Privacy Policy
Last updated: 9 July 2026
This policy explains how Pave Direct Ltd (“we”, “us”, “Pave Direct”) collects, uses and protects your personal data when you use https://www.pavedirect.co.uk, place an order, or contact us. We are the data controller for that data under the UK GDPR and the Data Protection Act 2018.
1. Who we are
- Controller: Pave Direct Ltd (company no. 07256076).
- Registered office: 39 Abbey Road, Bourne, Lincolnshire, PE10 9EN.
- Contact: info@pavedirect.co.uk, 01778 343999.
2. The data we collect
We collect only what we need to run the shop and fulfil your order:
- Account & contact details — name, email, phone, and password (stored hashed, never in plain text).
- Order & delivery details — billing/delivery address, items ordered, delivery date and tier, and order history.
- Payment data — card payments are processed by Stripe; we do not see or store your full card number. Bank-transfer orders record only the payment reference.
- Sample & enquiry data — details you give when ordering a £0.98 sample or submitting a delivery/damages claim.
- Marketing preferences — whether you have opted in to email/SMS, held in our consent ledger.
- Technical & usage data — collected only after you consent to analytics (see our Cookie Policy). Analytics are default-denied until you opt in.
3. How and why we use it (lawful bases)
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Process and deliver your order; handle returns and the breakage guarantee | Performance of a contract |
| Send order, dispatch and delivery updates | Performance of a contract |
| Meet tax, accounting and consumer-law duties (e.g. VAT records) | Legal obligation |
| Marketing emails/SMS and review invitations | Consent (you can withdraw it any time) |
| Site security, fraud prevention and improving the shop | Legitimate interests |
| Analytics and advertising cookies | Consent (PECR) — default denied until opt-in |
4. Who we share it with
We never sell your data. We share it only with the processors needed to run the shop, under contract and only for these purposes:
- Stripe — card payment processing.
- Delivery carriers — to deliver your pallet (name, address, phone, delivery window).
- Email/SMS provider — to send transactional and (with consent) marketing messages.
- Analytics (Google Analytics 4) — only after you consent.
- Our hosting provider — to run the website securely.
5. How long we keep it
We keep personal data only as long as necessary:
- Order & transaction records — retained for the period required by UK tax law (currently 6 years) even after account closure.
- Account data — until you ask us to close/erase your account (subject to the retention duties above).
- Marketing consent records — until you unsubscribe, plus a short period to evidence the withdrawal.
6. Your rights
Under UK GDPR you have the right to access, rectify, erase, restrict, port and object to the processing of your data, and to withdraw consent at any time. You can:
- Download a copy of your data or request erasure from your account’s Data & privacy page.
- Change marketing preferences from any email/SMS unsubscribe link or your account preferences.
- Contact us at info@pavedirect.co.uk for any request; we respond within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
7. Cookies
We use essential cookies to run the shop and, only with your consent, analytics/advertising cookies. See our Cookie Policy for the full list and how to change your choice.
8. Security
We protect your data with HTTPS across the whole site, hashed passwords, access controls, and a content-security policy. No system is perfectly secure, but we take appropriate technical and organisational measures and will notify you and the ICO of a breach where the law requires.
9. Changes to this policy
We may update this policy from time to time. The “last updated” date above shows the current version. Material changes affecting how we use your data will be highlighted.