Privacy Policy – Maker&Son Licenses Ltd

Last updated: January 2025

1. Introduction

Maker&Son Licences Ltd (“we”, “us”, “our”) respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you visit our website (www.makerandson.com) or otherwise engage with us (online, in showrooms, via consultants).

We are the data controller for personal data collected in the UK. We comply with the UK GDPR and the Data Protection Act 2018.

When you provide personal data to us (via website, showroom, order process, marketing, etc.), you agree to the terms of this policy.

2. What data we collect

We collect a variety of personal data depending on how you interact with us. Below is a breakdown of categories and examples:

Category	Example/Notes
Identity / Master Data	Name, title, date of birth (if needed), gender
Contact Data	Email address, postal address, telephone numbers
Transactional / Order Data	Order history, payment information (e.g. card token, billing address), delivery address
Profile Data	Account username, password (hashed), preferences, comments, feedback, survey information
Usage / Technical Data	IP address, browser type/version, device identifiers, operating system, page views, referrer, clickstreams, session duration
Location Data	Approximate location inferred from IP or device (with consent)
Marketing & Communications Data	Your preferences for receiving marketing, opt-ins, consents
Warranty / After-Sales Data	Warranty registrations, claims history, photographic evidence of faults, repair history
Financial Data	Bank account (for refunds), payment transactions (processed by third parties

We may also derive aggregated / anonymised data (e.g. “X% of visitors visited page Y”) which is not personal data (because individuals cannot be identified).

2.1 Data from third parties / other sources

We may receive data about you from third parties, such as:

• Analytics or advertising partners (e.g. Google, Meta, LinkedIn)
• Public sources(e.g. companies registry)
• Social media platforms (if you link your account or otherwise consent)
• Payment processors, identity verification services
• Delivery / logistics partners

We will only combine or use that data in accordance with this policy and with lawful grounds.

3. Cookies & tracking technologies

We (or our third-party partners) use cookies, pixels, web beacons, local storage and similar technologies to collect technical, usage, and marketing data. This helps our site function, analyse traffic, and deliver personalised advertising. Typical categories include:

• Strictly necessary cookies — essential for basic site operation (e.g. remembering your cookie consent choice, managing sessions).
• Preferences cookies — to remember your settings (language, currency, display).
• Statistics / Analytics cookies — to collect anonymous data about how users use the site (e.g. pages visited, time spent).
• Marketing / Advertising cookies — to deliver relevant adverts to you and measure their effectiveness across devices.

We may use tools such as Google Analytics, Facebook Pixel, or Adobe Analytics (or equivalents) to track site usage.
We may also use remarketing / retargeting technology (e.g. Google Ads retargeting, Facebook custom audiences) to show you relevant Maker&Son adverts on other websites or social media.
We may also use Hotjar (or similar) for session replay, heatmapping, behaviour tracking to improve usability — unless you opt out.
We provide or will provide a Cookie Banner / Consent Manager that allows you to accept or decline non-strictly necessary cookies.
For more detail on each cookie / tracker, please see our Cookie Policy.

4. How and why we use your personal data

We use your data for the purposes below, and under one or more lawful bases (e.g. consent, contract, legitimate interests, legal obligations):

Purpose	Data Used	Lawful Basis	Additional Notes
Providing & fulfilling orders	Identity, contact details, transactional, warranty	Performance of contract	To deliver goods, invoice, handle returns, repairs
Registration / account management	Identity, contact, profile, password	Performance of contract / legitimate interest	To allow you to use account features
Customer service & support	Contact details, order history, communications	Legitimate interest / contract	To respond to queries, warranty claims
Marketing & promotions	Contact, profile, usage, marketing preferences	Consent (or legitimate interest where permitted)	To send offers, updates, newsletters
Personalisation & recommendations	Profile, usage, browsing	Legitimate interest / consent	To tailor product suggestions
Analytics, site improvements	Usage, technical data	Legitimate interest	To identify and fix issues, improve content
Fraud prevention & security	Identity, transactional, technical	Legitimate interest	To detect misuse, secure payments
Legal / regulatory compliance	Identity, transactional, communications	Legal obligation	Record-keeping, anti-money laundering, tax, etc.
Mergers, transfers & corporate changes	Identity, transactional	Legitimate interest / contract / order fulfilment	If we restructure or sell business

We will always ensure the data used is proportionate and limited to what is needed.

5. Sharing your data & disclosures

We may share your personal data with:

• Service providers / processors (under contract) — e.g. Manufacturers, payment gateways, delivery / logistics companies, IT / hosting providers, CRM / customer support platforms.
• Marketing / advertising partners — for segmented or targeted advertising (subject to your consent or opt-out).
• Insurers / warranty administrators — to manage warranty or insurance claims (e.g. Loxa, etc.).
• Legal / regulatory authorities — if required by law, court order, or to protect rights.
• Business buyers / successors — in connection with continuation of order fulfilment, corporate mergers, acquisitions or asset sales.
• Anti-fraud / credit agencies — to detect or prevent fraud.

We will impose contractual obligations on all processors to ensure your data is handled securely and only as permitted by us. If sharing data outside the UK / EEA, we will ensure adequate protections (e.g. standard contractual clauses, UK adequacy decisions, or binding corporate rules).

5.1. Insurance

In order to offer insurance provided by Loxa Ltd, we will share limited personal information, such as your contact and order details, with Loxa Ltd, an insurance intermediary authorised and regulated by the Financial Conduct Authority (FCA no. 1018666). This is necessary for them to provide insurance related to your purchase, issue policy documentation, send renewal notifications, administer the policy, and process any claims. Loxa Ltd will process your personal data in accordance with their own Privacy Policy and applicable data protection laws. https://www.loxacover.com/privacy-policy

6. International transfers

Because we (or our processors) may operate globally, your personal data may be transferred outside the UK / EEA. When that happens, we ensure that:

• The country has an adequacy decision, or
• We use appropriate safeguards (e.g. standard contractual clauses), or
• You have explicitly consented where required.

We will always inform you when a transfer requires additional notice or consent.

7. Data retention

We retain your personal data only as long as needed for the purposes set out above or as required by law. Typical retention periods:

• Order / transactional data: as required for tax, manufacturer warranty, or accounting (e.g. up to 6–7 years)
• Marketing / communications data: until you unsubscribe or withdraw consent
• Support / warranty claims: for duration of warranty plus a reasonable period
• Analytics / usage data: a shorter period (e.g. 12–24 months), often anonymised or aggregated thereafter

After that, data is either securely deleted or anonymised.

8. Your rights

Under UK GDPR, you have multiple rights regarding your personal data:

• Right of access — you can request a copy of personal data we hold about you.
• Right to rectification — correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) — in some circumstances, you can ask us to delete your data.
• Right to restrict processing — in certain cases you may ask us to limit what we do with your data.
• Right to data portability — receive copies of your data in structured, machine-readable format.
• Right to object — object to processing for direct marketing or profiling.
• Rights in relation to automated decision-making / profiling — where applicable, challenge decisions made automatically.
• Withdraw consent — where processing is based on consent, you can withdraw it at any time (without affecting earlier processing).

To exercise any of these rights, contact us as below. We may ask for proof of identity to verify requests. We aim to respond to valid requests within one month (or longer if complex, in which case we will notify you). You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) if you believe your data has been misused.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. Access to data is limited to those who need to know. We also have procedures to detect, report, and investigate data breaches. Where legally required, we will notify affected individuals and regulators.

10. Changes to this policy

We may update this Privacy Policy from time to time (e.g. to reflect changes in law, technology or business practices). When we do:
We will post the updated version on our website with a revised “Last updated” date We may notify users (e.g. via email) if changes are material Continued use of our services after the changes constitutes your acceptance

11. Contact us

If you have any questions about this policy or your rights, or wish to exercise them, please contact:

C/O Data Protection Officer
Maker&Son Licences Ltd
4th Floor, Silverstream House/45 Fitzroy Street
London, England, W1T6EB
Email: hello@makerandson.com

You may also contact the UK Information Commissioner’s Office (ICO).