Privacy Policy

Last updated: 03 September 2026

This Privacy Policy explains how The Guild of Oriental Rugs Limited, trading as The Handmade Rug Co (“we”, “us” or “our”), collects, uses and protects your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and other applicable data-protection laws.

1. Who We Are

This website is operated by The Guild of Oriental Rugs Limited, trading as The Handmade Rug Co.

Company number: 08954428
Registered office: 14 Oliver Business Park, London, England, NW10 7JB, United Kingdom
Email: hello@thehandmaderug.com

For the purposes of data-protection law, The Guild of Oriental Rugs Limited is the data controller responsible for your personal data.

2. What Information We Collect

We may collect and process the following categories of personal information:

Your name, email address, telephone number and other contact details.
Collection, billing and delivery addresses.
Details of rugs or other items you ask us to assess, collect, clean, restore, value, store, sell or deliver.
Photographs and information you provide in relation to an enquiry or service request.
Purchase, quotation, order, payment and service history.
Account information, where an account is available.
Communications with us, including emails, telephone calls, messages and customer-service enquiries.
Website usage information, including IP address, browser type, device information, pages visited and cookie data.

3. How We Use Your Information

We may use your personal information to:

Respond to enquiries and prepare quotations.
Arrange collection, delivery, cleaning, restoration, valuation, storage or other requested services.
Process and fulfil orders and take payment.
Communicate with you about bookings, orders, collections, deliveries and account matters.
Provide customer support and resolve issues.
Maintain business, accounting and service records.
Improve our website, services and customer experience.
Protect our business, customers and website against fraud, misuse or security incidents.
Send marketing communications where you have consented, or where otherwise permitted by law.

4. Legal Basis for Processing

We process personal data using one or more of the following legal bases:

Contractual necessity — where processing is needed to provide a quotation, fulfil an order or deliver a service you have requested.
Legal obligation — where we are required to retain or disclose information under applicable law.
Legitimate interests — where necessary to operate, protect and improve our business, provided that your rights and interests do not override those interests.
Consent — for marketing communications and non-essential cookies, where consent is required.

5. Sharing Your Information

We do not sell your personal data.

We may share your information with trusted third parties where necessary to provide our services, including:

Payment processors.
Collection, delivery and logistics providers.
Specialist cleaning, restoration, storage or valuation partners where relevant to your requested service.
Website-hosting, email, technical-support and analytics providers.
Professional advisers, insurers, regulators or authorities where legally required or necessary to protect our legal rights.

We require third parties acting on our behalf to handle personal data securely and in accordance with applicable data-protection law.

6. International Transfers

Some of our service providers may process personal data outside the United Kingdom. Where this occurs, we will take appropriate steps to ensure your information receives a level of protection consistent with UK data-protection law.

7. Your Rights

Under UK GDPR, you may have the right to:

Request access to the personal data we hold about you.
Request correction of inaccurate or incomplete data.
Request deletion of your personal data where applicable.
Request that we restrict certain processing.
Object to processing based on legitimate interests, including direct marketing.
Withdraw consent at any time where processing is based on consent.
Request that certain data be provided to you or another organisation in a portable format.
Complain to the Information Commissioner’s Office (ICO).

To exercise your rights, please contact us at hello@thehandmaderug.com.

8. Data Security

We use appropriate technical and organisational measures to protect your personal information from unauthorised access, loss, misuse, alteration or disclosure. However, no method of internet transmission or electronic storage is completely secure.

9. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including providing services, resolving enquiries, maintaining business records and meeting legal, accounting or regulatory requirements.

Where we no longer need your information, we will securely delete or anonymise it.

10. Marketing

You may opt out of marketing communications at any time by using the unsubscribe link in an email or by contacting us at hello@thehandmaderug.com.

Please note that opting out of marketing will not stop essential service communications, such as updates about an existing booking, order or collection.

11. Cookies

Our website uses cookies and similar technologies to improve your experience, understand website performance and support our marketing activity. You can manage your cookie preferences through your browser settings or cookie-preference tools available on the website.

For more information, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.

13. Contact

If you have questions about this Privacy Policy or how we handle your personal information, please contact:

The Guild of Oriental Rugs Limited, trading as The Handmade Rug Co
14 Oliver Business Park
London
England
NW10 7JB
United Kingdom

Email: hello@thehandmaderug.com