Privacy Policy

Last Updated: June 2026

TWOPAGES ('we', 'us', 'our') is committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what rights you have in relation to it.
This Privacy Policy applies to all personal data we collect when you visit our UK website, located at https://twopagescurtains.co.uk, place an order, create an account, contact us, or otherwise interact with our services. It has been written in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Please read this Privacy Policy carefully. By using our website or our services, you acknowledge that you have read and understood its contents.
Remember that your use of TWOPAGES’s Services is at all times subject to our Terms of Website Use, which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Website Use.

Who We Are (Data Controller)

This policy applies to the TWOPAGES UK website and services. We are the data controller for your personal data. This website is operated by the TWOPAGES brand team. References to 'we', 'us' and 'our' mean the TWOPAGES team. If you need to contact us regarding the Website or these Terms, please reach out to our customer service team via email at support@twopagescurtains.co.uk.

What Personal Data We Collect

We collect personal data in the following categories. Not all categories will apply to every individual — we collect only what is relevant to the services you use or request.

Identity and Contact Data

We may collect your full name and title, email address, billing and delivery address, telephone number, and account login details, including your account username and password (stored in encrypted form), when you place an order, create an account, or contact us. We use this information to create and manage your account, process and deliver your orders, communicate with you about your order or enquiry, and provide customer support.

Order and Transaction Data

We collect information relating to your purchases and transactions, including the products you order, any custom specifications such as dimensions, fabric, lining, heading style, and colour, together with your order history, purchase records, payment method details such as card type and the last four digits only (we do not store full card numbers), transaction amounts, dates, references, and delivery and tracking information. We use this information to fulfil your order, process payments securely, maintain accounting and legal records, and manage delivery, returns, refunds, and warranty claims.

Technical and Usage Data

When you visit our website, we may automatically collect technical and usage data such as your IP address, approximate location at country or region level, browser type, device type, operating system, pages visited, time spent on pages, navigation behaviour, referral source, search terms used to reach our site, session data, and cookie information (see Section 7). We use this data to operate and improve our website, analyse user behaviour, maintain security, prevent fraud, and measure the effectiveness of our marketing.

Marketing and Communications Data

We may collect information about your preferences for receiving marketing communications from us, including whether you have subscribed to our newsletter, your communication preferences, your opt-out choices, and records of how you interact with our marketing emails, such as opens and clicks. We use this information to send relevant offers, product updates, and inspiration where permitted, to personalise our marketing, and to manage your communication preferences.

Profile and Preference Data

We may also collect or infer information about your preferences and browsing behaviour, such as products you have viewed, saved, or added to basket, your purchase behaviour, inferred interests, and any loyalty or rewards activity if applicable. We use this information to personalise your shopping experience, recommend products that may suit your preferences, and improve our website and product offering.

Customer Service Data

If you contact us for support or submit a review, we may collect the content of your communications with us, including emails, live chat conversations, call records, complaint details, return requests, warranty claims, reviews, testimonials, and any photographs or evidence you provide in relation to damage or claims. We use this information to respond to your enquiries, provide customer support, resolve complaints, manage returns and claims, improve our services, and, where appropriate and permitted, publish your reviews.

Special Categories of Data

We do not intentionally collect any special category personal data, such as health information, religious beliefs, or biometric data. Please do not share such information with us unless we specifically request it and clearly explain why it is needed.

Data We Receive from Third Parties

In some circumstances, we may receive limited personal data about you from trusted third parties, including payment providers such as Stripe, PayPal, or Klarna, who may provide transaction confirmation and fraud prevention information; analytics providers such as Google Analytics, who may provide aggregated website usage insights; social media platforms, where you interact with our content or use social login features; and delivery partners, who may provide delivery updates and address verification. We use this information to complete transactions, prevent fraud, analyse and improve our services, and ensure accurate and efficient delivery.

How We Use Your Personal Data

We use your personal data only for the purposes described in this Privacy Policy. We do not sell your personal data to third parties for their own marketing purposes.

Processing and fulfilling your order

To receive and confirm your order and process payment
To manufacture your custom-made products to your exact specification
To arrange delivery and provide you with tracking information
To process returns, exchanges, cancellations, and refunds
To enforce our Terms and Conditions and resolve disputes

Managing your account

To create and maintain your account
To allow you to view your order history and manage your preferences
To verify your identity when you contact us or request access to your data

Customer service and communications

To respond to your enquiries, complaints, and support requests
To send you service-related notifications (e.g. order confirmations, dispatch notifications, and delivery updates)
To process warranty claims and damage reports
To follow up on returns and refunds

Marketing and promotional communications

To send you marketing emails, newsletters, and promotional offers where you have given consent, or where we have a legitimate interest in doing so (see Section 4)
To personalise the content and offers you see on our website and in our emails
To invite you to take part in reviews, surveys, or competitions

ℹ You can opt out of marketing communications at any time. See Section 8 for full details.

Website improvement and analytics

To understand how visitors use our website and to improve its content, design, and functionality
To test new features and carry out A/B testing
To monitor website performance and fix technical issues
To detect and prevent fraud and other security threats

Legal and compliance purposes

To comply with our legal and regulatory obligations, including tax, accounting, and consumer protection law
To respond to lawful requests from regulators, law enforcement, or courts
To enforce our legal rights, defend against claims, and protect the safety of our customers and business

Our Lawful Basis for Processing Your Data

Under UK GDPR, we are required to identify a lawful basis for each way we use your personal data. The table below sets out the main purposes for which we process your data and the lawful basis we rely on for each.

Purpose of Processing	Type of Data	Lawful Basis
Processing and fulfilling your order (including manufacturing, payment, and delivery)	Identity, Contact, Order, Financial	Performance of a contract
Creating and managing your account	Identity, Contact, Profile	Performance of a contract
Sending order confirmations, dispatch notifications, and delivery updates	Identity, Contact, Order	Performance of a contract
Responding to customer service enquiries and complaints	Identity, Contact, Customer Service	Performance of a contract / Legitimate interests
Processing returns, refunds, and warranty claims	Identity, Contact, Order, Customer Service	Performance of a contract / Legal obligation
Sending marketing emails to existing customers about similar products and services	Identity, Contact, Marketing	Legitimate interests (soft opt-in, PECR compliant)
Sending marketing emails to new subscribers or where separate consent has been obtained	Identity, Contact, Marketing	Consent
Personalising website content and product recommendations	Technical, Profile, Marketing	Legitimate interests
Website analytics and performance monitoring	Technical, Usage	Legitimate interests
Preventing and detecting fraud and abuse	Identity, Technical, Order	Legitimate interests / Legal obligation
Complying with legal and regulatory obligations (e.g. tax, accounting)	Identity, Order, Financial	Legal obligation
Responding to lawful requests from regulators or courts	All relevant categories	Legal obligation
Retaining records for accounting and dispute resolution	Identity, Order, Financial	Legal obligation / Legitimate interests

Who We Share Your Personal Data With

We do not sell your personal data to third parties. We share your personal data only in the following circumstances, and only to the extent necessary:

Service providers and data processors

We work with carefully selected third-party service providers who process personal data on our behalf and under our instruction. These include:

Payment processors: to process card payments, PayPal transactions, and Klarna orders securely. These providers have their own privacy policies and are subject to PCI DSS compliance.
Delivery and logistics partners: to dispatch and track your order, including DHL Express, Royal Mail, and other carriers.
Email and marketing platforms: to send transactional and marketing emails on our behalf.
Customer service tools: including live chat providers and helpdesk software.
Analytics providers: including Google Analytics, to help us understand website usage. These providers may use cookies and process IP address data.
Cloud hosting and IT infrastructure: to store and process data securely.

All service providers are required to process your data only as we instruct, to maintain appropriate security standards, and to comply with applicable data protection law. Where required, we have entered into Data Processing Agreements with these providers.

Business transfers

In the event that we sell, transfer, or merge all or part of our business, or acquire a new business, your personal data may be disclosed to the prospective buyer, seller, or their advisers as part of due diligence. Any acquirer would be required to use your personal data only in accordance with this Privacy Policy.

Legal and regulatory disclosures

We may disclose your personal data to regulatory authorities, law enforcement agencies, courts, or other public bodies where we are required to do so by law, where we have a legitimate interest in doing so for legal proceedings, or where disclosure is necessary to protect the rights, safety, or property of TWOPAGES, our customers, or others.

With your consent

We may share your data with third parties for purposes not described above where we have obtained your explicit consent to do so. You may withdraw such consent at any time.

International Transfers of Personal Data

TWOPAGES is a cross-border retailer and some of our service providers operate outside the United Kingdom. When we transfer your personal data outside the UK, we ensure that appropriate safeguards are in place to protect it, in accordance with UK GDPR requirements.
Transfers outside the UK will only take place where one of the following applies:

The country has been assessed as providing adequate protection for personal data by the UK Secretary of State (an 'adequacy decision').
We have entered into contracts incorporating the UK Information Commissioner's International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum (UK Addendum) to the EU Standard Contractual Clauses, which require the recipient to protect your data to UK GDPR standards.
A specific derogation under UK GDPR Article 49 applies — for example, where the transfer is necessary for the performance of a contract with you.

If you would like further information about the specific safeguards applied to any international transfers of your personal data, please contact us at support@twopagescurtains.co.uk.

Cookies and Similar Technologies

We use cookies and similar tracking technologies on our website. A cookie is a small text file stored on your device by your browser when you visit a website. Cookies help our website function correctly and allow us to improve your experience and our marketing activities.

Types of cookies we use

Strictly necessary cookies: essential for the website to function. These enable core features such as your shopping basket, secure login, and checkout. They cannot be disabled.
Functional / Personalisation cookies: remember your settings and preferences (such as language, currency, and recently viewed products) to provide a more consistent experience.
Analytical cookies: collect anonymous or pseudonymous data about how visitors use our website — such as pages visited, time on site, and traffic sources. We use this information to improve our website. Providers include Google Analytics.
Marketing and targeting cookies: track your browsing activity to enable us to show you more relevant advertisements on our website and on other websites and social media platforms. Providers include Meta Pixel and Google Ads.
Currency conversion cookies: store your selected currency preference as a session cookie, which expires when you close your browser.

Your cookie choices

When you first visit our website, you will be shown a cookie preference banner. You may accept all cookies, reject non-essential cookies, or manage your preferences by category. You can change your preferences at any time through our cookie settings.
You may also control cookies through your browser settings. Most browsers allow you to block or delete cookies. Please note that if you disable certain cookies, some features of our website may not work correctly.

ℹ Our cookie practices are governed by the Privacy and Electronic Communications Regulations 2003 (PECR), as well as UK GDPR. Our cookie banner must obtain valid consent (freely given, specific, informed, and unambiguous) for all non-essential cookies before they are set. Essential cookies do not require consent.

Marketing Communications

When we send marketing communications

We may contact you with information about our products, promotions, and new collections in the following circumstances:

Where you have subscribed to our newsletter or explicitly opted in to receive marketing emails from us.
Where you are an existing customer who has purchased a product from us and you have not opted out of marketing. In this case, we may send you information about similar products and services under the 'soft opt-in' rule permitted by the Privacy and Electronic Communications Regulations 2003 (PECR).

Your right to opt out

You can opt out of marketing communications at any time:

By clicking the 'unsubscribe' link at the bottom of any marketing email you receive from us.
By logging into your account and updating your communication preferences.
By contacting us directly at support@twopagescurtains.co.uk.

We will process your opt-out request promptly. Please note that even if you opt out of marketing, we will continue to send you essential service-related communications — such as order confirmations, dispatch notifications, and responses to your enquiries.

Personalised advertising

We may use your browsing and purchase data to show you personalised advertisements on social media platforms (such as Meta/Instagram) and through other digital advertising networks. This is done using cookies and pixel tracking technologies, where you have consented to marketing cookies.
You can opt out of personalised advertising by adjusting your cookie preferences on our website, or by using your social media platform's advertising settings to opt out of interest-based advertising.

How Long We Keep Your Personal Data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. The following are our general retention guidelines:

Category of Data	Retention Period
Order and transaction records	7 years from the date of the order (required for tax and accounting purposes under UK law)
Account information	For the duration your account is active, plus 2 years following account closure or last login
Marketing preferences and subscription records	Until you opt out, plus a reasonable period to evidence your consent or opt-out decision
Customer service correspondence	3 years from the date of the last interaction, or longer if relevant to an unresolved dispute
Damage/fault photographs and warranty claim records	3 years from the date of the claim
Website analytics data	Up to 26 months (in line with Google Analytics default retention settings)
Fraud prevention records	6 years from the date of the relevant transaction or incident
Cookie consent records	Up to 1 year from the date of consent

At the end of the relevant retention period, personal data will be securely deleted or anonymised so that it can no longer be associated with any individual. Where we are unable to delete data immediately (for example, because it is stored in backup systems), we will isolate it from further processing until deletion is possible.

Your Rights Under UK Data Protection Law

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights in relation to your personal data. These rights are subject to certain conditions and exemptions, which we will explain if they apply to your request.

Your Right	What It Means
Right of Access	You have the right to request a copy of the personal data we hold about you (a 'Subject Access Request' or SAR). We will respond within one month of receiving your request. In some cases, we may extend this by a further two months where the request is complex.
Right to Rectification	You have the right to ask us to correct any personal data we hold about you that is inaccurate or incomplete. We will update your data promptly upon request.
Right to Erasure ('Right to be Forgotten')	You have the right to request that we delete your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent (if consent was the basis for processing), or where we have processed it unlawfully. This right is not absolute — we may be required to retain certain data by law.
Right to Restrict Processing	You have the right to ask us to restrict the processing of your personal data — for example, whilst a dispute about its accuracy is resolved, or pending an objection you have raised.
Right to Data Portability	Where we process your data on the basis of your consent or to perform a contract, and the processing is carried out by automated means, you have the right to receive your data in a structured, commonly used, and machine-readable format, and to request that we transmit it to another data controller.
Right to Object	You have the right to object to processing based on our legitimate interests. You also have an absolute right to object to processing of your personal data for direct marketing purposes. We will stop processing your data for marketing immediately upon receipt of your objection.
Right to Withdraw Consent	Where we process your data on the basis of your consent (e.g. for marketing emails or non-essential cookies), you may withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Rights in Relation to Automated Decision-Making	You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects. We do not currently make such automated decisions about you.

How to exercise your rights

To exercise any of the rights listed above, please contact us at support@twopagescurtains.co.uk

We will respond to all requests within one calendar month of receipt. If your request is complex or numerous, we may extend this period by up to two additional months — we will notify you of any extension within the first month and explain our reasons.
We may need to verify your identity before processing your request to protect against unauthorised access to your data. If we require additional information from you, the response period will begin once we have received it.
We will not charge a fee for responding to your request, unless the request is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or decline to act on the request.

Right to complain to the ICO

If you are not satisfied with our response to a data protection request, or if you believe we have handled your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:

Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would, however, appreciate the opportunity to address your concerns before you approach the ICO. Please contact us in the first instance at support@twopagescurtains.co.uk.

How We Protect Your Personal Data

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, alteration, disclosure, or destruction. These include:

Encryption of personal data in transit using SSL/TLS protocols (HTTPS)
Encryption of personal data at rest where appropriate
Access controls restricting who within our organisation can access personal data, based on the principle of least privilege
Regular security assessments and vulnerability testing of our systems
Staff training on data protection obligations and information security
Data Processing Agreements with all third-party service providers who process personal data on our behalf

Whilst we take all reasonable steps to protect your personal data, no transmission of data over the internet can be guaranteed to be completely secure. You use our website and share your personal data at your own risk. If you suspect that your account has been compromised, please notify us immediately at support@twopagescurtains.co.uk.

Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay, as required by UK GDPR Article 34.

Children's Privacy

Our website and services are not intended for use by children under the age of 18. We do not knowingly collect or process personal data from anyone under 18 years of age.
If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately at support@twopagescurtains.co.uk. We will take prompt steps to delete such data from our records.

Third-Party Websites and Social Media

Our website may contain links to third-party websites — including the websites of delivery partners, payment providers, and social media platforms. This Privacy Policy does not apply to those websites. We are not responsible for the privacy practices of third parties and encourage you to read the privacy policy of any third-party site before providing them with your personal data.
Our website may include social media features and widgets (such as 'Share' or 'Follow' buttons for Instagram, Facebook, Pinterest, and TikTok). These features are operated by the respective social media platforms and may collect information about you, including your IP address. Your interactions with such features are governed by the privacy policies of the relevant social media companies.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data processing activities, applicable law, regulatory guidance, or the way we operate. Any changes will be posted on this page with an updated 'Last updated' date.
Where we make material changes — for example, changes that significantly affect how we use your personal data or your rights — we will notify you by email (if we hold your email address) or by posting a prominent notice on our website before the changes take effect.
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of our website after any changes are posted constitutes your acceptance of the updated Privacy Policy, to the extent permitted by law.

How to Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our handling of your personal data, please do not hesitate to contact us at support@twopagescurtains.co.uk.

We aim to acknowledge all data protection enquiries within 5 working days and to respond fully within one calendar month.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.