Who is responsible
Hossam-UK Ltd, company number 15153560, registered office Office 17, 30B Wilds Rents, London, SE1 4QG, United Kingdom, is the controller of the personal data described here. Contact us about privacy at info@hossam-uk.com.
What we collect and why
| When | Data | Purpose and lawful basis |
|---|---|---|
| You place an order | Name, email, phone (optional), delivery and billing address, what you bought, payment confirmation (never your card number) | To fulfil the contract with you, send confirmations and the VAT invoice, and meet tax and accounting law (legal obligation) |
| You create an account | Name, email, a hash of your password, saved addresses, order history | To provide the account you asked for (contract) |
| You send a form | What you type into the quote, trade account or contact forms, and any file you attach | To answer you and, for trade accounts, assess your application (our legitimate interest in running the business; contract once an account is opened) |
| You browse the site | A basket identifier, your sign-in session, your theme, VAT and view preferences; server logs with IP address and pages requested | To make the site work and keep it secure (legitimate interest). See our cookie policy |
| You ask for marketing | Email address | Only with your consent: we add your address after you click the link in our confirmation email, and keep the wording you agreed to. Every email has an unsubscribe link |
Who we share it with
- Payment: Stripe Payments UK Ltd processes card and wallet payments on its own pages; we receive a confirmation and the last four digits of the card. Stripe is a controller for the data it collects: see Stripe’s privacy policy.
- Email: our transactional email provider Brevo sends order confirmations, password resets and replies on our behalf.
- Delivery: our delivery couriers receive your name, address and phone number to deliver your parcel.
- Hosting: our servers run with IONOS in the United Kingdom. Cloudflare carries every visit to the site to our servers (encrypted connection, content delivery and protection from attacks), and keeps our database backups in its R2 storage in the European Union.
- Error reports: Sentry (data stored in the European Union) receives technical details when something goes wrong on our servers, such as the page and the error message, so we can fix it. They contain no names, addresses, cookies or payment details.
- Professional advisers and authorities where the law requires, for example HMRC for VAT records.
We do not sell personal data. Any transfer outside the UK is covered by UK adequacy regulations or the appropriate safeguards.
How long we keep it
- Orders and invoices: six years after the end of the tax year, as HMRC requires.
- Accounts: until you close your account; the account, its addresses and basket are then deleted straight away (orders are kept as above).
- Visitor baskets: 90 days without use. Sign-in sessions: 30 days without use.
- Form messages and attachments: two years, or for the life of the trade account.
- Server logs: kept only as long as needed for security and troubleshooting, then deleted.
- Newsletter: until you unsubscribe (we then keep only your address and the dates, so it isn’t added again), or delete it on request. Sign-ups never confirmed: 90 days.
Your rights
You can ask for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Where we rely on consent you can withdraw it at any time. If you have an account, you can change your email address, download a copy of your data and close your account yourself, from Your account → Your details. For anything else, email info@hossam-uk.com; we reply within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Security
Passwords are stored only as salted hashes. Session and basket tokens are stored hashed. The site is served over HTTPS. Access to order data is limited to staff who need it.
Children
This site is for adults and businesses. We do not knowingly collect data from anyone under 16.
Changes
We will post any changes here with a new date. Significant changes affecting account holders will be emailed to them.