Privacy policy
This notice explains how BMF Limited trading as Washlets Direct collects and uses personal data under UK GDPR and the Data Protection Act 2018, and how cookies are used under PECR.
Last updated: 31 August 2026 · Controller: BMF Limited (company 05238759)
1. Who we are
Data controller: BMF Limited, registered in England and Wales under company number 05238759. Registered office: Ground Floor, Techno Centre, Station Road, Horsforth, Leeds LS18 5BJ. Trading address / showroom (appointment only): 248 Meanwood Road, Leeds LS7 2HZ. VAT 852975876.
Website: washletsdirect.co.uk. Email: [email protected]. Phone: 0113 266 0096.
We are not required to appoint a statutory Data Protection Officer. Mark privacy requests “Data protection”.
2. What we collect
- Identity and contact — name, email, phone, billing and delivery addresses when you order, create an account, apply for trade, book the showroom or send an enquiry.
- Order and account — products, payment references (we do not store full card numbers), delivery notes, returns, warranty claims, trade status.
- VAT relief declarations — if you claim zero-rating, the written eligibility declaration you send us (kept with our VAT records). We do not ask for medical letters or clinic records as a condition of relief.
- Technical — IP address, browser, device type, approximate location, pages viewed, referring site, cookie identifiers.
- Communications — emails, phone notes, contact-form messages, project drawings you attach.
- On-site tools — messages typed into the website chatbot. If you use voice search, audio is processed in the browser / speech service and the resulting text may be used as a search query. Chat transcripts are customer-service records, not a substitute for a written order.
- Marketing — email address if you subscribe to “Stay in touch”, plus your unsubscribe choices.
3. Why we use it (lawful bases)
| Purpose | Lawful basis |
|---|---|
| Take and fulfil orders, delivery, returns, refunds, warranties | Contract (UK GDPR Art. 6(1)(b)) |
| Customer service, compatibility questions, project quotes | Contract and/or legitimate interests (Art. 6(1)(f)) |
| Tax, accounting, product safety, VAT relief records | Legal obligation (Art. 6(1)(c)) |
| Prevent fraud, keep the site secure, debug faults | Legitimate interests (Art. 6(1)(f)) |
| Newsletter and similar electronic marketing | Consent (PECR + Art. 6(1)(a)). Withdraw at any time. |
| Analytics and advertising cookies that are not strictly necessary | Consent (PECR), managed in the cookie banner |
4. Cookies and similar tools
On first visit a banner lets you Accept, Decline or Manage non-essential cookies. Required cookies cannot be switched off because the basket, login and security need them. Category detail: Cookie policy.
- Required — basket, account session, security, cookie choice itself.
- Personalisation — remember VAT display and similar preferences.
- Analytics — understand which pages work (only if you accept).
- Marketing — ShopWired / partner ads and remarketing (only if you accept).
5. Who we share data with
We do not sell personal data. We share it only with processors who help us run the shop, under contracts:
- ShopWired (ecommerce platform and hosted checkout)
- Payment providers (card, PayPal, Apple Pay, Google Pay — they process the card, not us)
- Carriers and pallet firms for delivery
- Cloudflare (R2 asset hosting and, where used, Workers)
- Email / hosting providers that carry help@ messages
- Address lookup (if used at account or checkout) solely to complete an address
- Professional advisers (accountant, solicitor) where required
Some processors store or access data outside the UK. Where that happens we rely on UK-approved transfer tools (UK Extension to the EU-US Data Privacy Framework or the ICO International Data Transfer Agreement / Addendum).
6. How long we keep it
- Orders, invoices, VAT relief declarations — at least 6 years after the end of the tax year (HMRC).
- Warranty / fault files — for the life of the relevant guarantee plus a short buffer.
- Enquiries and chatbot transcripts that do not become an order — up to 24 months, then deleted or anonymised unless a dispute is open.
- Marketing list — until you unsubscribe, plus a suppression record so we do not email you again by mistake.
- Server logs — typically 12 months or less.
7. Chatbot and voice search
The on-site assistant answers catalogue and compatibility questions. Do not put card numbers or passwords into it. It can be wrong; policies on this website and your order confirmation take priority over anything the bot says. Voice search uses the browser’s speech service to turn speech into text for the search box. We do not keep raw audio files on our servers.
8. Marketing (“Stay in touch”)
The footer form is optional. By submitting your email you consent to occasional emails about products, stock and offers. Every email includes an unsubscribe link. We will not use that list for third-party marketing. If you only want order updates, do not subscribe — transactional messages about an order you placed do not need marketing consent.
9. Your rights
You may request access, correction, erasure, restriction or portability, and you may object to processing based on legitimate interests. Where we rely on consent you may withdraw it without affecting earlier lawful use. Email [email protected] with the subject “Data protection”. We may need to verify who you are.
You can complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.
10. Children
The shop is aimed at adults buying sanitaryware. We do not knowingly collect data from children.
Related: Cookie policy · Terms · Contact · VAT relief