Privacy Policy

This privacy policy explains how Gecko Glazing Ltd. collects and uses personal information about customers, prospective customers, website visitors and other people who interact with us. It applies whether you contact us through our website, online store, telephone, email, social media, a surveyor or installer, or another channel.

1. Who we are
   1. Gecko Glazing Ltd. is the controller responsible for the personal information described in this policy. We are registered in Scotland under company number SC524562. Our registered office is 4 Sauchiebank, Edinburgh, Scotland, EH11 2NN.
   2. For privacy questions or to exercise your rights, email info@geckoglazing.co.uk, telephone 0131 305 0925, or write to us at the address above.
2. The information we collect
   1. Identity and contact information, such as your name, address, email address and telephone number.
   2. Enquiry, quotation and order information, including products requested, dimensions, colours, prices, discounts, delivery information and order history.
   3. Property and installation information, such as the property address, postcode, window type and condition, measurements, templates, photographs, videos, access information, survey notes, installation notes and remedial-work records.
   4. Payment and transaction information, including payment status, invoices, refunds and limited payment references. Card and account details are normally handled by our payment provider rather than stored by Gecko in full.
   5. Communications, including emails, messages, call notes, web forms, social-media messages, complaints, reviews and customer-service history. If we record a call, we will tell you.
   6. Account and preference information, including login details, marketing preferences, consent records and communication choices.
   7. Website and device information, including IP address, device and browser information, pages viewed, referral source, approximate location, interactions, cookies and similar identifiers.
   8. Information relevant to fraud prevention, security, legal claims and compliance.
   9. We do not intentionally collect special-category information unless it is necessary in an exceptional situation, for example accessibility information needed to arrange a safe visit. Please do not provide sensitive information unless it is relevant.
3. How we obtain information
   1. We collect information directly from you when you request a quote or sample, place an order, create an account, book a survey or installation, contact us, enter a promotion, submit a review, sign up for marketing or otherwise interact with us.
   2. We may receive information from another member of your household, a property owner or occupier, a surveyor, installer, reseller, referral partner, payment provider, delivery company, social-media platform or other person involved in your enquiry or order.
   3. We receive technical and usage information automatically through our website, cookies, pixels and similar technologies, subject to your choices where consent is required.
   4. If you give us information about another person, please ensure you are entitled to do so and, where appropriate, direct them to this policy.
4. How and why we use personal information

Purpose	Information used	Lawful basis
Responding to enquiries and preparing quotations	Identity, contact, property and enquiry data	Steps at your request before a contract; legitimate interests in managing enquiries
Processing orders, manufacture, delivery, surveys and Gecko-supplied installation	Identity, contact, order, property, payment and communications data	Contract; legitimate interests where dealing with another household or business contact
Taking payment, invoicing, accounting and tax	Identity, transaction and payment data	Contract; legal obligation; legitimate interests in financial administration
Customer service, complaints, remakes, remedials and guarantees	Order, property, photographs and communications	Contract; legal obligation; legitimate interests in resolving issues and improving service
Managing independent surveyors, installers, couriers and other partners involved in an order	Contact, order, property and access data	Contract; legitimate interests in fulfilling and coordinating the requested service
Operating accounts, CRM, order-management and internal administration	Identity, contact, order and communications data	Contract; legitimate interests in running an efficient and accurate business
Improving products, services, training and quality control	Survey, installation, support and feedback data	Legitimate interests in quality, safety and product improvement; consent where information is used publicly
Website operation, security, fraud prevention and troubleshooting	Account, device, usage and transaction data	Legitimate interests in secure operation; legal obligation; consent for non-essential storage/access where required
Analytics, advertising and audience measurement	Cookie, device and interaction data	Consent where required by PECR; legitimate interests only where lawful and appropriately balanced
Marketing similar Gecko products and services	Contact, purchase/enquiry history and preferences	Consent or legitimate interests, subject to PECR including the soft opt-in where available
Legal claims, regulatory requests and business transactions	Relevant records from the categories above	Legal obligation; legitimate interests in protecting rights, compliance and business continuity

5. Marketing
   1. We may send marketing where you have consented or, where permitted, under the electronic- marketing “soft opt-in” for our own similar products and services. We will provide an opportunity to opt out when we collect your details where required and in every marketing message.
   2. You can stop direct marketing at any time by using the unsubscribe link or contacting us. We may retain minimal information on a suppression list so that we can respect your choice.
   3. We may use advertising platforms to show or measure advertisements only in accordance with applicable cookie and marketing rules and your consent choices.
6. Who we share information with
   1. We share personal information only where reasonably necessary. Recipients may include surveyors, installers, resellers and other fulfilment partners; delivery and logistics providers; payment providers and banks; accountants and professional advisers; insurers; IT, hosting, ecommerce, email, telephony, messaging, CRM, order-management, file-storage, security and automation providers; analytics and advertising providers where permitted; review and customer-feedback services;regulators, courts, law-enforcement bodies and tax authorities; and a purchaser or adviser in connection with a business sale or restructuring.
   2. Depending on the services currently used, providers may include WordPress/WooCommerce and our website host; HubSpot; Microsoft 365; PayPal and other checkout providers; Xero; Zapier; WhatsApp or Twilio; Retool, Supabase and Netlify; Google services; and Meta services. This list should be read as examples of relevant provider categories, not as permission for unrelated use.
   3. Some surveyors and installers act on Gecko’s behalf as processors or subcontractors. Others are Independent Contractors and separate controllers where you contract with and pay them directly. Where another controller handles your information, its own privacy notice also applies.
   4. We do not sell personal information.
7. International transfers
   1. Some suppliers may process information outside the United Kingdom. Where personal information is transferred to a country without UK adequacy regulations, we use an approved safeguard where required, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with supplementary measures where appropriate.
   2. You may contact us for further information about the safeguard relevant to a transfer.
8. How long we keep information
   1. We keep personal information only for as long as reasonably necessary for the purpose collected, including contractual, guarantee, tax, accounting, safety and legal-claims requirements.
   2. As a working retention framework: enquiry records that do not become orders are normally kept for up to 24 months after the last meaningful contact; customer, invoice and payment records are normally kept for six years after the end of the relevant financial year; and order identity, pane specifications, measurements and guarantee-claim records may be kept for the duration of the longest applicable guarantee, currently up to 30 years, plus a reasonable period for resolving claims.
   3. Where a customer is eligible for the Lifetime Replacement Discount, we may retain a limited record of the original purchase and use of that benefit for the lifetime of the original purchaser, unless the benefit ends earlier. Routine photographs, correspondence and installation notes are not necessarily retained for the whole guarantee period and are deleted or anonymised when no longer reasonably required.
   4. Marketing records are kept until you opt out or the information is no longer useful, with a minimal suppression record retained to honour opt outs. Cookie durations are shown in the Cookie Policy.
   5. Actual periods may be extended where information is needed for an active complaint, legal claim, fraud investigation, regulatory requirement or another documented reason. We securely delete or anonymise information when it is no longer required.
9. Cookies and similar technologies
   1. Essential cookies and similar technologies are used where necessary to operate the site, provide a service you request, secure checkout or remember privacy choices.
   2. We ask for consent before using non-essential analytics, advertising, personalisation or similar technologies where required. Rejecting non essential cookies should be as easy as accepting them, and you can change your choice through the “Manage consent” control.
   3. Our Cookie Policy provides a current list of cookies and similar technologies, their providers, purposes and durations. The Cookie Policy and consent tool form part of this privacy information.
10. Security
    1. We use appropriate technical and organisational measures designed to protect personal information, including access controls, authentication, staff procedures, supplier controls, backups and security monitoring appropriate to the risk.
    2. No internet or storage system is completely secure. If you believe information has been lost, misused or accessed without authority, contact us promptly.
11. Your rights
    1. Depending on the circumstances and lawful basis, you may have rights to access your personal information; correct inaccurate information; request erasure; restrict processing; object to processing; receive certain information in a portable format; and withdraw consent at any time without affecting earlier lawful processing.
    2. You have an absolute right to object to the use of your personal information for direct marketing. You may also object to processing based on legitimate interests, although we may continue where we demonstrate compelling legitimate grounds or need the information for legal claims.
    3. To exercise a right, contact us using the details in section 1. We may ask for information needed to verify identity. Rights are subject to legal conditions and exemptions, and we will normally respond within one month.
12. Automated decisions
    1. We do not currently make decisions about customers based solely on automated processing that
       produce legal or similarly significant effects. We may use limited automation to route enquiries,
       calculate distances, manage workflows, segment audiences or assist staff, but a person can review
       material decisions.
13. Complaints
    1. Please contact us first if you have a concern so that we can try to resolve it.
    2. You also have the right to complain to the Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint, telephone 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
14. Children
    1. Our products and website are not directed at children, and we do not knowingly collect information from children for marketing or account purposes. If you believe a child has provided information to us inappropriately, please contact us.
15. Links and other controllers
    1. Our website may link to websites, social-media platforms or services controlled by others. Their privacy notices apply to their processing, and we are not responsible for their practices.
16. Changes to this policy
    1. We may update this policy to reflect changes in our services, suppliers or the law. We will publish the updated version on this page and change the “last updated” date. If a change materially affects how we use information, we will take reasonable steps to bring it to the attention of affected people.