This Privacy Policy explains how Ashlar House Ltd collects, uses, stores and shares personal information.
It applies when you:
Ashlar House Ltd is the data controller responsible for the personal information described in this policy.
We process personal information in accordance with applicable UK data-protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.
Ashlar House Ltd is a company registered in England and Wales under company number 17303130.
Our registered office address is displayed in the permanent Legal Notice available through our website.
For questions about this policy, requests relating to your personal information or data-protection complaints, please contact:
Email: info@ashlar-house.com
The information we collect depends on how you interact with us.
When you contact us, we may collect:
When you request a quotation, arrange a consultation or place an order, we may collect:
Where you request a bespoke or personalised piece, we may also collect:
Please avoid providing personal information that is not necessary for the commission.
Where you provide personal information about another person, including a gift recipient or the subject of an engraving, you should ensure that you have an appropriate reason and authority to provide it.
Where you pay by bank transfer, we may receive information appearing in our banking records, including:
Where you pay by card, payment is processed by our appointed payment provider. We do not ordinarily receive or store your complete card number, security code or full payment credentials.
We may receive limited information from the payment provider, such as:
A payment provider may process personal information as an independent data controller under its own privacy policy.
To arrange delivery, collection or customs clearance, we may process:
Certain cutters, scissors, blades or other pieces may be subject to legal age restrictions.
Where age or identity verification is required, we may collect or receive:
Where possible, we will retain confirmation that a check was completed rather than a complete copy of an identity document.
We will collect and retain only the information reasonably necessary to perform the verification and comply with our legal obligations.
When you visit our website, our website host and technical systems may automatically process limited technical information, including:
This information is used only so that the website can be delivered, maintained and protected.
We do not currently use website analytics, behavioural tracking or targeted-advertising technologies.
Our website uses only cookies or similar technologies that are strictly necessary for its operation, security or a service expressly requested by the visitor. Further information is provided in our Cookie Policy.
Most personal information is collected directly from you.
We may also receive information from:
Where another person provides your contact or delivery information, we will use it only for the relevant purpose, such as arranging delivery, preparing a commission or responding to an enquiry.
We use personal information only where we have a lawful basis to do so.
We use your information to:
Our lawful bases are:
We use your information to:
Our lawful bases are:
We use commission information to:
Our lawful bases are:
We process payment-related information to:
Our lawful bases are:
We use personal information to:
Our lawful bases are:
Where required, we use age or identity information to:
Our lawful bases are:
We use limited technical information to:
Our lawful basis is our legitimate interest in maintaining a functional, reliable and secure website and business.
We may process personal information to:
Our lawful bases are:
We may contact you about an enquiry, consultation, quotation, commission, payment, delivery, return or other matter connected with your dealings with us.
These are service communications necessary to respond to you or administer our relationship with you. They are not general marketing communications.
We do not currently use the personal information described in this policy to send a general email newsletter or unsolicited consumer marketing.
If we introduce an optional mailing list or similar service in the future, we will provide appropriate information and obtain any permission required before using your information for that purpose.
Where we rely on legitimate interests, those interests may include:
We consider whether the processing is necessary and proportionate and balance our interests against your rights and reasonable expectations.
You may object to processing based on legitimate interests as explained below.
You are not generally required to provide personal information merely to browse our website, subject to the limited technical processing necessary to deliver and secure it.
However, certain information may be necessary for us to:
If you do not provide the necessary information, we may be unable to respond fully, accept an order, fulfil a commission or deliver a piece.
We do not sell or rent personal information.
We may share information, where reasonably necessary, with the following categories of recipient.
These may include providers of:
Service providers acting as our processors may use information only in accordance with our instructions and the applicable contractual and legal requirements.
Some providers, including payment providers, banks and communications platforms, may act as independent data controllers for their own processing.
We may share necessary information with:
Where necessary to fulfil an order, particularly a bespoke or personalised commission, we may share limited information with a partner atelier, specialist maker or supplier.
This may include:
We will not provide more personal information than is reasonably necessary for the relevant work.
We may share information with our:
We may disclose information:
If Ashlar House or part of its business is sold, reorganised, financed or transferred, relevant information may be disclosed to professional advisers, prospective purchasers, investors or a successor organisation.
Any such disclosure will be limited to what is reasonably necessary and subject to appropriate confidentiality and data-protection measures.
Ashlar House works, or may work, with service providers, payment providers, delivery providers and specialist ateliers located outside the United Kingdom.
Personal information may therefore be processed in, or transferred to, another country where this is necessary to provide a service or fulfil an order.
Where personal information is transferred outside the United Kingdom, we will take reasonable steps to ensure that the transfer is lawful and that the information remains appropriately protected.
Depending on the circumstances, this may include:
In many cases, an overseas atelier will receive only the approved design or production information and will not need to receive your direct contact or payment information.
You may contact us for further information about the safeguards relevant to a particular transfer.
We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, regulatory and dispute-resolution purposes.
Our usual retention periods are set out below.
We ordinarily retain enquiry correspondence for up to 24 months after the last substantive contact, unless:
We ordinarily retain order, invoice, transaction and accounting records for up to six years after the end of the relevant financial year, or for a longer period where required by law, an official investigation or an unresolved dispute.
We ordinarily retain specifications, approvals and material project correspondence for up to six years after completion or cancellation of the commission.
We may retain a limited non-personal design, provenance or production record for longer where necessary to identify the construction, materials, history or care requirements of a piece.
Where reasonably possible, unnecessary customer information will be removed from longer-term design or production records.
We retain records for as long as reasonably necessary to investigate and resolve the matter and, where appropriate, for the relevant legal limitation period.
We retain age-verification information only for as long as necessary to complete the transaction, comply with applicable law and demonstrate that the required check took place.
We will avoid retaining a complete identity document unless doing so is necessary and proportionate.
Technical and security logs are retained for a limited period appropriate to website operation, security monitoring, fraud prevention and the investigation of technical incidents.
Information held within strictly necessary cookies or similar technologies is retained for the period described in our Cookie Policy.
We may retain information for longer where required by law, where a complaint or legal claim is ongoing, or where deletion would interfere with the establishment, exercise or defence of legal rights.
We use reasonable organisational and technical measures intended to protect personal information against:
These measures may include:
No method of transmission or storage is completely secure. We therefore cannot guarantee absolute security, but we take proportionate steps to protect the information for which we are responsible.
Ashlar House does not itself use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects for you.
Payment, fraud-prevention or age-verification providers may use automated systems when assessing a transaction or verification request. Those providers may act as independent data controllers and explain their processing in their own privacy policies.
Where a decision made by us has a significant effect on you, you may contact us to request further information.
Our website and services are not directed at children.
We do not knowingly collect personal information from children for general customer or promotional purposes.
A person under the legally required age may not purchase an age-restricted piece. Where appropriate, we may take steps to verify a purchaser’s age.
Please contact us if you believe that a child has provided personal information to us inappropriately.
Depending on the circumstances and our lawful basis for using your information, you may have the following rights.
You may ask whether we process your personal information and request a copy of the information we hold about you.
You may ask us to correct inaccurate information or complete information that is incomplete.
You may ask us to delete personal information in certain circumstances.
This right is not absolute. We may need to retain information where it remains necessary for a contract, legal obligation, accounting record, complaint or legal claim.
You may ask us to restrict the use of your information in certain circumstances, including while its accuracy or our reason for using it is being considered.
You may object to processing based on our legitimate interests.
We will stop the relevant processing unless we have compelling legitimate grounds to continue or the processing is necessary for the establishment, exercise or defence of legal claims.
Where processing is based on contract or consent and carried out by automated means, you may have the right to receive certain information in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation where technically feasible.
Where we rely on consent for a particular use of your information, you may withdraw that consent at any time.
Withdrawal does not affect processing lawfully carried out before consent was withdrawn.
Where applicable, you may have rights relating to decisions based solely on automated processing that produce legal or similarly significant effects.
You have the right to object to our use of your personal information where we rely on legitimate interests.
Whether we must stop processing will depend on the circumstances and whether we have compelling legitimate grounds to continue.
If personal information is ever used for direct marketing, you will have an absolute right to object to that use at any time.
To exercise a data-protection right, contact:
Please describe your request clearly and provide sufficient information to allow us to identify the relevant records.
We may request reasonable evidence of identity where necessary to ensure that personal information is not disclosed to an unauthorised person. We will not request more information than is reasonably necessary for this purpose.
We will respond without undue delay and ordinarily within one month of receiving your request. Where a request is particularly complex or several requests are made, the response period may be extended as permitted by law. We will inform you if an extension is necessary.
Data-protection requests are normally handled without charge. A reasonable fee may be charged, or a request may be refused, only where permitted by law.
You may complain about how we have collected or used your personal information by contacting:
Please include:
We will acknowledge receipt of a data-protection complaint within 30 days.
We will take appropriate steps to investigate the complaint, keep you informed where necessary and communicate the outcome without undue delay.
We may contact you if we require further information to understand or investigate the complaint.
You also have the right to complain to the Information Commissioner’s Office, the United Kingdom’s independent data-protection regulator.
We would appreciate the opportunity to consider your concern first, but you are not required to contact us before approaching the Information Commissioner’s Office.
Our website or communications may contain links to third-party websites, social-media platforms, payment services or other external services.
Those organisations control their own collection and use of personal information. This Privacy Policy does not apply to their independent processing, and you should review their privacy information before providing personal information to them.
We may update this Privacy Policy from time to time to reflect:
The current version will be made available on this page.
Where a change materially affects how we use personal information, we will take reasonable steps to bring it to the attention of affected individuals where required.
Last updated: 16 July 2026