Privacy notice

Who we are

KWICK HOUSE is a brand of SIA Tuuya, a company registered in Latvia. SIA Tuuya decides why and how your personal data is used. That makes it the controller of your data under the UK GDPR and the EU GDPR.

For any question about your data, write to [email protected] or to the postal address above. The workshop address shown elsewhere on the site is a production site. It does not handle data requests.

What we collect and why

When you send an enquiry

Every enquiry form asks for your name and email address. Depending on which form you use and the topic you choose, it also asks for some of the following: the country of delivery, the model you are interested in, what the building is for, the topic of your enquiry, your order number and your message. Sending an enquiry is up to you. Your name and email address are required on every form: we need your name so we know who we are writing to, and your email address to reply. The form on our Contact page also requires you to choose a topic and to write a message. A form cannot be sent until its required fields are filled in.

Along with what you type, each enquiry records the date and time it arrived, the web address of the page you sent it from, which form on the site you used and a random reference number created for that submission. If you send your configuration from a product page, the enquiry also holds the product code, the options you chose, the total price for that set of options and which payment method applies to that total, bank transfer.

We use these details to answer your enquiry and, when you ask for one, to prepare a quote. The legal basis is taking steps you have asked for before a possible contract or, for other questions, our legitimate interest in answering you. If you write about an order you have placed, we use your email address or the order number to find that order, and the legal basis is performing our contract with you.

Each enquiry and each order also records where your visit came from, as described under Cookies and local storage: the campaign tags, the name of the site that sent you, the page you landed on, the time and, if you accepted cookies, the advert click reference. It also records whether you had accepted cookies, rejected them or not yet chosen. We use this to know which adverts and pages bring enquiries and orders. It is kept with the enquiry or order and deleted with it. The legal basis for keeping this record is our legitimate interest in measuring our own advertising; for the click reference it is your consent.

Each enquiry is saved as a private record in the admin area of our website. It is not shown anywhere on the site. We do not use enquiry details for marketing emails and we do not sell them.

Keeping the form free of spam

We do not store your IP address with the enquiry. We keep only a hash of it, a coded version made with a secret key. The hash still counts as personal data. For an IPv6 address the hash covers only the part that identifies your network. We use it to spot spam that keeps coming from the same source.

To limit the form to five enquiries an hour from one address, the site also keeps a counter stored under a hash of your address. It expires one hour after the last enquiry from that address.

The legal basis for both is our legitimate interest in protecting the form from spam and abuse.

When you visit the site

Every request to the site passes through Cloudflare, which delivers the pages and protects the site. To do that, Cloudflare and our server have to process your IP address and the technical details your browser sends with each request.

Our server keeps logs of these requests, IP addresses included, for up to six weeks. We use them for security and to find and fix faults.

The site also runs the Wordfence security plugin. Its live traffic log is switched off, so it does not record ordinary visits. The site does take part in the Wordfence network: when a request looks like an attack, details of that request, including the IP address it came from, are sent to Wordfence in the United States.

The legal basis for all of this is our legitimate interest in keeping the site available and secure and in finding and fixing faults.

Automated decisions

We do not use your data for automated decisions that have legal or similarly significant effects on you.

How long we keep it

• Enquiries that do not lead to an order: 24 months after our last contact with you, then deleted.
• The hash of your IP address: kept with the enquiry and deleted with it.
• The counter that limits the form to five enquiries an hour: one hour after the last enquiry.
• Server logs: up to six weeks.

Who else handles your data

Our hosting provider runs the server in the European Union that holds the site, the enquiries and the server logs. Cloudflare, a company based in the United States, delivers and protects every page of the site. Wordfence, also based in the United States, receives the details of requests that look like attacks, as described above.

Google (Google Analytics) and Meta Platforms (the Meta pixel and the reports our server sends about enquiries and orders) receive data only if you accept cookies. Meta also uses what it receives for its own purposes, advertising among them, as its own privacy policy describes.

Transfers outside the UK and the EEA

Our hosting server is in the European Union, so the enquiries and server logs are stored in the EU.

Cloudflare and Wordfence are based in the United States, so data that passes through them may be processed there. If you accept cookies, Google and Meta may also process the data they receive in the United States.

Cookies and local storage

When you first visit kwick.house, a banner asks whether we may use Google Analytics and the Meta pixel. Nothing from either loads until you choose Accept, and if you choose Reject, neither loads at all.

If you accept:

• Google Analytics, run by Google, sets cookies including _ga and _ga_9ZG8MJQJZP, which last up to two years. We use it to count visits and to see which pages and adverts bring people to the site. Our Google Analytics account is set to keep data about individual visits for 14 months. When you accept, the site also tells Google that you allow this data to be used for advertising, personalised adverts included.
• The Meta pixel, run by Meta Platforms, sets cookies including _fbp and, when you arrive by a link from Facebook or Instagram that carries a click reference, _fbc. Both last 90 days. We use it to see which Meta adverts lead to enquiries and orders.
• Both are told which pages and kits you look at, when you add a kit to your basket or start the checkout, and when you send an enquiry or place an order, with the total of the order and the kits in it. Google Analytics also receives the order number and what you click on the site, such as menu links, buttons and FAQ questions.
• When you send an enquiry, unless it is about an order you have already placed, or place an order, our server also reports it to Meta, with the same reference as the pixel so that it is counted once. The report carries your email address, your name, your country and, for an order, your phone number, city and postcode, each as a SHA-256 hash, a coded form that Meta compares with its own records to find a matching account. It also carries your IP address, your browser details, the values of the Meta cookies and the address of the page. For an enquiry it names the form you used and the model you are interested in; for an order, the order number, its total and the kits in it. We do this only if you accepted.
• A first-party cookie, kh_src, keeps for 90 days where your first and latest visits came from: the campaign tags in the link, the advert click reference, the name of the site that sent you, the page you landed on and the time.

The legal basis for Google Analytics, the Meta pixel and the reports to Meta is your consent.

Your choice itself is kept in a cookie, kh_consent, for 12 months, so the banner does not ask again on every page. To change it, use Change cookie settings at the foot of any page. If you withdraw consent, the Google Analytics, Meta and kh_src cookies are deleted from your browser and nothing more is sent to Google or Meta. What they received before then is not removed.

Until you choose, and if you reject, the site remembers, for as long as the browser tab stays open, the campaign tags of the link you arrived by, the name of the site that sent you, the page you landed on and the time. This is kept in your browser's session storage and reaches us only if you send an enquiry or place an order, as part of that enquiry or order. Advert click references are not kept unless you accept.

The home page keeps one entry in your browser's local storage, kh_intro_seen_v2. It holds the date, so the opening animation plays once a day rather than on every visit. It stays in your browser until you clear it in your browser settings and is never sent to us.

Two more entries are kept in your browser and are never sent to us. On small screens, kh_swipe_ followed by the name of a picture strip records in session storage that the hint to swipe has been shown; it goes when you close the tab. If you accepted cookies and placed an order, kh_ms_tx in local storage holds the references of your latest orders, up to 20, so that none is counted twice; it is removed if you withdraw consent.

The basket and the checkout use three WooCommerce cookies that the shop needs to work. They are set when you add a kit to your basket, not before: wp_woocommerce_session_ followed by a code, which links your browser to your basket and lasts 48 hours, and woocommerce_items_in_cart and woocommerce_cart_hash, which are deleted when you close your browser. They are strictly necessary, so we do not ask for your consent to them.

Your rights

Under the UK GDPR and the EU GDPR you can ask us to:

• tell you whether we hold data about you and give you a copy;
• correct data that is wrong or incomplete;
• delete your data;
• limit how we use your data;
• object to how we use your data where we rely on our legitimate interests;
• give you the data you provided with your enquiry in a format a computer can read, or send it to another company.

To use any of these rights, write to [email protected]. We may ask you to confirm who you are before we act. There is no charge. We reply within one month.

Complaints

If you are unhappy with how we handle your data, please tell us so we can put it right. You also have the right to complain to a supervisory authority. In Latvia, where SIA Tuuya is registered, that is Datu valsts inspekcija (the Data State Inspectorate). If you live in the UK, it is the Information Commissioner's Office (ICO).

Changes to this notice

We update this notice whenever the way the site handles personal data changes. The date of the last change is shown on this page.

Contact

Email: [email protected] Post: SIA Tuuya, Kārļa Ulmaņa gatve 119, Mārupe, LV-2167, Latvia