Clearcraft Ltd Privacy Policy

Website and online shop

Last updated: 7 October 2026

Clearcraft Limited (“Clearcraft”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, share and protect personal information when you use our website or online shop, create an account, place an order, contact us, or otherwise deal with us.

Data controller. Clearcraft Limited is the controller responsible for the personal information described in this policy.

Clearcraft Limited
Registered office: Kingstons Farm Commercial Park, Downhall Road, Matching, Hatfield Heath, CM17 0RB
Company number: 03408157
Privacy enquiries: info@clearcraftltd.co.uk

1. Personal information we collect

Depending on how you interact with us, we may collect:

Identity and contact information, such as your name, business or organisation name, job role, email address, telephone number, billing address and delivery address.
Account information, such as account login details, saved addresses, preferences and order history if you choose to create an account.
Order and transaction information, such as products ordered, order value, delivery information, invoices, refunds, payment status and transaction references.
Communications, including emails, telephone enquiries, contact-form messages, customer-service records and other correspondence with us.
Marketing information, such as your marketing preferences, subscription status and records of consent or opt-out requests.
Technical and usage information, such as IP address, device and browser information, pages visited, referral source, interactions with the website, and information collected through cookies or similar technologies.
Delivery and payment updates received from our couriers and payment providers, where needed to complete or manage your order.
Payment card information. When you pay online, payment information is provided to the payment provider you select, such as SagePay or PayPal. Clearcraft receives the payment status and transaction information needed to complete, reconcile or refund your order, but the payment provider is responsible for processing the payment information submitted through its service.

2. How we collect your information

Directly from you when you create an account, use guest checkout, place an order, contact us, request information, subscribe to marketing, or communicate with us.
Automatically when you use our website, through server logs, cookies, analytics tools and similar technologies.
From service providers involved in a transaction, for example payment confirmation from SagePay or PayPal and delivery status from Royal Mail or APC.
From our customer relationship management systems when information is recorded or updated as part of our relationship with you.

3. How we use your information and our lawful bases

UK data protection law requires us to have a lawful basis for using personal information. The main purposes and lawful bases we rely on are set out below. More than one basis may apply to the same information depending on the circumstances.

Purpose	Examples of use	Lawful basis
Orders and contracts	Creating or managing your account; processing orders; arranging delivery; handling returns, refunds and service issues.	Performance of a contract or steps requested before entering a contract.
Payments and financial administration	Processing payment status, refunds, invoices, reconciliation and accounting.	Contract and legal obligation.
Customer service and relationship management	Answering enquiries, maintaining customer records, following up orders and managing our business relationship, including through GoHighLevel.	Contract and our legitimate interests in providing effective customer service and managing customer relationships.
Legal, tax and regulatory requirements	Maintaining accounting and transaction records, responding to regulators, authorities or lawful requests.	Legal obligation.
Fraud prevention, security and website operation	Protecting customers, our systems and our business; detecting misuse; maintaining website security and reliability.	Our legitimate interests in protecting our business, customers and systems; and legal obligation where applicable.
Website analytics and improvement	Understanding how visitors use the website, measuring performance, diagnosing issues and improving content and functionality, including through Google Analytics.	Our legitimate interests in improving the website. Separate cookie/storage-and-access rules also apply; see section 8.
Marketing and business communications	Sending news, product information, offers or other marketing where you have asked to receive it or where the law otherwise permits us to do so.	Consent where required, and/or our legitimate interests where direct marketing is permitted by law.
Legal claims and business protection	Establishing, exercising or defending legal rights and dealing with disputes.	Our legitimate interests and, where relevant, legal obligation.

If you do not provide information we need to enter into or perform a contract with you, we may be unable to create your account, process your order, take payment, deliver the goods or provide the requested service.

4. Customer accounts and guest checkout

You may be able to create a customer account or place an order using guest checkout. If you create an account, we use your account information to provide account functions such as saved details and order history. If you use guest checkout, we still retain the information required to process the order and meet our legal and business obligations, but we do not create a customer account solely because you checked out as a guest.

5. Who we share personal information with

We only share personal information where it is necessary for the purposes described in this policy, where you have asked us to do so, or where the law allows or requires it. Recipients may include:

SagePay and PayPal, for payment processing, payment confirmation, refunds and transaction administration.
Royal Mail and APC, for delivery, tracking and resolving delivery issues.
GoHighLevel, where customer or prospect information is stored or processed in our customer relationship management system and related communication workflows.
Google, through Google Analytics and related website technologies used to understand website performance and usage.
Website hosting, ecommerce, IT, security, communications and technical-support providers that process information on our behalf.
Professional advisers such as accountants, insurers, legal advisers and auditors where reasonably necessary.
HM Revenue & Customs, regulators, courts, law-enforcement bodies or other authorities where disclosure is required or permitted by law.
A purchaser, investor or successor organisation if we sell, transfer or reorganise all or part of our business, subject to appropriate confidentiality and data-protection arrangements.

We do not sell your personal information.

6. Third-party services

Some organisations we work with act as our processors, meaning they handle personal information on our instructions. Others, such as certain payment, delivery or analytics providers, may act as independent controllers for some of the processing they carry out. Their own privacy notices explain how they use information for those purposes.

7. International transfers

Some of our service providers, including technology, CRM, payment or analytics providers, may process or make personal information accessible outside the United Kingdom. Where this results in a restricted transfer under UK data-protection law, we take steps to ensure the transfer is lawful. Depending on the destination and provider, this may include relying on UK adequacy regulations or using an appropriate safeguard such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses, together with any assessment required by law.

You can contact us at info@clearcraftltd.co.uk if you would like further information about the safeguards relevant to a particular transfer.

8. Cookies, Google Analytics and similar technologies

Our website uses cookies and similar storage or access technologies. Some are necessary for the website to work, for example to support shopping-basket, checkout, account or security functions. We also use Google Analytics to understand how visitors use the website and to help us improve its performance and content.

The rules applying to analytics depend on exactly how the technology is configured and used. Where consent is required for a cookie or similar technology, we will ask for consent before using it. Where the law permits statistical analytics without consent, we will provide the required information and a simple way to object. If analytics or similar technologies are used for advertising, profiling, cross-site tracking or another purpose that requires consent, we will seek consent where required.

You can find more detailed information about the cookies and similar technologies used on the website, their purposes, providers and available controls in our Cookie Policy and cookie-preference tool.

9. Marketing communications

We may send you marketing communications about Clearcraft products, services, news or offers where you have consented to receive them or where the law otherwise permits us to contact you. We may use GoHighLevel to manage customer or prospect records and marketing communications.

You have the right to object to direct marketing at any time. You can unsubscribe using the link in a marketing email, use any other opt-out method provided in the communication, or contact us at info@clearcraftltd.co.uk. We may keep a minimal suppression record after you opt out so that we can respect your request in future.

10. How long we keep personal information

We do not keep personal information for longer than we reasonably need it. Because different information is used for different purposes, there is no single retention period for every type of record. We decide retention periods by considering:

how long we need the information to provide the product, service, account or customer support;
the length and nature of our relationship with you;
legal, tax, accounting and regulatory requirements;
whether information is needed to resolve a complaint, dispute, refund, warranty issue or legal claim;
security, fraud-prevention and operational requirements; and
whether the information can instead be securely deleted or anonymised.

Where transaction information forms part of our VAT, tax or accounting records, we generally keep the relevant records for at least six years where required by law. Account information may be retained while the account is active and afterwards where necessary for legal, accounting, customer-service or dispute purposes. Marketing information is retained only for as long as it remains relevant or until you opt out, subject to keeping a suppression record where needed to honour that opt-out.

11. How we protect your information

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or misuse. We also limit access to personal information to people and service providers who need it for legitimate business purposes and require appropriate confidentiality and security arrangements where applicable.

No internet transmission or information-storage system can be guaranteed to be completely secure, but we review our safeguards and take reasonable steps to manage the risks associated with the information we hold.

12. Your data-protection rights

Depending on the circumstances and the lawful basis we rely on, you may have the right to:

ask for access to the personal information we hold about you;
ask us to correct inaccurate or incomplete information;
ask us to erase personal information in certain circumstances;
ask us to restrict the use of personal information in certain circumstances;
object to processing based on legitimate interests;
object to direct marketing at any time;
receive certain personal information in a portable format, where the right to data portability applies; and
withdraw consent at any time where we rely on consent. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are not absolute and may not apply in every situation. For example, we may need to retain transaction information to meet legal or tax obligations even if you ask us to delete your account.

To exercise a right, contact us at info@clearcraftltd.co.uk. We may need to ask for information to verify your identity before acting on a request.

13. Complaints

If you have a concern about how we use your personal information, please contact us first at info@clearcraftltd.co.uk so that we can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK regulator for data protection. Further information and the ICO’s complaints process are available at www.ico.org.uk.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our website, services, suppliers, business practices or legal requirements. The current version will be published on our website and the “Last updated” date at the top of the policy will be changed when we make a material update.