Made in the UK from 100% recycled polypropylene
Made in the UK from 100% recycled polypropylene
Legal
How X-Grid handles website enquiries, project specifications, operational lead records, consent and data retention.
Status: launch draft — legal approval required.
What we collect
X-Grid’s website collects information in two places: when someone sends an enquiry, and when someone uses the project configurator. An enquiry carries whatever the sender chooses to give us — typically a name, an email address, sometimes a telephone number, and the description of the project they are asking about. The configurator adds the inputs needed to produce a schedule: the area in square metres, the finish selected, the traffic described, and any note the user adds. Nothing else is required. The forms do not ask for payment details, dates of birth or any special-category information, and browsing the site itself needs no account and creates no profile of the reader.
We collect this information for one purpose: to answer the question that was asked. A configurator lead exists so the technical team can review a schedule; an enquiry exists so somebody can reply. We do not use enquiry data to build marketing audiences, we do not sell it, and we do not pass it to third parties for their own purposes. Where analytics are used at all they are consent-gated and configured to avoid identifying individuals, which the cookie policy sets out in detail.
Retention
This launch draft describes the intended 90-day operational retention for configurator leads. The reasoning is straightforward: a configurator schedule is useful while a project is live — long enough for a review, a quote and a build — and after that it is stale input rather than a record. Ninety days matches the realistic span between a homeowner sizing a driveway and materials arriving, and it keeps the store small enough to be auditable. Enquiry correspondence is retained for a comparable operational period so that a reply, a follow-up or a warranty question can be handled without the sender repeating themselves. The specific retention periods, and the lawful basis for each, will be finalised with the data controller before publication rather than asserted here.
Where information is held, it is held in the UK or in a jurisdiction assessed as providing equivalent protection. The processors that handle it — the hosting provider, the form delivery route and any consent-gated analytics — will be named in full in the final statement rather than in the partial list a draft can honestly give.
Your rights
Under UK data protection law a person can ask what information is held about them, ask for it to be corrected, ask for it to be deleted, or object to its processing. Those requests need no particular form or wording: an email to the address on the contact page is enough, and the response will confirm what was found and what has been done. Where consent is the basis for processing — as with optional analytics — consent can be withdrawn at any time, and withdrawing it stops the processing from that point onward. Where legitimate interests are the basis, the interest will be explained rather than assumed.
If a request is not answered satisfactorily, the matter can be taken to the Information Commissioner’s Office; the final statement will carry that route and the controller’s registration details in full. Until then this page is deliberate about its status: it describes the approach accurately, but it is a draft and should not be relied on as the final legal position.
