Our Principles
We are a small Scottish family business inviting ourselves into your home. Looking after the personal information you share with us is part of what we owe you in return.
When you ask us for a quotation, we end up knowing a fair bit about you. Your name and contact details. The room you are renovating. Photographs of your windows. Sometimes a bank reference when a deposit is paid. Often, over the years, the layout of much of your home.
We think the least we owe you, in return, is to be straightforward about what we hold, how it is looked after, and what you can ask us to do with it.
This page is the plain-English summary. Our full Privacy Policy is the formal document, and our written Data Protection Complaints Procedure sets out exactly what to do if something has gone wrong.
Data protection in the UK is regulated by the Information Commissioner's Office (ICO) under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025.
ICO Registered
ZB581919
Rocknowe Interiors Limited, trading as The Scottish Shutter Company. Verifiable on the ICO public register.
Data Protection Lead
David Browne
Project Director and named lead for every data protection question, request or complaint. privacy@scottishshutters.co.uk
Reviewed
June 2026
Our policies, processor list and breach plan are reviewed at least annually.
We're registered with the Information Commissioner's Office and we pay the annual data protection fee, as every UK business that handles personal data has to. Our registration runs to 14 August 2027. The certificate below was issued for the period just ended, so for the live position the ICO's own register is the place to check it.
UK GDPR sets out seven legal principles. Underneath those, we run our day-to-day work to four practical rules of our own. They are simple, but together they explain almost every decision we make about your data.
The only personal data we ask you for is the data we genuinely need to give you a useful answer, prepare a quotation, fit your blinds and look after you afterwards. We do not buy lists, and we do not ask for information "just in case".
Our main customer records are kept in our customer relationship management system (Pipedrive), our accounting system (Xero), our email system (Google Workspace) and our marketing platform (Brevo). Each is purpose-built for that job and runs to enterprise-grade security standards.
We keep contract and order records for seven years because HMRC requires us to. Marketing data is kept until you ask us to stop. Our full retention schedule sits behind our Privacy Policy.
We do not sell your data. We do not rent it. We do not share it with anyone for their own marketing purposes.
Services that handle personal data include:
| Service | What we use it for | Data location |
|---|---|---|
| Pipedrive | Customer relationship management | EU |
| Xero | Accounting and invoicing | UK / EU |
| Google Workspace | Email and calendar | EU / US (UK adequacy) |
| Brevo | Email marketing | EU |
| Stripe | Card payments | EU / US (UK adequacy) |
| Vercel | Website hosting | UK (London region) |
| Cloudflare | Content delivery and security | Global edge (UK first) |
| Sentry | Error monitoring | EU |
| Manufacturers | Producing your bespoke order (e.g. S:Craft, Luxaflex, MasterBlinds) | UK / EU |
We use AI tools internally to help us work faster: drafting documents and emails, analysing site survey photographs, sense-checking product specifications.
No automated decision is ever made about a customer. Every quotation, every survey, every installation decision is made by a named member of our team.
We're reviewing how we use these tools, and we'll set out the detail on this page when that review is finished.
Under UK GDPR you have a set of rights in relation to the personal data we hold about you. You can exercise any of them by emailing privacy@scottishshutters.co.uk or calling 0800 086 2989. We respond within 30 days. There is no charge.
You can ask for a copy of the personal data we hold about you. This is called a "subject access request".
If anything we hold is inaccurate or out of date, we will put it right.
You can ask us to delete your data. We will, except where the law requires us to keep certain records (such as invoices for HMRC).
You can withdraw from marketing at any time. We action it the same day. Every marketing email also has a one-click unsubscribe.
You can ask for a copy of your data in a structured, machine-readable format ("data portability").
If something has gone wrong, our Data Protection Complaints Procedure explains what to do, and you can always go straight to the ICO.
We have a written Data Breach Response Plan. If we ever discovered a data breach that posed a risk to your rights or freedoms, we would notify the Information Commissioner's Office within 72 hours, as the law requires. Where the breach posed a high risk, we would also tell you directly, without undue delay, in plain English.
We have not had a notifiable data breach to date. If we do, we will be open about it.
For anyone who wants the detail:
The formal statement of what we collect, why, and the rights you have.
Every cookie on this website, what it does, and how to control it.
How to raise a concern about how we have handled your personal data.
The terms that apply when you purchase from us.
Privacy, complaints, safeguarding, health & safety, environmental, modern slavery and more.
52 pages of ideas, product details, and real installations from homes across Scotland. Request your copy and take the first step.