What we do with your information.

01Who we are

Enzo Interiors designs, makes and fits bespoke interiors and fitted furniture in Leicester and across Leicestershire. For the purposes of UK data protection law we are the data controller for the personal data described in this notice.

Registered company: ENZO INTERIORS LTD, company number 16540291, registered office 51 Forest Road, Leicester, England, LE5 0DW.

If you have a question about this notice or about how we handle your information, the quickest route is the contact page, or email [email protected].

Our websites, Admin Portal and Client Portal are hosted and technically operated for us by NPATEL GROUP LTD (“NPG”), company number 16236097. See section 10.

02What we collect, and when

We only collect information you give us, and only where you have asked us to do something with it. There is no third-party tracking on the public website and no profile is built from your browsing.

• Enquiry and quote requests — your name, email address, phone number if you give one, the room or service you are asking about, and whatever you write in the message.
• Booking a survey — the above, plus the address of the property to be surveyed and the times you are available, because we cannot come and measure a room without knowing where it is.
• During a project — measurements, photographs of the rooms we are working in, drawings, correspondence, and the invoicing details needed to be paid.
• Server logs — your IP address and browser user-agent are processed transiently by our hosting provider to serve the page and to protect against abuse. These are not used to identify you and are not combined with anything else.

We do not ask for, and would rather you did not send us, any special category data (health, beliefs, and so on). If a room has to be designed around a medical need or a disability, tell us only what we need in order to design it correctly.

Staff accounts (Admin Portal). Name, work email, role (for example Admin), hashed password, optional two-factor authentication details, and a log of sign-ins and actions taken in the portal (for security and accountability).

Client Portal. Your name, email, login details, and the project, quote, booking, document and message information you view or submit through the portal.

Technical data from the portals. IP address, browser and device type, session identifiers, and usage events (pages and features used, timestamps, errors).

03Why we use it, and our lawful basis

Under Article 6 of the UK GDPR every use of personal data needs a lawful basis. Ours are:

• Steps taken at your request before entering a contract (Art. 6(1)(b)) — answering an enquiry, arranging and carrying out a survey, and preparing a quotation.
• Performance of a contract (Art. 6(1)(b)) — designing, making, fitting and guaranteeing work you have ordered, and invoicing for it.
• Legal obligation (Art. 6(1)(c)) — keeping accounting and tax records, and any records required by consumer law.
• Legitimate interests (Art. 6(1)(f)) — keeping a record of the work we have done so we can honour the guarantee on it, and defending ourselves if a dispute arises. We have considered your interests against ours and consider this balance fair because the data is limited to what the job required.
• Consent (Art. 6(1)(a)) — only for optional things, such as using a photograph of your finished room in our portfolio. We ask separately, in writing, and you can withdraw it at any time.

We do not sell your data, we do not share it for anyone else's marketing, and we do not send marketing email unless you have asked us to.

Staff accounts and portal security: contract and legitimate interests (running and protecting our systems).

Client Portal: contract (delivering your project) and legitimate interests.

Portal usage analytics: legitimate interests (improving and securing the service).

Google sign-in and calendar: consent, which the user gives when they connect their account and can withdraw by disconnecting.

04Photographs of your home

We photograph rooms during a survey and again on completion. Survey photographs are working documents — they exist so the workshop can see the wall it is building for — and they are never published.

Completion photographs are only ever used publicly with your separate written consent, and that consent is genuinely optional: it has no effect on the price, the timescale or anything else about your job. If you consent and later change your mind, tell us and we will remove the images from our website and social channels. We cannot recall copies other people have already saved or shared, and we will say so honestly rather than promise otherwise.

05Who else sees it

As few people as possible. We do not use subcontracted fitters, so nobody outside our own team is in your home.

• Our hosting and email providers, who process data on our instructions under a written contract (UK GDPR Art. 28).
• Our accountant, for invoicing and statutory records.
• Suppliers, where a specific item has to be ordered to your address — and then only the delivery details.
• A public authority, where we are legally required to disclose something.

Where a processor is outside the UK, we rely on UK adequacy regulations or on the International Data Transfer Addendum, and we will tell you which if you ask.

NPATEL GROUP LTD hosts and operates our systems and acts on our instructions as our data processor under a written agreement. It also uses limited data for its own analytics purposes, as described in section 10.

Google receives data only when a user chooses to sign in or connect a calendar (section 11).

06How long we keep it

Only as long as there is a reason to.

• Enquiries that do not become jobs — up to 12 months, then deleted.
• Survey notes and drawings for a quotation you did not accept — up to 12 months.
• Completed projects — for the life of the workmanship guarantee plus 1 year, so we can honour a claim against the actual drawings.
• Invoices and accounting records — 6 years after the end of the relevant financial year, as required by HMRC.
• Consent records for photographs — for as long as the photograph is in use, plus 1 year.

07Your rights

Under the UK GDPR you have the right to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, and rights relating to automated decision-making. We make no automated decisions about you and do no profiling.

To exercise any of these, email [email protected] or write to us at the registered office above. We will respond within one month. There is no charge, and we will not ask you to justify the request.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner's Office at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We would rather you came to us first so we can put it right, but you do not have to.

08Keeping it safe

The website is served over HTTPS. Access to project records is limited to the people working on your job. Devices are password-protected and encrypted, and we review who has access when someone joins or leaves.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly where the risk is high.

Data is stored on servers operated by NPATEL GROUP LTD in UK. Passwords are hashed, Google access tokens and two-factor recovery data are encrypted at rest, traffic uses HTTPS, and access is restricted by role.

09Hosting, NPATEL GROUP LTD and analytics

Our websites, Admin Portal and Client Portal run on servers owned and managed by NPATEL GROUP LTD (“NPG”) in United Kingdom. NPG’s staff can access this infrastructure only for hosting, maintenance, support and security, under a data processing agreement with us.

NPG may also use data generated by our systems for its own legitimate purposes, namely: analysing usage of the portals and website (for example feature usage, performance and error data); security monitoring, abuse prevention and fraud detection; improving and developing its software and services.

Where possible this uses aggregated, de-identified or pseudonymised data. In doing this, NPG acts as an independent controller for that analytics use, on the basis of legitimate interests. NPG does not use your data to advertise to you, does not sell it, and does not use it to market to you on behalf of third parties.

This section does not apply to Google user data. Information we receive from Google (section 11) is never used by NPG for analytics, research, advertising or any purpose other than providing the Google features to you.

10Sign in with Google and Google Calendar

Enzo Interiors offers two optional Google features in the Admin Portal, used only by our staff.

Sign in with Google. Staff can link their Google Workspace account to their portal account and then sign in with it. We request the scopes openid and userinfo.email. We receive your Google account email address and a Google account identifier, which we use only to match your Google account to your existing portal account. We do not create accounts from Google sign-in.

Google Calendar. An Admin can connect a Google Calendar so that customer bookings appear in it. We request https://www.googleapis.com/auth/calendar.events (to create, update and delete booking events) and https://www.googleapis.com/auth/calendar.calendarlist.readonly (to list calendars so the Admin can choose which one to use). We read and write only the events needed for bookings. The booking event may contain the customer’s name, contact details, address and appointment time.

How we protect it. Google access and refresh tokens are encrypted at rest. They are stored on NPG-hosted servers and used only to provide these features.

Disconnecting. You can unlink Google sign-in on your Account page or disconnect the calendar in Settings at any time. We then delete the stored tokens. You can also revoke access at myaccount.google.com/permissions.

Limited Use. Enzo Interiors’ use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: We use Google user data only to provide and improve the user-facing sign-in and booking-calendar features. We do not sell Google user data or use it for advertising, including personalised advertising. We do not transfer Google user data to third parties except as needed to operate these features (our processor NPG hosts it on our behalf), to comply with law, or as part of a merger or sale with notice to you. No human reads Google user data except with your consent, to investigate abuse or a security issue, or where required by law. Google user data is not used by us or NPG for analytics, research or to train any AI or machine-learning model.

11Changes to this notice

This notice was last updated on 13 October 2026. If we change it materially we will update the date at the top and, where the change affects how we use data you have already given us, we will contact you rather than rely on you noticing.