Privacy Policy

Last updated: 15 October 2026

Who we are

London Plumbing Supplies Ltd ("we", "us") is the data controller for the personal data you provide through this website, by phone, or in person. Registered office: 186-192 Chingford Mount Road, Chingford, London E4 9BS. VAT No. GB 457 9266 44. You can contact us at accounts@londonplumbing.com.

What we collect

We only collect what we need to provide our products and services (data minimisation):

Contact details you provide (name, email, and — only if you give them — phone and delivery address).
Order details and, for trade accounts, your company name and VAT number.
Order and payment information (payments are processed securely by Stripe — we never see or store your card details).
Mailing list — only if you opt in: your email address, your name if you give it, and a record of your consent: the wording you agreed to, when and where you signed up (account sign-up, the website footer or your account settings) and the IP address used at the time. We also record when you confirmed and, if you do, when you unsubscribed.
Visitor statistics — without cookies: the pages you view, the website or search engine that sent you, anything you search for on our site, your device type, browser and operating system, and your approximate country (provided by our network provider, Cloudflare). We don't store your IP address — see Visitor statistics below.
Essential cookies to run your basket and keep the site secure, and — only with your consent — Google Maps cookies.
Account security data: one-time sign-in and verification codes (stored only as irreversible hashes and expiring after 10 minutes), a token for each device you choose to trust (30 days), and the IP address and browser used to sign in, to protect your account from misuse.

We do not collect special category data, and we do not use automated decision-making or profiling that produces legal effects.

How we use it

To provide the products, quotes and support you ask for.
To process payments and fulfil orders, and to email you about your order — confirmation, picking, out for delivery or ready to collect, delivered or collected, and any cancellation or refund.
To send one feedback email about an hour after an order is delivered or collected, asking how we did.
To send newsletters with offers, new stock and trade deals — only if you have opted in.
To understand how the website is used — which pages and products people view and what they search for — so we can fix problems and improve it.
To keep the site, accounts and payments secure, and to meet legal, accounting and warranty obligations.

Legal bases

Contract — your account, your orders, delivery or collection, and the emails about them.
Consent — newsletters and other marketing emails, and the Google Maps embed. You can withdraw consent at any time.
Legitimate interests — the one-off feedback email after an order, our cookieless visitor statistics, security and fraud prevention (including reCAPTCHA), and keeping a record that you unsubscribed so we never email you again by mistake.
Legal obligation — tax, invoice and product safety records.

We only send marketing emails to people who have said yes. You can join in three ways, and none of them is required to shop with us:

When you create an account — an optional box that is never ticked for you. Your subscription only starts once you confirm your email address with the code we send.
From the website footer — we email you a confirmation link, and you're only added once you click it ("double opt-in").
In your account — under Email preferences.

Newsletters are occasional emails about offers, new stock and trade deals from our Chingford counter. To stop them, use the Unsubscribe link at the bottom of any newsletter — it works in one click — or the unsubscribe button your email app shows next to our emails (for example in Gmail, Outlook or Apple Mail), switch off “Offers & trade deals” under Email preferences in your account, or email accounts@londonplumbing.com. Unsubscribing takes effect straight away.

Order and account emails aren't marketing, so you'll still receive those after you unsubscribe. When you unsubscribe we keep your email address marked as unsubscribed — a suppression record — so we never add it again without your permission.

Order and feedback emails

We email you about your order as it progresses: when it's being picked, when it's out for delivery or ready to collect, when it's delivered or collected, and if it's cancelled or refunded. These are part of providing your order, so they can't be switched off.

About an hour after an order is delivered or collected, we send one email asking how we did, with a link to leave a review on Google. We ask every customer in the same way, and we never offer anything in return for a review. If you follow the link, you're on Google's site and Google's Privacy Policy applies. If you'd rather not receive these feedback emails, email accounts@londonplumbing.com and we'll stop.

Visitor statistics (no cookies)

We count visits to this website with our own statistics, not Google Analytics. They place nothing on your device — no cookies or similar storage — so they don't need cookie consent.

To count each visitor once per day without knowing who they are, we combine your IP address and browser details with a random code that changes every day, and keep only the scrambled result. The daily code is deleted after two days, so the result can't be reversed or linked to you on another day. We never store your IP address itself.
Visits from search engine crawlers and other bots, and from our own staff signed in to the shop's admin, aren't counted.
The statistics are only seen by us, as totals and rankings (for example “most viewed products”). We don't share or sell them.
Page-view records are deleted after about 13 months.

Third parties & sub-processors

We keep third-party code to a minimum and never sell your data. The services we rely on are:

Stripe — payment processing (card data goes directly to Stripe; we never receive it).
Hosting provider — serves the website and stores order data within the UK/EEA.
Cloudflare — delivers the website quickly and protects it from attacks. It handles your IP address to do this and tells us your approximate country for our visitor statistics.
Google Fonts — fonts are self-hosted at build time, so your browser does not call Google when you visit.
Google Maps — our shop location map loads only if you accept all cookies or press “Show map”; Google then receives your IP address and may set its own cookies.
Twilio — delivers our emails through its Email API: order confirmations and updates, the feedback email, newsletters you've subscribed to, verification and sign-in codes, and security alerts. It receives your name, email address and the content of those emails.
Google reCAPTCHA — protects sign-in, registration, password reset, contact, newsletter sign-up and checkout forms from bots and fraud. When you use one of those forms it collects device and browser information and sends it to Google, under Google's Privacy Policy and Terms. We use it on the basis of our legitimate interest in keeping accounts and payments secure.

We do not use Google Analytics, advertising networks, social media tracking pixels or session-recording tools.

Your rights

You have the right to access, correct, delete, restrict or port your data, and to object to processing or withdraw consent at any time — for newsletters, the unsubscribe link does this instantly. The easiest way to exercise any of these — including full account deletion — is our Data & Privacy Requests page, or email accounts@londonplumbing.com. We respond within one calendar month and never charge for a request.

Retention

Account data is kept while your account is open, and deleted on request or after prolonged inactivity.
Order and invoice records, including the dates of the emails we sent about them, are kept for six years to meet HMRC requirements, then securely deleted.
Mailing-list records are kept while you're subscribed. After you unsubscribe we keep only your email address, the unsubscribe date and your original consent record, so we can respect your choice and show that we had your permission.
Visitor statistics are kept for about 13 months; the daily codes behind them are deleted after two days.
Sign-in codes expire after 10 minutes, and trusted-device tokens after 30 days.

Where your data is held

Your data is stored on servers within the UK/EEA. Where a provider processes data outside the UK, we rely on an adequacy decision or Standard Contractual Clauses to keep it protected.

Complaints

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk if you're unhappy with how we handle your data.