Privacy Policy

1. Who we are

CN Framing ("CN Framing", "we", "us", "our") operates the CN Framing website and online store (the "Site"). For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018"), CN Framing is the data controller of the personal data described in this policy.

Registered business address: 37 Lower Road, Maidstone, Kent, ME15 7RH, England, United Kingdom. Contact: sales@cnframing.com or zac@cnframing.com.

2. Personal data we collect

Depending on how you use the Site, we may collect:

• your name, email address, phone number and country dialling code;
• your billing address, shipping address and order history;
• payment metadata (transaction identifier, card brand, last four digits, cardholder name, billing postcode and authorisation status) — full card numbers are handled exclusively by our PCI-DSS compliant payment processors and never stored on our servers;
• account credentials if you create an account;
• customer service correspondence and returns records;
• marketing preferences and consent records (email, SMS, cookies);
• technical data — IP address, user-agent, device identifiers, approximate location derived from IP, and pages viewed.

The Site and any purchase of products are intended for persons aged 18 or over only.

3. Lawful bases for processing

• Contract (Art. 6(1)(b)) — to process your order, take payment, ship goods and handle returns.
• Consent (Art. 6(1)(a)) — for email and SMS marketing, non-essential cookies and analytics.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, Site security, product improvement and basic analytics.
• Legal obligation (Art. 6(1)(c)) — tax, accounting and consumer-protection record keeping.

4. Payments

Payments on the Site are processed by third-party payment providers (which may include Stripe, PayPal, Shopify Payments, Apple Pay and Google Pay). When you check out, your card and payment details are submitted directly to the payment provider over an encrypted connection. We receive only a transaction reference, the amount, the status of the transaction and limited card metadata. We do not store full card numbers or CVV codes. Each provider is PCI-DSS Level 1 certified and acts as an independent data controller for the payment data it collects; their own privacy notices apply.

5. SMS marketing — mobile phone numbers

Mobile phone numbers and SMS opt-in data/consent collected for marketing purposes will not be shared, sold, or rented to third parties or affiliates under any circumstances. We share phone numbers only with the messaging platform that delivers our SMS (currently Klaviyo, Inc. and its downstream telecom carriers) solely so we can send the SMS you opted in to receive. Phone numbers are never transferred to advertisers, data brokers, affiliates or other merchants for their own marketing.

Consent to SMS is not a condition of any purchase. Message frequency varies. Message and data rates may apply. You can opt out at any time by replying STOP to any SMS, or reply HELP for help. Full SMS terms are set out in our Terms of Service.

6. SMS Marketing and Data Privacy

We value your privacy. Mobile information/phone numbers collected for SMS marketing consent will not be shared, sold, or rented to third parties or affiliates for marketing or promotional purposes under any circumstances. SMS opt-in data and consent are strictly excluded from any data-sharing agreements.

7. Who we share data with

Your data is disclosed only to processors acting on our documented instructions under Article 28 UK GDPR, or where required by law:

• hosting, database and CDN providers;
• payment processors (see section 4);
• shipping carriers and fulfilment partners;
• Klaviyo, Inc. — email and SMS marketing platform;
• analytics and advertising providers — only if you consent via our cookie banner;
• professional advisers (accountants, lawyers) under a duty of confidentiality;
• regulators, HMRC, law enforcement or courts where legally required.

We do not sell your personal data for money.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties or affiliates for marketing purposes.

7. International transfers

Some processors store data outside the United Kingdom or European Economic Area. Where this happens we rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision, so your data continues to receive an essentially equivalent level of protection.

8. Data retention

Order and transaction records are retained for at least 6 years to comply with UK tax and consumer-protection law. Marketing contact details are retained until you unsubscribe or ask us to delete them. Support correspondence is kept for up to 3 years. Anonymised aggregate analytics may be kept indefinitely.

Sign-up submissions (including SMS opt-in checkbox state, the exact consent language shown to you, timestamp, page URL, IP address and user-agent) are stored in our internal admin consent records database solely so that CN Framing can produce proof of consent if it is ever requested by Klaviyo or by US SMS carriers and aggregators for compliance and audit purposes (TCPA, CTIA and carrier code-of-conduct requirements). These records are not used for any other purpose, are never shared or sold to third parties or affiliates, and are retained only for as long as needed to satisfy those compliance obligations.

9. Security

We apply appropriate technical and organisational measures (Art. 32 UK GDPR), including TLS 1.2+ encryption in transit, encryption at rest, role-based access control, restricted admin access secured by authenticated sign-in, and regular review of processor security.

10. Your rights

Under UK GDPR and DPA 2018 you have the right to:

• be informed about how we use your data;
• access a copy of your data;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to processing;
• data portability;
• withdraw consent at any time;
• lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise a right, email sales@cnframing.com. We respond within one month.

11. US residents — CCPA / CPRA and other state laws

California residents have the right to know, access, delete, correct, opt out of "sale" or "sharing" for cross-context behavioural advertising, and to limit use of sensitive personal information. We do not sell personal information for money. Rejecting non-essential cookies, or sending a Global Privacy Control signal, is treated as an opt-out. Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA) and Texas (TDPSA) have similar rights. Contact sales@cnframing.com to exercise a right.

11a. Refunds and returns

For all UK / European customers:

You have the legal right to change your mind, cancel your order, or return your item for any reason (including wrong size, colour or preference) within 14 days of receiving your delivery. Returns filed for these reasons require the shipping label to be purchased by the buyer and shipped to the following business address: 37 Lower Road, ME15 7RH, Maidstone, Kent, United Kingdom. For returns in rare cases of damage or faulty items, we as CN Framing will cover any shipping label costs. Once you notify us of your return, you must ship the item back to us within 14 days. We will issue a full refund, including our standard outbound shipping costs, within 14 days of receiving the returned goods (or proof of return shipping).

For all US customers:

All CN Framing pieces are bespoke made to order. By placing an order you acknowledge and agree with this. We do not accept returns, exchanges or refunds for change of mind, size or colour preference, because every piece is made bespoke once your order is placed. This does not affect your rights if an item is faulty or incorrectly supplied. Contact us at sales@cnframing.com within 14 days of delivery with photographs and your order details. Returns will need to be sent to: 37 Lower Road, ME15 7RH, Maidstone, Kent, United Kingdom. All returns for US customers require the buyer to pay for the shipping label.

Refunds are issued to the original payment method within 10 business days of approval. If your return is accepted, we'll send you instructions on how and where to send your package. Items sent back to us without first requesting a return will not be accepted or refunded. Full details in our Terms of Service.

12. Changes to this policy

We may update this policy from time to time. Material changes will be notified by email where appropriate. Continued use of the Site constitutes acceptance of the updated policy.

13. Contact

If you have questions about this policy or our SMS practices, contact us at zac@cnframing.com.