Privacy policy
How Johnkeans UK Ltd collects, uses and protects your personal data under the UK GDPR, the EU GDPR and other data-protection laws that apply to you. Last updated: 1 November 2026.
1. Who we are
Johnkeans UK Ltd (Company No. 17500105), 71–75 Shelton Street, London WC2H 9JQ, United Kingdom, is the data controller for personal data collected through johnkeans.co.uk. Contact us about anything in this policy at sales@johnkeans.co.uk (subject: "Data protection").
2. What we collect
- Identity & contact: name, company, email, phone/WhatsApp, delivery and billing address.
- Account: email address, sign-in history (date, device type, IP address) – we use one-time email codes, so we hold no passwords.
- Orders & quotes: products, quantities, prices, delivery details and messages you send us.
- Payments: handled by Stripe. We never see or store your full card number.
- Marketing preferences: whether you subscribed, the type of work you told us about, and whether you asked for trade pricing.
- Technical: IP address and browser information for security (rate-limiting and fraud prevention), and – only with your consent – analytics and advertising cookies.
3. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Processing orders, payments, delivery, returns and warranty | Contract |
| Answering quotes, questions and trade enquiries | Contract (steps before a contract) / Legitimate interests |
| Your account and email sign-in codes | Contract |
| Marketing emails (offers, new products, welcome series) | Consent – given by confirming your email; withdraw any time |
| Reminder if you leave items at checkout | Legitimate interests (you can opt out by replying) |
| Website security, fraud and spam prevention | Legitimate interests |
| Accounting and tax records | Legal obligation |
| Analytics and advertising cookies | Consent via our cookie banner |
4. Who we share it with
We never sell your data. We share it only with trusted processors who act on our instructions under a written data-processing agreement:
- Hostinger – website hosting and database
- Resend – sending account, order and marketing emails
- Stripe – card and wallet payments
- Microsoft 365 – our business email
- Couriers and freight partners – only the details needed to deliver your order
- Professional advisers and authorities where the law requires it
5. International transfers
Some processors store or access data outside the UK/EEA (for example in the USA or Japan). Where this happens we rely on an adequacy decision or on the UK International Data Transfer Agreement / EU Standard Contractual Clauses, plus the provider's security measures.
6. How long we keep it
- Orders, invoices and payment records: 6 years (UK tax law).
- Quote requests and messages: 2 years after our last contact.
- Account data: until you delete your account (or 3 years without sign-in).
- Marketing list: until you unsubscribe – we then keep only your email on a suppression list so we never email you again.
- Unconfirmed sign-ups: deleted after 30 days. Security logs: 12 months.
7. Your rights
Under the UK and EU GDPR you have the right to access, correct, delete, restrict or object to the use of your data, the right to data portability, and the right to withdraw consent at any time. Signed-in customers can download or delete their data instantly from My account. You can also email us – we reply within one month and there is no charge.
If you are unhappy, you can complain to the UK Information Commissioner's Office (ico.org.uk) or the data-protection authority in your country. Customers in Saudi Arabia, the UAE and other countries have the equivalent rights under their local laws (for example the Saudi PDPL and UAE PDPL), and we honour them in the same way.
8. Cookies
We use strictly necessary cookies and storage to run your basket, sign-in and security. Analytics or advertising cookies are used only if you accept them. See our Cookie policy or change your cookie settings.
9. Security
Our site runs on HTTPS only. Sign-in codes and session tokens are stored only in hashed form, customer data is kept outside the public web folder, and forms are protected against spam and abuse.
10. Children
Our products and services are for professionals and adults. We do not knowingly collect data from children under 16.
11. Changes
We will post any changes on this page and update the date at the top. Material changes will be emailed to account holders.
