Privacy Policy

LONDON CARPET SOLUTIONS LTD (trading as Loncar) is the data controller for personal data processed through loncarsol.shop. We decide why and how your data is used, and we are accountable for it.

Business and correspondence address: 852 Green Lanes Winchmore Hill, N21 2RS, United Kingdom. Questions, requests and complaints about privacy go to support@loncarsol.shop or +44 7804880779. We answer privacy requests Monday to Friday, 09:00-17:00 Europe/London, and within the statutory deadline in every case.

We have not appointed a statutory Data Protection Officer because we are not required to; privacy requests are handled directly by the team at the address above.

We collect only what an order, an enquiry or a membership actually needs.

• Order and delivery data. Your name, email address, phone number and full shipping address; the sets, sizes and quantities ordered; order totals in USD; the order reference; and carrier tracking information used for order fulfilment.
• Checkout data before payment. If you complete the checkout form but do not finish paying, we retain the contact and delivery details you entered so we can help you complete or cancel the order.
• Payment and billing data. Stripe processes card payments. Where you select a PayPal wallet payment method, PayPal processes the wallet credentials. We receive the payment outcome, billing country and payment reference; for a card, we may also receive the brand and last four digits. We never receive or store a full card number, expiry date, security code or PayPal password.
• Membership data. Your plan, billing period, renewal and cancellation dates, and invoice history for Loncar Home+ or Loncar Studio.
• Support and returns data. Your messages, the enquiry subject, photographs you choose to send us about a set or a fault, return reasons, and our replies.
• Trade enquiry data. Your business name, country, estimated volume and project description.
• See-in-Room room photos. Previews are composed in your browser. Room photos you select or upload in the tool are not transmitted to our servers and are not used to train any model. If you separately email a preview or room photo to support, that copy is handled as support data and deleted within 30 days of the case closing.
• Technical data. IP address, browser type, device type, pages viewed and timestamps, collected through server logs and essential cookies for security, fraud prevention and site reliability.

We do not collect identity documents, and we do not knowingly collect special category data. Please do not send us health, political, biometric or similar sensitive information; it is not needed to sell you a rug.

Almost all of it comes directly from you: the checkout form, the contact form, the trade enquiry form, or an email to support.

The rest comes from:

• Your device and browser, automatically, through server logs and essential cookies.
• Stripe or PayPal, which returns the payment outcome, billing country and fraud signals after you pay.
• Delivery carriers, which return tracking events and proof of delivery.

We do not buy personal data, and we do not build profiles from data brokers or third-party advertising networks.

Under UK GDPR and EU GDPR we must have a lawful basis for each purpose. Ours are:

• Order fulfilment and delivery — performance of a contract. We use your shipping address and contact details to pick, dispatch, track and deliver the rug; without them we cannot perform the order.
• To handle returns, refunds, exchanges and warranty questions — performance of a contract, and compliance with consumer law.
• To bill and manage a membership — performance of a contract.
• To answer your enquiry or trade request — your consent, given when you tick the box on the form, and our legitimate interest in responding to people who contact us.
• To follow up an abandoned checkout — our legitimate interest in completing a sale you started. You can object at any time and we will stop.
• To prevent fraud and payment disputes, and to keep the site secure— our legitimate interest, and Stripe's legal obligations.
• To keep accounting and tax records — compliance with a legal obligation.
• To send marketing email — your consent only. We do not add customers to a marketing list automatically, and every marketing message carries an unsubscribe link.

Where we rely on legitimate interests, we have weighed them against your rights and use the minimum data needed. Where we rely on consent, you may withdraw it at any time; that does not affect processing already carried out.

Card payments are processed by Stripe on its hosted checkout page. If you choose a PayPal wallet payment method, PayPal processes the wallet authorisation. In either case, payment credentials are entered into the payment provider's interface, not ours.

LONDON CARPET SOLUTIONS LTD never receives, sees or stores your full card number, expiry date, CVC or PayPal password. We receive only the payment outcome and a reference: whether it succeeded, the amount in USD, the card brand, the last four digits and the billing country. That is what lets us match a payment to an order, issue a refund and answer a dispute.

Stripe and PayPal each act as an independent controller for their own fraud prevention and regulatory obligations. Stripe's handling of card data is governed by the Stripe Privacy Policy. Charges appear on your statement as LONCAR RUGS.

We do not sell your personal data. We share it only with the processors that make the order happen:

• Stripe and PayPal — payment or wallet authorisation, subscription billing where applicable, refunds, fraud checks and dispute handling.
• Vercel — website and application hosting, and server logs.
• Supabase — the database holding orders, enquiries and delivery records.
• Resend — transactional email such as order confirmations and replies.
• Cloudflare — bot protection on our forms.
• Delivery carriers — the name, address and phone number needed to deliver your rug and to arrange a drop for larger rolled items.
• Professional advisers, accountants and authorities — where we are legally required to disclose, or need advice on a legal claim.

Each processor is bound by a written data processing agreement, may only act on our instructions, and may not use your data for its own purposes. If our business were ever sold or restructured, customer data could transfer to the buyer; you would be told before that happened.

We ship worldwide, so your data is transferred internationally by necessity. Our processors operate infrastructure in the United Kingdom, the European Economic Area and the United States, and a delivery carrier in your own country will receive your address.

Where data leaves the UK or the EEA, we rely on one of the following safeguards:

• An adequacy decision by the UK government or the European Commission covering the destination country;
• The UK International Data Transfer Addendum, or the European Commission's Standard Contractual Clauses, together with a transfer risk assessment; or
• The necessity of the transfer to perform our contract with you — for example, giving a carrier your address so it can deliver.

You can request a copy of the safeguard we rely on for a particular transfer by writing to support@loncarsol.shop.

• Order, delivery and payment records — six years after the end of the relevant financial year, which is the retention period required for UK tax and accounting records.
• Membership and invoice records — six years on the same basis.
• Support and returns correspondence — 24 months after the case closes.
• Contact and trade enquiries that do not become orders — 24 months from your last contact with us.
• Abandoned checkout details — 12 months, then deleted.
• Room photos or previews emailed to support — deleted within 30 days of the case closing.
• Marketing consent records — for as long as you are subscribed, plus 24 months, so we can evidence the consent.
• Server and security logs — 12 months.

When a period expires the data is deleted, or irreversibly anonymised for statistical purposes.

The site is served over HTTPS. Data is encrypted in transit, and at rest by our hosting and database providers. Administrative access is restricted to named people, protected by authentication and reviewed periodically. Payment credentials never enter our systems, so they cannot leak from them.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of it, and we will tell you directly where the risk to you is high.

If you are in the United Kingdom or the European Economic Area, UK GDPR and EU GDPR give you the right to:

• Be told what we hold about you, and get a copy of it (access);
• Have inaccurate data corrected (rectification);
• Have data deleted where we no longer have grounds to keep it (erasure);
• Restrict how we use your data while a dispute about it is resolved;
• Receive data you gave us in a portable, machine-readable format, and have it sent to another controller;
• Object to processing based on our legitimate interests, and to direct marketing at any time, absolutely;
• Withdraw consent at any time, where we rely on consent.

To exercise any of these, write to support@loncarsol.shop. We respond within one month, and will tell you if we need to extend that by a further two months for a complex request. We may ask for enough information to confirm who you are. Exercising your rights is free; we only charge where a request is manifestly unfounded or excessive, and we will say so first.

Note that we cannot delete order and payment records that we are legally required to keep for tax purposes until that retention period expires. We can restrict them from any other use in the meantime.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information we collect and why, to request a copy of it, to request deletion, to correct inaccurate information, and not to be discriminated against for exercising those rights.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, including for the personal information of anyone we know to be under 16. Because we do not sell or share, there is no opt-out to submit — but you may still exercise every other right above.

The categories we collect are identifiers, commercial information about your orders, internet activity from server logs, and geolocation only at the level of your delivery address and billing country. We collect these for the business purposes described in this policy, and we do not use them to profile you.

To make a request, write to support@loncarsol.shop with “California privacy request” in the subject line. An authorised agent may act for you with written permission.

We use essential cookies to keep your cart and your session working, and to protect our forms from automated abuse. These are required for the site to function and cannot be switched off.

Your cart is stored in your own browser storage, not in a tracking cookie, and never leaves your device until you submit an order.

We do not run advertising cookies and we do not embed third-party advertising trackers. Full detail, including how to control cookies in your browser, is in the Cookie Policy.

Automated decisions. We do not make decisions producing legal or similarly significant effects about you by automated means alone. Stripe runs automated fraud scoring on payments, which can decline a transaction; if that happens and you believe it is wrong, contact us and a person will review it.

See-in-Room. The preview tool composes an image in your browser. It makes no decision about you and receives no personal data from us.

Children.This site is intended for adults. It is not directed at children under 13, and we do not knowingly collect their personal data. Anyone aged 13 to 17 must have a parent or guardian's consent before contacting us or placing an order, and the guardian is responsible for the order. If you believe a child has given us personal data, write to support@loncarsol.shop and we will delete it promptly.

Please raise any privacy concern with us first at support@loncarsol.shop, or by post to LONDON CARPET SOLUTIONS LTD, 852 Green Lanes Winchmore Hill, N21 2RS, United Kingdom. We would rather fix it than have you escalate.

You also have the right to complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office (ico.org.uk, helpline 0303 123 1113). In the EEA you may complain to the supervisory authority in the country where you live, work, or where you believe the issue occurred.

This policy is governed by the laws of England and Wales. If we change it, we will update the date in the ledger on this page and, where the change is significant, tell affected customers by email.