This policy explains how Aquastar Cubicles collects, uses and protects your personal data. It is written in plain English and complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read it carefully.
1. Who We Are
Aquastar Cubicles is the Data Controller for the personal information we collect through this website and through our general business activities.
Aquastar Cubicles
Aquastar House, 162 Birkenhead Road
Wallasey, Wirral, CH44 7JN
United Kingdom
As Data Controller, we are responsible for deciding how and why your personal data is processed. If you have any questions about how we handle your information, please contact us using the details above.
2. Data We Collect
We only collect personal data that is necessary for the purposes described in this policy. Depending on how you interact with us, this may include:
Identity & Contact Data
- Full name
- Email address
- Telephone number
- Company name and job title (for trade or B2B enquiries)
- Postal address (where provided for quotes or deliveries)
Technical & Usage Data
- IP address
- Browser type and version
- Operating system
- Pages visited, time of visit and time spent on pages
- Referring website (how you arrived at our site)
- Device type (desktop, mobile, tablet)
Communication Data
- The content of any enquiry or message you submit via our contact form or by email
- Records of telephone conversations where notes are taken
We do not collect any special category data (such as health data, ethnicity or biometric data), nor do we process payment card information directly — any transactions are handled by our bank or payment processor.
3. How We Collect Your Data
We collect personal data through the following means:
- Contact and enquiry forms on our website
- Email when you contact us directly
- Telephone when you call us
- Cookies and similar tracking technologies when you browse our website (see Section 9)
- Third-party sources such as Google (via Analytics and Maps), where data is collected in accordance with Google’s own privacy policy
4. Lawful Basis for Processing
Under UK GDPR, we are required to have a lawful basis before processing your personal data. We rely on the following bases:
| Processing Activity | Lawful Basis |
|---|---|
| Responding to an enquiry submitted via our contact form or email | Legitimate interests — it is in both parties’ interests to correspond about a potential project or quotation |
| Preparing and sending a quotation or proposal | Performance of a contract (pre-contractual steps taken at your request) |
| Processing an order and fulfilling a contract | Performance of a contract |
| Keeping records for accounting and tax purposes | Legal obligation (UK tax law, Companies Act) |
| Website analytics (Google Analytics) | Legitimate interests — to understand how our website is used and improve it |
| Sending marketing communications (if applicable) | Consent — you will only receive marketing from us if you have explicitly opted in |
Legitimate Interests: Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights. We do not use this basis where it would be unreasonably intrusive or cause harm.
5. How We Use Your Data
We use the personal data we collect for the following purposes:
- To respond to your enquiries and provide quotations
- To fulfil orders and manage our contractual relationship with you
- To communicate with you about your project or order
- To improve our website, products and services based on usage data
- To comply with our legal and regulatory obligations
- To send marketing communications where you have consented to receive them
We will never sell your personal data to third parties, and we will not use it for any purpose incompatible with the purposes described in this policy without first obtaining your consent.
6. How Long We Keep Your Data
We retain personal data only for as long as is necessary for the purpose for which it was collected, or as required by law.
| Data Type | Retention Period | Reason |
|---|---|---|
| Enquiries that did not result in an order | 12 months from last contact | Legitimate interests — to follow up if the project progresses |
| Customer and order records | 7 years from the end of the financial year | Legal obligation — HMRC record-keeping requirements |
| Email correspondence | 7 years | Legal obligation and legitimate interests |
| Website analytics data | 26 months (Google Analytics default) | Legitimate interests — website improvement |
| Technical log data (IP addresses) | Up to 12 months | Security and fraud prevention |
When data reaches the end of its retention period, it is securely deleted or anonymised.
7. Who We Share Your Data With
We do not sell or rent your personal data. We may share it with the following categories of third parties where necessary to operate our business:
IT and Hosting Providers
Our website is hosted on servers operated by our hosting provider. They act as a data processor on our behalf and may have access to technical data as part of maintaining the server infrastructure.
Google LLC
We use Google Analytics to understand how visitors use our website, and Google Maps to display our location. Google may collect usage and technical data in accordance with its own privacy policy. For more information, visit policies.google.com/privacy.
Email and Communication Providers
Emails and enquiries pass through our email service provider’s infrastructure. They process data only on our instruction and under a data processing agreement.
Professional Advisers
In limited circumstances, we may share data with our accountants, solicitors or insurers, strictly as necessary and subject to duties of confidentiality.
Legal Obligation
We may disclose your personal data to a court, regulator, law enforcement agency or other authority if required to do so by law or in response to a legitimate legal request.
All third parties who process personal data on our behalf are required to handle it securely and in accordance with our instructions and UK GDPR.
8. International Data Transfers
Some of our third-party service providers, including Google, may process data outside the United Kingdom. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place in accordance with UK GDPR. These safeguards may include:
- Transfers to countries recognised by the UK government as providing an adequate level of data protection
- Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner’s Office
- Binding Corporate Rules or other legally recognised transfer mechanisms
You may request further information about the safeguards we rely on for international transfers by contacting us using the details in Section 15.
9. Cookies
Cookies are small text files placed on your device when you visit a website. We use cookies to make our website function correctly, to analyse usage, and to improve your experience.
Strictly Necessary Cookies
These cookies are essential for the website to operate and cannot be disabled. They do not collect any personally identifiable information.
| Cookie | Purpose | Duration |
|---|---|---|
| WordPress session cookies | Maintain website functionality and security | Session |
| PHPSESSID | Server-side session management | Session |
Analytics Cookies
We use Google Analytics to understand how visitors interact with our website. The information collected is aggregated and anonymous — it cannot be used to identify you personally.
| Cookie | Purpose | Duration |
|---|---|---|
| _ga | Distinguishes unique users for Google Analytics | 2 years |
| _ga_[ID] | Maintains analytics session state | 2 years |
| _gid | Distinguishes users (short-term) | 24 hours |
Third-Party Cookies
Our website embeds a Google Maps widget which may set cookies from Google LLC. These are governed by Google’s privacy policy.
Managing Cookies
You can control and delete cookies through your browser settings. The following links explain how to manage cookies in popular browsers:
Please note that disabling certain cookies may affect the functionality of this website.
10. Your Rights Under UK GDPR
Under UK GDPR, you have the following rights in relation to your personal data. These rights are not absolute and may be subject to certain conditions or exemptions.
You have the right to request a copy of the personal data we hold about you (known as a Subject Access Request). We will respond within one month.
If the data we hold about you is inaccurate or incomplete, you have the right to ask us to correct it.
Also known as the “right to be forgotten”. You can ask us to delete your personal data where there is no compelling reason for us to continue holding it.
You can ask us to pause the processing of your data in certain circumstances — for example, if you contest the accuracy of the data.
Where processing is based on your consent or a contract, you can ask us to provide your data in a structured, commonly used, machine-readable format.
You have the right to object to processing based on legitimate interests or direct marketing. We must stop unless we can demonstrate compelling legitimate grounds.
We do not make any decisions about you using solely automated processing. You have the right not to be subject to such decisions where they produce legal or similarly significant effects.
Where we rely on your consent to process data, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us using the details in Section 15. We may need to verify your identity before processing your request. There is no charge for making a request unless it is manifestly unfounded or excessive.
11. How to Complain
If you are unhappy with how we have handled your personal data, please contact us in the first instance so that we can try to resolve the matter.
If you remain dissatisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the supervisory authority for data protection in the UK:
Information Commissioner’s Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
12. Links to Other Websites
Our website may contain links to other websites that are not operated by us. We have no control over these sites and are not responsible for their content or privacy practices. We strongly encourage you to review the privacy policy of any third-party site you visit. This policy applies solely to information collected by aquastarcubicles.co.uk.
13. Children’s Privacy
Our website and services are intended for business and professional use. We do not knowingly collect or solicit personal data from anyone under the age of 18.
If you believe that a child under 18 has provided us with personal data, please contact us immediately at sales@aquastarcubicles.co.uk and we will take steps to delete such information without delay.
14. Changes to This Policy
We review and update this Privacy Policy periodically to reflect changes in our practices, services or legal obligations. When we make material changes, we will update the “Last updated” date at the top of this page.
We encourage you to review this policy from time to time. Continued use of our website following any changes constitutes your acknowledgement of the updated policy.
Note: This policy was last reviewed in June 2026. If you are reading this significantly after that date, please check whether an updated version is available.
15. Contact Us
For any questions, requests or concerns regarding this Privacy Policy or the personal data we hold about you, please contact us:
Data Enquiries — Aquastar Cubicles
Aquastar House, 162 Birkenhead Road
Wallasey, Wirral, CH44 7JN
✉ sales@aquastarcubicles.co.uk
We aim to respond to all data-related requests within one calendar month in accordance with UK GDPR requirements.