browser local storage, pixels and identifiers. This section explains their purposes and your choices and forms part of this Privacy Policy.
1 Necessary functions
Storage or access strictly necessary to provide a service you request may operate without consent where the legal exception applies. Examples include secure checkout, basket contents, authentication, fraud protection necessary for the service and remembering privacy choices. A useful commercial purpose alone does not make tracking strictly necessary.
Saved designs, measurements, sample selections and assistant conversations can involve storage needed for a requested feature. Optional persistence, analytics and advertising uses are assessed separately rather than automatically exempted.
2 Google Analytics and Google Ads
Google Analytics helps us understand visits and improve the store. Subject to settings and consent, it processes device and browser details, identifiers, pages, interactions and purchase events. We obtain consent for this optional tracking.
Google Ads supports advertising, conversion measurement and, where enabled and consented to, personalised advertising. Identifiers and interactions may be shared with Google. We obtain required consent for advertising storage, data use and personalisation. Another setting must not override refusal.
We do not treat accepting terms, scrolling or continuing to browse as consent. The limited legal exceptions for some statistical or functional uses do not automatically cover Google advertising, remarketing or technologies used for multiple purposes.
3 Embedded services and external links
Shopify provides store and checkout functions. Trustpilot review features can involve third-party technologies depending on how they are displayed. Any optional tracking requiring consent is subject to your choice. A link to WhatsApp opens a separate service governed by its own privacy notice; it does not authorise unrelated advertising tracking on our website.
4 Accepting refusing and changing choices
Use the website's cookie controls to accept, reject or manage optional categories. Rejecting optional tracking must be as straightforward as accepting it. Necessary shopping functions remain available subject to their technical requirements. You can change your choice and withdraw consent through the cookie controls; withdrawal is as easy as giving consent.
Browser controls can delete or block storage but may remove saved baskets, designs or sign-in settings without changing consent saved elsewhere. Use website controls too. Contact support@interiorsbysutton.com if a control is missing or does not work.
5 Technology details and retention
Cookies last for a session or defined period; local storage may persist until removed. Purposes, providers and durations depend on the configured technology. Current details should be available with the cookie controls. Contact us for help identifying or removing an item.
Withdrawing consent stops the optional uses governed by it going forward. Where possible, associated optional storage is removed or disabled. Withdrawing consent does not retrospectively invalidate processing that was lawful when it occurred. The sections above explain data retention, provider processing, international safeguards and your rights.
13 Trade applications and account pricing
When you apply for a trade account, we collect your name, business contact details, trading name, the website or registration information you choose to provide, and a description of your trade and projects. We may request proportionate evidence to confirm business eligibility or your authority to act. We record the application, correspondence and approval status. Orders may include a project or purchase-order reference and delivery notes. Please keep these fields relevant to the purchase and avoid unnecessary personal or sensitive information about an end customer.
We use this information to review applications, communicate a decision, manage access, provide account pricing, process purchases and protect against misuse. Our team makes approval decisions manually. This purchasing account is not a credit application; the online application does not initiate a credit-reference search. Where you personally request a contract or pre-contract steps, we rely on that lawful basis as appropriate. For a company's representative, business verification and account security, we rely on our legitimate interests in managing genuine business relationships and protecting the service, balanced against your rights. Tax and other statutory records are processed to meet legal obligations.
We receive contact-form applications through Shopify by email and keep relevant application and correspondence records in our business systems. Where Shopify Forms is enabled, it also holds submitted details in our store's form and customer records. Where online account pricing is enabled, our existing Sutton basket service, hosted with Supabase, checks the signed-in Shopify customer identifier, approval status and relevant VAT status to verify account pricing. It processes the basket, project reference and checkout association needed for the requested purchase. The application is not sent to an unrelated business or used to train Tufty. Existing provider, international-transfer and security provisions above apply.
We keep application and account records for as long as reasonably needed to review and manage the relationship, handle disputes, maintain security and meet legal record-keeping requirements. Unsuccessful or withdrawn applications are assessed for deletion when these purposes no longer require them; we do not keep them indefinitely simply because an application was made. Order and accounting records can require a separate retention period. Contact us to correct your business information or request account closure, and see section 10 for your data-protection rights.
Applying does not subscribe you to marketing. Account review, approval, security and order messages are service communications. Optional promotional messages remain subject to the separate choices and electronic-marketing rules explained above.