Data Protection Policy

Effective date: 1 May 2026  |  Last reviewed: 1 May 2026

At IWM Designs, we work closely with our clients from the first conversation right through to the completed installation. Along the way we collect a modest amount of personal information — and we handle it with the same care and professionalism we bring to every project. This policy sets out how we collect, use and protect personal data in compliance with UK GDPR and the Data Protection Act 2018.

Who we are

IWM Designs Ltd (company number 04574145) is a bespoke shopfitting, display cabinet and retail interior design business run by Ian and Deborah. We design, manufacture and install custom retail display solutions for businesses across the UK, with over 30 years of experience in our field. For the purposes of UK data protection law, IWM Designs Ltd is the data controller responsible for the personal information we collect.

IWM Designs Ltd

Company number: 04574145

Website: iwmdesigns.co.uk

Our data protection principles

We process all personal data in accordance with the seven principles of UK GDPR:

01
Lawfulness & fairness
Data is processed on a clear legal basis and never in a deceptive or harmful way.
02
Purpose limitation
Data is collected for specific, stated purposes and not used in incompatible ways.
03
Data minimisation
We only collect what is genuinely needed — nothing more.
04
Accuracy
We take reasonable steps to keep personal data accurate and up to date.
05
Storage limitation
Data is not kept longer than necessary for the purpose it was collected.
06
Security
Appropriate measures protect personal data against unauthorised access or loss.
07
Accountability
We take responsibility for compliance and can demonstrate how we meet these principles.

What data we hold and why

Project enquiries and consultations

When you contact us about a project — by phone, email or through our website — we collect your name, contact details and information about your requirements. This is used to respond to your enquiry, arrange a consultation and prepare a tailored quotation.

Site survey and premises information

Where a site survey is required prior to quotation or installation, we record details about the premises including measurements, layout, structural notes and access information. This data is used solely to design and deliver an accurate, site-specific solution. Where a survey is carried out at a client’s retail premises, we handle any access arrangements and related information with discretion.

Project and commission records

For confirmed projects, we maintain records including client details, the agreed specification and design brief, correspondence, quotations, invoices and any relevant installation documentation. These records are kept for the duration of the project and for up to 6 years thereafter, in line with standard contractual limitation periods.

Financial and payment records

We retain invoicing and payment records as required by HMRC for up to 7 years. Payment card details are never stored by us — all card transactions are processed securely through our payment provider.

Portfolio photography

We photograph completed installations for use in our portfolio, website and promotional materials. Where photography is taken at a client’s premises, we do so with their knowledge. If a client would prefer their installation not to be featured in our portfolio, please let us know and we will respect that request.

Marketing communications

Where you have agreed to receive updates from us, we may use your contact details to send information about our services and new projects. You can opt out at any time by contacting us directly.

Lawful bases for processing

  • Contract performance — to design, manufacture, deliver and install bespoke retail display solutions for clients
  • Legitimate interests — to respond to enquiries, manage client relationships, maintain our portfolio and promote our services
  • Legal obligation — to retain financial and contractual records as required by law
  • Consent — for marketing communications and portfolio photography where specific permission is sought

How long we keep data

  • Enquiry and quotation data — up to 2 years
  • Project and commission records — up to 6 years after project completion
  • Financial and invoicing records — up to 7 years (HMRC requirement)
  • Marketing preferences — until you unsubscribe or withdraw consent

All data is securely deleted or anonymised once it is no longer needed.

Who we share data with

We do not sell personal data. As a small, studio-based business, we share data only where strictly necessary:

  • With trusted subcontractors or installation teams, where required to deliver a project, under appropriate arrangements
  • With materials suppliers, where order or delivery details require it
  • With our IT and website service providers, under appropriate data processing agreements
  • With HMRC, where required for financial reporting
  • With authorities or regulators, where required by law

We do not transfer personal data outside the UK.

Data security

We take appropriate steps to protect personal data from loss, misuse or unauthorised access. Records are stored securely, access is limited to Ian and Deborah, and physical documents are handled and disposed of carefully. In the unlikely event of a personal data breach that poses a risk to individuals, we will notify the ICO within 72 hours as required by law.

Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access — request a copy of the data we hold about you
Right to rectification — ask us to correct inaccurate information
Right to erasure — request deletion in certain circumstances
Right to restrict processing — ask us to limit how we use your data
Right to data portability — receive your data in a readable format
Right to object — object to processing based on legitimate interests
Right to withdraw consent — at any time, where consent is our legal basis

To exercise any of these rights, please contact us via our website. We will respond within one calendar month.

ICO registration and complaints

ICO

IWM Designs Ltd is registered with the Information Commissioner’s Office (ICO) as required under UK data protection law.

If you have a concern about how we handle your personal data and we have not been able to resolve it to your satisfaction, you have the right to lodge a complaint with the ICO:

Information Commissioner’s Office

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113

Website: ico.org.uk

Changes to this policy

We may update this policy from time to time. The date at the top of this page will always show when it was last reviewed.