Privacy notice
This notice explains how Datum+Grain Ltd (trading as Kora Kitchens and Datum+Grain) collects and uses your personal data, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Datum+Grain Ltd is the controller of your personal data. We are a company registered in England and Wales (company number [company number]), with our registered office at [registered office address].
Studio and workshop: Unit 4, Malling Brooks, Lewes BN7.
Privacy questions: privacy@datumandgrain.co.uk
ICO registration number: [ICO registration number]
2. The data we collect
- Contact details — your name, email address, phone number, postcode and installation address, when you ask for an estimate, send an enquiry or become a customer.
- Project details — room measurements, drawings, photos, design choices and notes you share with us so we can design, price and build your kitchen.
- Transaction details — quotes, orders, invoices and payment records. We do not store full card details; payments are handled by our bank or payment provider.
- Correspondence — emails, calls and messages between you and us.
- Technical data — your IP address, browser type and the pages you visit, collected when you use this website.
We do not ask for special category data (such as health information). Please don't send us any.
3. How and why we use it
Under UK GDPR we must have a lawful basis for each use of your data:
| Purpose | Lawful basis |
|---|---|
| Replying to enquiries and sending you an estimate you asked for | Steps at your request before entering a contract |
| Designing, making, delivering and fitting your kitchen, and handling aftercare and warranty claims | Performance of a contract |
| Keeping accounting and tax records | Legal obligation |
| Running, securing and improving our website and services | Legitimate interests |
| Sending you news and offers by email | Consent (you can withdraw it at any time) |
Where we rely on legitimate interests, we have weighed our interests against your rights and you can object at any time (see section 7). We do not sell your data and we do not make decisions about you based solely on automated processing.
4. Cookies and analytics
We use a strictly necessary session cookie to keep you signed in to the design tools; it expires after 7 days. Our website analytics (Umami) are cookieless and do not identify you personally — they count page visits in aggregate. We do not use advertising or tracking cookies.
5. Who we share it with
We only share your data where we need to, with:
- service providers who host our website, email and data on our behalf, under contracts that require them to protect it;
- fitters, carriers and suppliers involved in your order, limited to what they need to do their job;
- our accountants, insurers and professional advisers;
- regulators, HMRC or law enforcement, where the law requires it.
If any of your data is transferred outside the UK, we make sure it is protected by an adequacy decision (“UK data bridge”) or by appropriate safeguards such as the ICO’s International Data Transfer Agreement.
6. How long we keep it
- Enquiries and estimates that don’t go ahead: up to [2 years] from our last contact.
- Customer, order and design records: 6 years after the end of the contract, to meet tax requirements and deal with any warranty or legal claims.
- Marketing preferences: until you unsubscribe or withdraw consent.
After that, we securely delete or anonymise it.
7. Your rights
You have the right to:
- access the personal data we hold about you;
- ask us to correct data that is inaccurate or incomplete;
- ask us to erase your data;
- ask us to restrict how we use it;
- object to our use of it where we rely on legitimate interests, and to direct marketing at any time;
- data portability — receive data you gave us in a machine-readable format, or have it sent to another organisation;
- withdraw consent at any time, where we rely on it (this doesn’t affect anything we did before you withdrew it).
Some rights only apply in certain circumstances. To make a request, email privacy@datumandgrain.co.uk. There is normally no charge, and we will respond within one month.
8. Keeping your data safe
We use appropriate technical and organisational measures to protect your data, including encrypted connections, access controls and limiting access to staff who need it. If a breach occurs that is likely to put you at risk, we will tell you and the ICO as the law requires.
9. Complaints
If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113.
10. Changes to this notice
We may update this notice from time to time. The date at the top shows when it last changed.