Data should move only where the order needs it.

SOUTH ESSEX PLUMBING AND HEATING LIMITED, at Ground Floor, Kings House, 101-135 Kings Road, Brentwood, Essex, CM14 4DR, United Kingdom, is the data controller for the Ripple store. Contact support@southessexphh.shop for privacy questions or rights requests.

Our store sells physical, self-fit bathroom goods worldwide. This policy applies to browsing, checkout, membership, delivery, returns, fit enquiries and support.

• Identity and contact data: name, email, telephone, country and support correspondence.
• Order and delivery data: basket contents, billing status, delivery address, carrier updates, returns and refund records.
• Membership data: plan, renewal status, benefit eligibility and quarterly delivery history.
• Fit-check data: bathroom setup, door thickness, surface type and the issue described.
• Technical data: IP address, browser, device, security events, cookie choices and basic page activity.

We do not ask for identity documents. Stripe or PayPal processes payment-card details; Ripple does not receive or store the complete card number or card security code.

We collect data directly from you when you browse, add items to a basket, submit checkout, contact, fit-check or membership forms, place an order, request a return or contact support. We collect technical data automatically from essential cookies, server logs and security tools. Payment providers supply payment status and billing identifiers; delivery carriers and fulfilment partners supply dispatch, tracking and delivery events; email providers supply delivery status and support replies.

If someone orders for another recipient, the buyer must have permission to provide that recipient's shipping address and contact details.

• Contract: take payment status, fulfil orders, arrange delivery, provide membership benefits and handle returns.
• Legitimate interests: prevent fraud, secure the store, answer fit and support enquiries, improve stock planning and recover an abandoned checkout where permitted.
• Consent: optional marketing, non-essential analytics and certain cookie use. Consent can be withdrawn.
• Legal obligation: accounting, tax, consumer-rights, dispute and regulatory records.

We do not use fit-check responses to make decisions with legal or similarly significant effects.

We use the shipping address, recipient name and contact details to validate the destination, pick and pack the ordered bathroom sets, create shipping labels, provide tracking, complete order fulfilment, resolve failed delivery, and administer returns or replacements. Warehouse and packing partners receive the order contents and necessary recipient details; postal or courier carriers receive the recipient name, shipping address, telephone or email needed for delivery.

We also share only what is needed with hosting and infrastructure providers, Supabase for secured lead and order records, Stripe or PayPal for payment, transactional email providers, fraud and bot-prevention services, analytics providers where consent applies, and professional advisers or authorities where law requires. Processors act under contracts and may not use order data for unrelated purposes.

Some processors or carriers may handle data outside the United Kingdom or European Economic Area. Where adequacy regulations do not apply, we use appropriate safeguards such as the UK International Data Transfer Agreement, UK Addendum or EU Standard Contractual Clauses, plus security and transfer-risk review.

• Checkout leads that do not become orders: up to 24 months, unless consent is withdrawn sooner.
• Contact and fit enquiries: up to 24 months after the last meaningful exchange.
• Order, payment-status, refund and tax records: generally 6 years where required for accounting and legal claims.
• Membership records: the membership period plus up to 6 years for transaction evidence.
• Security logs: normally up to 12 months, unless needed to investigate abuse.

We securely delete or anonymise data when the applicable period ends.

We use access controls, encrypted transport, restricted service credentials, processor review, monitoring and backups appropriate to the data. No online system can be guaranteed completely secure. Customers should never email complete card data or passwords.

If a breach is likely to risk individuals, we assess notification duties to the UK Information Commissioner's Office and affected people.

Under UK GDPR and, where applicable, EU GDPR you may request access, correction, deletion, restriction, portability, or objection; withdraw consent; and complain to the UK Information Commissioner's Office or your supervisory authority. Some rights are limited where records must be retained by law.

Residents of relevant United States states, including California, may request access, correction and deletion and may opt out of covered sale, sharing or targeted advertising. Ripple does not sell personal information for money and does not share it for cross-context behavioural advertising. We do not discriminate for exercising privacy rights.

Send requests to support@southessexphh.shop. We may verify the request using information already associated with an order, and normally respond within the statutory period.

Essential cookies keep the cart, admin security and checkout working. Preference, analytics or advertising cookies are used only where law and consent permit. You can change browser settings and follow the controls described in our Cookie Policy. Blocking essential storage may stop cart or checkout functions.

We use basic fraud and bot signals, but Ripple does not make solely automated decisions producing legal or similarly significant effects. The store is not directed to children under 13. People aged 13–17 may browse or order only with a parent or guardian's permission; the contracting buyer must be at least 18.

Contact support@southessexphh.shop, call +44 7838176077, or write to Ground Floor, Kings House, 101-135 Kings Road, Brentwood, Essex, CM14 4DR, United Kingdom. Please use the subject “Privacy request”. You may also complain to the UK Information Commissioner's Office. We encourage contacting us first so we can investigate promptly.