Legal
Privacy policy
This policy is being finalised
The substance below describes accurately how this website handles your information. Two details are still to be confirmed by the business before this policy is final: our data protection registration number, and the exact periods for which records are kept.
In the meantime, please contact us or call 020 7437 4989 and we will confirm anything you need to know before you buy.
Who we are
Romanys Ltd is the data controller for information collected through this website and in our shops. Our registered trading addresses are 51 Brewer Street, Soho, London W1F 9UQ and 13 Shepherd Street, Mayfair, London W1J 7HT.
You can reach us about anything in this policy by emailing sales@romanys.uk.com or calling 020 7437 4989.
What we collect
When you buy something
- Your name, email address and phone number.
- The delivery and billing addresses you give us.
- What you ordered, what you paid, and any note you added to the order.
- Whether you chose delivery or collection, and from which branch.
When you have an account
- Your name, email address, phone number and any saved addresses.
- Your order history and any reward points or vouchers on the account.
- For trade accounts, your company or trading name and VAT number if you give us one.
When you contact us, ask for a quote or book a visit
- Your name, email address, phone number and what you wrote to us.
- For a quote, also your company name if you give it, the items you listed, whether you want to collect or have them delivered (and the postcode), and the date you need them by.
When you sign up for our newsletter
- Your email address, and a record of your consent — see our newsletter below.
Automatically
- A small number of strictly necessary cookies, listed in full in our cookie policy.
- Standard server logs, including your IP address, used to keep the site available and to rate limit abuse.
What we never collect
We do not see or store card details. Payments are handled entirely by PayPal on their own systems; we receive only confirmation that a payment succeeded and a reference for it. We do not run advertising or third-party analytics trackers.
Why we use it
We use your information only for these purposes, on these legal bases.
- To fulfil your order — taking payment, preparing goods, arranging delivery or collection, and dealing with problems. Basis: performance of a contract.
- To run your account — signing you in, keeping your order history, addresses, reward points and vouchers. Basis: performance of a contract.
- To answer enquiries and bookings — replying to you and arranging a time. Basis: legitimate interests in responding to people who contact us.
- To keep records — accounting and VAT records we are required to keep. Basis: legal obligation.
- To protect the site — rate limiting, fraud prevention and security logging. Basis: legitimate interests in keeping the service secure.
- To send marketing — only if you have specifically opted in. Basis: consent, which you can withdraw at any time from your account or by replying to any marketing email.
We do not make automated decisions about you that produce legal or similarly significant effects, and we do not profile you for advertising.
How long we keep it
Order and payment records are kept for as long as we are required to keep accounting and VAT records. Account information is kept while your account is open. Enquiries and bookings are kept while they are being dealt with and for a reasonable period afterwards.
The specific retention periods for each category are being confirmed by the business and will be set out here. If you want to know how long we hold something in particular, ask us and we will tell you.
When you close your account we remove your personal details, but we must keep the underlying order records for the period the law requires.
How we protect it
These are measures the site genuinely implements, not aspirations.
- All traffic is encrypted in transit using HTTPS.
- Passwords are never stored by us in a readable form — authentication is handled by our provider using industry-standard hashing.
- Your account data is protected at the database level by row-level security, so one customer’s records cannot be read through another’s session.
- Session cookies are httpOnly and SameSite-restricted, so they cannot be read by scripts or sent from another site.
- Access to customer records by our own staff is limited by role and significant actions are logged.
- Card details never touch our systems at all.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of the information we hold about you;
- correct anything that is wrong;
- delete information we no longer need to keep (we cannot delete records we are legally required to retain);
- restrict or object to how we use it;
- transfer it to another provider in a portable form;
- stop sending you marketing, which you can also do yourself at any time.
Email sales@romanys.uk.com and we will respond within one month. We will not charge you, and we will not ask why.
Complaints and contact
If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection, at ico.org.uk.
Our data protection registration number will be published here once confirmed by the business.
Questions about this policy
Write to Romanys Ltd, 51 Brewer Street, Soho, London W1F 9UQ, or email sales@romanys.uk.com.