Privacy policy

Who we are

Granddad Rob Designs Ltd, Goreside Farm, Great Chart, Ashford, Kent TN26 1JU, company number 08294586. We are the data controller for the information described here.

If you have a question about your information, or want to exercise any of the rights below, email hello@granddadrobdesigns.co.uk or call 01233 822 457.

What we collect

When you place an order: your name, delivery address, email address and phone number. We ask for a phone number because these are large items and we need to ring you to arrange delivery. If Stripe asks for a billing address to take the payment, that stays with Stripe and we do not keep it.

When you send us a bespoke enquiry: your name, email address, phone number, and whatever you tell us about the project. We keep it in our records as well as in our email, so it is not lost.

To stop the enquiry form being misused, we keep a scrambled code made from your connection's IP address for up to a day. It cannot be turned back into the address.

When you browse: our host keeps standard server logs, which include IP addresses, for security and to keep the site running.

We do not collect anything else. There is no account to create, no newsletter sign-up on this site, no profiling and no advertising.

Your card details

We never see them. Payment happens on a page hosted by Stripe, and your card number goes directly to Stripe. What comes back to us is confirmation that a payment succeeded, along with your name, contact details and delivery address.

Who else handles it

We keep the list of companies involved as short as we can. Each one only gets what it needs to do its job.

• Stripe: takes the payment and handles your card details. Stripe is the payment processor and its own privacy policy applies to what it holds.
• Supabase: stores order records and bespoke enquiries, so we know what you bought, where it is going and what you asked us. Hosted in the UK or EU.
• Resend: sends the emails this website sends automatically, which are your order confirmation and the acknowledgement of a bespoke enquiry.
• Google Workspace: our email. Order notifications, enquiries and anything you email us arrive in our Google mailbox, and our own replies are sent from it.
• Vercel: hosts the website and keeps the server logs.

Information processed outside the UK

Stripe, Resend, Google and Vercel are based in the United States, so some of your information may be processed there. Each one protects it with a safeguard recognised under UK data protection law:

• Stripe: Stripe, LLC is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which it relies on first. Where that does not apply, its terms use the UK International Data Transfer Addendum to the EU standard contractual clauses.
• Resend: its terms use the EU standard contractual clauses with the UK Addendum, and Resend states that it also complies with the UK Extension to the EU-US Data Privacy Framework.
• Google: Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), which its terms rely on for information sent to the United States.
• Vercel: its terms use the EU standard contractual clauses with the UK International Data Transfer Addendum issued by the Information Commissioner.

Why we are allowed to hold it

For your order: because we need it to do what you have asked us to do, which is make something and deliver it to you. That is performance of a contract.

For our accounts: because the law requires us to keep records of what we sell. That is a legal obligation.

For an enquiry: because you asked us to get back to you, and it is in both our interests that we do.

How long we keep it

Order records: six years after the end of the tax year they fall in, because HMRC requires it. Your five year guarantee also means we need to know what we sold you and when.

Bespoke enquiries that do not turn into an order: we keep these while we are still talking, and clear them out once it is plain nothing is coming of it.

Server logs: kept briefly by our host and then deleted.

Cookies

This website sets no cookies for visitors. The only cookie is set for our own staff when they sign in to manage orders. There is no analytics, no tracking, no advertising pixel, and nothing loaded from another company's servers. The fonts are served from our own site.

The basket is the one thing we store on your device. It is kept in your browser's local storage, not a cookie, and it only holds which items you have added and how many. It never reaches us, and clearing your browser data removes it.

Because that is the only thing stored and it is there purely to make the basket work, there is no cookie banner to click through.

The payment page is different, because it belongs to Stripe. Stripe sets its own cookies there to process the payment and prevent fraud, and Stripe's privacy policy covers those.

Your rights

You can ask us what we hold about you, ask us to correct it, ask us to delete it, ask us to restrict how we use it, or ask for a copy to take elsewhere. You can also object to us holding it.

Bear in mind that we cannot delete a completed order record before the six years are up, because we are required to keep it. Everything else we can.

Email hello@granddadrobdesigns.co.uk and we will deal with it. If we do not get it right, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

We will update this page if what we do changes. Last updated 20 October 2026.