Privacy notice

Painted Bespoke Joinery Ltd (company no. 15180866, VAT no. 453 0435 19) handles trade manufacturing, bespoke joinery, the shop and trade accounts. Painted Ltd (company no. 13767710, VAT no. 448 4677 49) handles spray finishing. Each is the data controller for its own work, and each is responsible for the parts of this notice that apply to it.

Registered office and correspondence address for both: Unit 2 Mill Lane Trading Estate, Croydon CR0 4AA.

This notice covers everyone whose details we may hold:

• People who enquire by form, email, phone or social message.
• Customers buying bespoke joinery, spray finishing or shop goods.
• Trade customers and the people named on a trade account application.
• People using the customer portal to approve work or pay an invoice.
• Visitors to our website and to our workshop reception.
• Suppliers, subcontractors and their staff, where we hold a contact.
• Painted employees who use Painted Operations, our private staff application.

We are not obliged to appoint a data protection officer. Privacy questions go to the director responsible, reachable at the address and email in the last section.

“We”, “us”, “Painted” — the two companies named above.

“The application” — Painted Operations, the private application our employees use to run enquiries, quotes, orders, the workshop and marketing. It is not open to the public.

“Personal data” — any information that identifies a living person, directly or when put together with something else we hold.

“Google user data” — anything the application receives from a Google account after that account holder has granted permission on Google's sign-in screen: the account email address, Gmail messages in a connected business mailbox, and reporting figures from Google Ads, Analytics, Search Console and YouTube.

“Processor” — a supplier that handles data for us, under contract, and only on our instructions.

When you enquire: your name, company, email address, phone number, the address of the work, what you have asked for, and any drawings, measurements or photographs you send. If you ring us, we keep a written note of the call — the caller, the number, what was asked and what we said we would do.

When we quote: the specification, the finishes and materials chosen, the priced breakdown, revisions, and your approval or comments.

When you order: everything above, plus the delivery and installation address, access notes, order and invoice history, purchase orders, and the card type and last four digits from your payment. We never see or store your full card number — Stripe takes the payment and holds the card details.

While the work is made: production records, workshop photographs of your job, quality checks, delivery and installation notes, a signature and photograph on hand-over, snags reported afterwards and how they were put right.

When you apply for a trade account: company details, the names of directors or authorised buyers, trading references, the credit limit and terms agreed, and payment behaviour on the account.

When you buy in the shop or use the portal: your account email, a securely hashed password, saved delivery addresses, saved card references held by Stripe (never the card number itself), basket and order history, returns, and the messages you send us through the portal.

When you visit the workshop: the reception log — name, company, who you came to see and the time in and out.

When we ask for a review: whether the request was sent and opened, and any rating or comment you choose to give.

When you use the website: pages viewed, how you arrived and rough location from your IP address — but only if you agreed to measurement or advertising cookies. Essential cookies keep the basket, sign-in and payment working and are always on. See the cookie notice.

When you email one of our business mailboxes: your message, its attachments and the conversation that follows are read into the enquiry record so any member of the team can pick the job up. This is the Gmail access described in the Google sections below.

When you arrive from one of our paid adverts: we keep a security record of that visit — your IP address, the browser you used, which advert and search brought you, the pages seen, how long you stayed and whether a form was started. This is not a cookie choice: it is how we protect the advertising budget from robots and repeat clickers, which is our legitimate interest. We keep the visit for 90 days and the page-by-page detail for 30 days, then delete it. It is never used to advertise to you.

From other places: Companies House and credit reference information for a trade application, public business listings when we research a prospective trade customer, and messages sent to our social accounts.

Where we rely on legitimate interests we have weighed our interest against your rights and privacy, and we will stop if you object and we have no overriding reason to continue. Where we rely on consent you can withdraw it at any time without affecting anything done before.

The staff application uses artificial intelligence to help our team work faster. In plain terms, it can sort an incoming email into the right enquiry, summarise a long conversation, suggest a reply, tidy up a call note, read out a summary aloud and turn speech into text.

A member of staff always reads and approves an AI draft before it is sent to you. Nothing about your order, your credit, your price or your rights is decided automatically. There is no automated decision-making producing a legal or similarly significant effect on you, and no profiling of that kind.

Content sent for this processing goes to Google Gemini and, for speech, to ElevenLabs. It is used only to produce the result we asked for and returned to us. It is not used to train generalised or non-personalised AI or machine-learning models, and never to build an advertising profile.

We only pass details to the suppliers who make the service work. Each one is under contract, may use the data only to provide its service to us, and may not use it for its own purposes.

We also disclose information where the law requires it, to a public body entitled to it, or where it is needed to establish or defend a legal claim. If a company were ever sold or merged, records would pass to the buyer under the same terms.

We never sell your details, and we never pass them to a data broker.

Painted Operations is the private staff application run by Painted Bespoke Joinery Ltd. It is used only by Painted employees, and it is the application named on the Google sign-in screen when a Google account is connected. A member of staff chooses to connect a business-owned Google account, Google shows the permissions before access is granted, and we only access the account after that consent and only for the features listed below.

We ask for the narrowest permission that makes a feature work. Where a read-only permission is enough, that is what we request. Every permission is set out here, with what it lets the application do, why we need it, and what we keep.

Gmail (read and send). Enquiries arrive by email. The application reads the connected business mailbox so a new enquiry appears on the sales board with its conversation attached, so a reply from a customer lands against the right job, and so a member of staff can answer, send a quote or send an order update from the same address the customer already writes to. We never delete, alter or archive a message in Gmail, and we never touch a personal Google account.

Google Ads. The marketing desk shows Painted's own campaigns, adverts, audiences, budgets and results in one place, so spending can be judged against the enquiries it produced. A change is only sent to Google Ads after an authorised member of staff reviews and approves it on screen.

Analytics, Search Console and site verification. These give summary figures for Painted's own websites — traffic, pages, search queries, clicks, impressions and indexing problems — and let a Painted website be verified without leaving the application. They are not used to identify an individual visitor.

YouTube and YouTube Analytics. Read-only figures for Painted's own channel and videos, connected separately and only if staff choose to.

Account email address. So staff can see which business account is connected, and so a member of staff can sign in with Google.

Google OAuth access and refresh tokens are held in our private database and are available only to trusted server code. They are never sent to a browser and never shown on screen. Connected account details and the business records created from Gmail are available only to authorised Painted staff, according to their role. We use access controls, encrypted connections in transit, encryption provided by our hosting and database suppliers at rest, restricted administrator access, and an audit trail of who opened what.

We share Google user data only with service providers acting for us where that is necessary to run these staff features: Supabase for secure database and file storage, and Google Gemini for the limited email processing described below. They may process the data only to provide their service to us. We may also disclose data where the law requires it. We do not sell Google user data, share it with data brokers, use it for credit or lending decisions, or transfer it for personalised, retargeted or interest-based advertising.

Painted's use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Gmail content may be sent to Google Gemini only to classify an enquiry, summarise the conversation or draft a reply for the authorised staff member using the feature. A member of staff reviews a draft before it is sent. This processing is used solely to provide and improve those user-facing features.

We do not use Google Workspace API data to develop, improve or train generalised or non-personalised artificial intelligence or machine-learning models. We do not use it to build advertising profiles or for any advertising purpose, and we do not make it available to a human reader outside the authorised Painted staff working on that enquiry, except where you have asked us to, where it is needed for security purposes, or where the law requires it.

Other information sent directly to us, such as enquiry details and call notes, may be processed by Google Gemini or ElevenLabs to produce summaries, drafts or call assistance. We do not use that information to train AI models either.

Gmail conversation data copied into Painted's system, including message content used by the internal assistant, is kept for no more than 3 months and is then deleted automatically. Google Ads, Analytics, Search Console and YouTube reporting data is refreshed as staff use the reporting tools; we do not keep raw Google API reporting responses longer than needed to provide those reports. Business records that must be retained for a contract or legal obligation follow the periods in the retention section below.

When staff disconnect a Google integration in Painted, we delete its stored access and refresh tokens straight away. The Google account holder can also revoke Painted's access at any time from the third-party connections page in their Google Account. Revocation stops further access; data already copied into a required business record remains subject to the periods stated in this notice.

To ask us to delete Google user data that we are not legally required to keep, email info@painted.co.uk, ring 020 8944 2817, or write to Painted Bespoke Joinery Ltd, Unit 2 Mill Lane Trading Estate, Croydon CR0 4AA. We acknowledge the request, confirm who is asking, and complete a valid deletion request within one month.

There is a fuller description of Painted Operations, what it is for and who uses it, on our Google integration page.

Our database and files are held in the United Kingdom and the European Economic Area. Some of the suppliers listed above process data in the United States.

Where data leaves the United Kingdom we rely on the UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, together with the technical measures those contracts require. You can ask us for a copy of the safeguard used for a particular supplier.

• Everything travels over an encrypted connection, and is encrypted at rest.
• Staff accounts are created only by a director or manager, and sign-in needs a password plus a second step.
• What a member of staff can see depends on their role. Payment, credit and personnel records are limited to the people who need them.
• Keys, tokens and passwords are held server-side, never in a browser, and are rotated when someone leaves.
• Sensitive actions are logged, so we can see who did what and when.
• Backups are taken regularly and are held under the same protections.
• If a breach were to put your rights at risk, we would tell the Information Commissioner's Office within 72 hours and tell you without undue delay.

When a period ends the record is deleted, or anonymised so it can no longer identify anyone and only counts remain.

We only run measurement and advertising cookies if you agree in the banner. Google Consent Mode is set to deny until you do, so nothing is sent before your choice. You can change or withdraw that choice at any time on the cookie notice.

We may email an existing customer about similar work or aftercare on the basis of our legitimate interests, and every such email carries a one-click unsubscribe. Anything else — a newsletter, an offer to somebody who has not bought from us — goes out only with consent.

Under UK data protection law you can:

• Ask for a copy of the personal data we hold about you, and be told why we hold it.
• Have it corrected if it is wrong or incomplete.
• Ask us to delete it where we are not required to keep it.
• Ask us to pause our use of it while a dispute about accuracy or our grounds is settled.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Ask for portability — a machine-readable copy of the data you gave us, or for it to be sent to someone else.
• Withdraw consent for measurement, advertising or marketing email at any time.

Email info@painted.co.uk or ring 020 8944 2817. We answer within one month, and tell you if a complex request needs longer. There is no charge unless a request is clearly excessive. We may ask for proof of identity first, so we do not hand your details to somebody else.

If you are not happy with our answer you can complain to the Information Commissioner's Office at ico.org.uk, by phone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

Our work, our shop and our staff application are for businesses and adults. We do not knowingly collect details from anyone under 16. If you believe a child has given us information, tell us and we will delete it.

We review this notice at least once a year and whenever we add a feature that changes what we hold. The date at the top is the version in force. If a change matters to you we will say so on the site, and by email where we have one.

Painted Bespoke Joinery Ltd and Painted Ltd, Unit 2 Mill Lane Trading Estate, Croydon CR0 4AA. Email info@painted.co.uk, phone 020 8944 2817. See also our Google integration page, cookie notice and terms.