Privacy Policy - Mena Ceramics

Last updated: 9 February 2026

1. Who we are

This Privacy Policy explains how Mena Ceramics collects, uses, discloses, and protects your personal data when you visit or interact with https://menaceramics.co.uk (the “Website”), contact us, purchase our products, or otherwise engage with us. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Mena Ceramics is the data controller responsible for your personal data collected via the Website and our related services.

You can contact us about privacy matters at: privacy@menaceramics.co.uk.

References in this policy to “you” or “your” mean any visitor, customer, or individual interacting with the Website or our services. This policy also addresses our use of cookies and similar technologies in accordance with the Privacy and Electronic Communications Regulations (PECR).

2. Personal data we collect

2.1 Data you provide to us

Identification and contact data: name, email address, telephone number, delivery/billing address.
Order and payment details: items purchased, order history, preferred delivery options. Payment card data is processed by our payment provider and is not stored by us.
Communications: content of emails, form submissions, chat messages, and customer service interactions.
Marketing preferences and consents: your subscription status and preferences.
Job applications (if applicable): CV/resume, cover letter, qualifications, and references you provide.
User-generated content: product reviews, testimonials, or images you choose to submit.

2.2 Data we collect automatically

Usage and device data: IP address, device type, operating system, browser type, settings, unique identifiers, pages viewed, time and date of visits, referring/exit pages, and clickstream data.
Cookies and similar technologies: as described in Section 7.
Security and log data: error logs, access logs, and events used to maintain system integrity.

2.3 Data from third parties

Service providers: anti-fraud checks, payment authorisations, delivery and logistics status updates.
Publicly available sources and social media: if you interact with us on social platforms or publicly tag us, we may collect the content you make available.
Business partners and marketplaces (if applicable): order information necessary to fulfil your purchase.

2.4 Special category and children’s data

We do not intentionally collect special category data (e.g., health, biometric, or religious information). Do not provide such information to us. The Website and our services are not directed to children. If you are under 13, please do not use the Website or provide personal data. If we learn we have collected personal data from a child under 13, we will delete it.

3. Purposes and legal bases for processing

We process personal data only where we have a lawful basis under the UK GDPR (and, where applicable, the EU GDPR). Depending on the context, we rely on one or more of the following legal grounds:

Consent: where you have given clear consent (e.g., to receive marketing emails, to place non-essential cookies).
Contract: where processing is necessary to enter into or perform a contract with you (e.g., to take payment, fulfil your order, deliver customer service).
Legal obligation: where we must comply with a legal requirement (e.g., tax, accounting, and reporting obligations; responding to lawful requests).
Legitimate interests: where processing is necessary for our or a third party’s legitimate interests and these are not overridden by your rights (e.g., to secure our Website, prevent fraud, understand service usage and improve our products, and manage business operations).

3.1 How we use your data

Provide and manage our services and the Website (contract; legitimate interests in operating an effective site and service).
Process and fulfil orders, deliver products, handle returns and refunds (contract; legal obligation for record-keeping).
Communicate with you, respond to enquiries and support requests (contract; legitimate interests in effective customer service).
Send you marketing communications where you opt in, and personalise content (consent; legitimate interests for existing customers where permitted by law with an easy opt-out).
Improve, test, and enhance our Website, products, and user experience (legitimate interests in service improvement).
Ensure security, prevent and detect fraud or abuse, and maintain system integrity (legitimate interests; legal obligation where applicable).
Comply with legal obligations, resolve disputes, and enforce our terms (legal obligation; legitimate interests).
Recruitment and hiring processes if you apply for a role (contract; legitimate interests in hiring; legal obligation where applicable).

4. Cookies and similar technologies

We use cookies and similar technologies to operate the Website, understand performance, and—where you consent—measure audience and personalise content. Under PECR, we can store or access strictly necessary cookies without consent, but we will request your consent for any non-essential cookies.

4.1 Types of cookies we may use

Strictly necessary cookies: required for core site functionality, security, and to enable services you request (e.g., shopping basket, navigation). These cannot be switched off.
Performance/analytics cookies: help us understand how visitors use the site so we can improve it. Set only with your consent.
Functional cookies: remember choices (e.g., region or preferences). Set only with your consent where not strictly necessary.
Advertising/targeting cookies: used to deliver relevant ads or measure the effectiveness of campaigns. Set only with your consent.

4.2 Managing cookies

Consent: where required, we ask for your consent before setting non-essential cookies. You can withdraw consent at any time by adjusting your browser settings to block or delete cookies.
Browser controls: most browsers allow you to refuse cookies or delete them after they have been set. If you block cookies, some site features may not work as intended.
Do Not Track: our Website does not respond to DNT signals. You can manage tracking preferences through cookie settings and browser controls.

Cookie lifespans vary. Session cookies expire when you close your browser; persistent cookies may remain for up to 24 months unless you delete them sooner.

5. Disclosures and recipients of personal data

We share personal data with trusted recipients for the purposes described above, under appropriate contractual and security safeguards:

Service providers acting as processors: website hosting and cloud infrastructure, IT and security services, email and communications platforms, analytics providers (for consented analytics), customer support tools, payment processors, and delivery/logistics partners.
Professional advisers: accountants, auditors, insurers, lawyers, and consultants under duties of confidentiality.
Authorities and law enforcement: where required by law or to protect our rights, users, or the public.
Business transfers: in connection with a merger, acquisition, or sale of assets, subject to continued protections consistent with this policy.

We do not sell your personal data.

6. International transfers

Your personal data may be transferred outside the United Kingdom and the European Economic Area where our service providers or their sub-processors operate. When such transfers occur, we ensure appropriate safeguards are in place, such as:

An adequacy decision by the UK government for the destination country; or
Appropriate transfer tools, including the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, and additional technical/organisational measures as needed.

You can obtain more information about our transfer safeguards by contacting us at privacy@menaceramics.co.uk.

7. Data retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, including for satisfying legal, accounting, or reporting requirements. Typical retention periods are:

Customer orders and related records: up to 7 years after the end of the relevant financial year to meet tax and accounting obligations.
Customer support enquiries: up to 24 months after the last interaction.
Marketing data (including consent records): until you withdraw consent or object, or up to 24 months after last meaningful interaction, whichever occurs first.
Website analytics data: typically up to 26 months, where enabled by your consent.
Security and access logs: typically up to 12 months, unless longer is required to investigate incidents.
Job applications: typically up to 6 months after the hiring decision unless longer retention is justified or consented to.

We may anonymise data for statistical purposes. Anonymised data is not subject to this policy.

8. Data security

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, as appropriate, encrypted connections (TLS), access controls and authentication, least-privilege principles, secure configuration and patching, monitoring and logging, data minimisation, staff training, and processor due diligence. While we take reasonable steps to safeguard information, no method of transmission or storage is completely secure.

9. Your rights

Subject to applicable law and certain exemptions, you have the following rights in relation to your personal data:

Access: request a copy of your personal data and information about how we process it.
Rectification: request correction of inaccurate or incomplete data.
Erasure: request deletion of your data where there is no legal basis to continue processing.
Restriction: request that we restrict the processing of your data in certain circumstances.
Portability: receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
Object: object to processing based on our legitimate interests, and to direct marketing at any time.
Withdraw consent: where we rely on consent, you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise your rights, contact privacy@menaceramics.co.uk. We may need to verify your identity before responding. We aim to respond within one month, or within the period allowed by law. There is no fee to exercise your rights unless your request is manifestly unfounded or excessive.

10. Marketing communications

We will send you marketing communications by email only with your consent or where otherwise permitted by law in relation to similar products you have purchased from us. You can opt out at any time by using the unsubscribe option in our emails or by contacting privacy@menaceramics.co.uk. Opting out will not affect service-related communications (e.g., order updates).

11. Automated decision-making

We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. If this changes, we will inform you and provide information about the logic involved and the significance and envisaged consequences for you, as required by law.

12. Third-party websites and services

The Website may reference third-party services or platforms. If you follow references to third parties, their own privacy policies and terms will apply. We are not responsible for the privacy practices of third parties.

13. Complaints

If you have concerns about how we handle your personal data, please contact us first at privacy@menaceramics.co.uk so we can try to resolve your concerns. You also have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113

14. International users and applicable law

This policy is intended to comply with the UK GDPR and the Data Protection Act 2018. Where we offer goods or services to individuals in the EEA, or monitor their behaviour within the EEA, we will also comply with the EU GDPR as applicable and extend comparable rights protections.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make changes, we will update the “Last updated” date at the top of this page. Material changes will apply prospectively. We encourage you to review this policy periodically to stay informed about our information practices.

16. Contact and data protection contact

For questions about this Privacy Policy or our data protection practices, to exercise your rights, or to make a complaint, please contact:

Email: privacy@menaceramics.co.uk

Mena Ceramics has designated a data protection lead as the primary contact for privacy matters. You can reach the data protection lead at privacy@menaceramics.co.uk.