Privacy Policy

1. Who we are

SHOMONO LTD is the data controller for the personal data described in this policy. We sell garden furniture and outdoor storage online to private customers in the United Kingdom.

• Legal name: SHOMONO LTD
• Company number: 17195284
• Registered address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
• Email for privacy questions: ceo@shomono.uk
• Telephone: +44 20 7946 0958
• Website: shomono.uk

We process personal data in line with the UK GDPR and the Data Protection Act 2018.

2. Data we collect

Order and contact details

To fulfil an order we need your name, email address, telephone number and delivery address. Where the delivery address differs from the billing address, both are recorded. For bulky items such as dining sets, timber stores and sheds, we may also record access notes you give us — for example gate widths, parking restrictions, steps or the presence of a side passage — so that the carrier can complete the delivery.

Order history

We keep the contents of your order, the price paid, delivery arrangements, and any correspondence about returns, warranty claims or after-sales support.

Payment data

Card and other payment details are collected and processed by our payment provider. They are not stored on this website and we do not have access to full card numbers. We receive only the outcome of the transaction and a reference for reconciliation.

Correspondence

If you email or telephone us, we keep the message, your contact details and our reply so that we can answer and, if needed, refer back to the conversation.

Technical data

Our hosting provider records standard server logs, which may include IP address, browser type, referring page and the time of the request.

Data we do not collect

We do not collect special category data — such as data about health, ethnicity, religion, political opinions, trade union membership, sex life or sexual orientation — and we do not ask you to provide it. Please do not include such information in messages to us.

3. Purposes and legal bases

• Performance of a contract. Processing your order, arranging delivery, handling assembly queries, returns, refunds and warranty claims. Without these details we cannot supply the goods.
• Legal obligation. Keeping accounting and tax records, and meeting our obligations to consumers under the Consumer Contracts Regulations 2013 and the Consumer Rights Act 2015.
• Legitimate interests. Answering enquiries, keeping records of correspondence, preventing fraudulent orders, and maintaining the security and integrity of the website. We balance these interests against your rights and freedoms.
• Consent. Any optional communications you opt into, and any non-essential cookies, where consent is the basis. Consent can be withdrawn at any time.

4. Sharing with third parties

We share personal data only where it is needed for the purposes above, and only with the following categories of recipient:

• Couriers and pallet carriers. Your name, delivery address, telephone number and any access notes are passed to the carrier handling your consignment. For bulky items this is required so that the driver can contact you and plan the drop.
• Payment providers. Payment data is processed directly by the provider under its own privacy terms.
• Suppliers and manufacturers. Where an item is dispatched directly from a manufacturer, or where a warranty claim is raised, the details needed to complete the delivery or the claim are shared with them.
• IT and hosting providers. Website hosting, email and order administration systems, acting as processors on our instructions.
• Professional advisers and public authorities. Accountants, insurers and legal advisers, or authorities where disclosure is required by law.

We do not sell personal data and we do not share it with third parties for their own marketing purposes.

5. International transfers

Our processing normally takes place in the United Kingdom or the European Economic Area. If a provider processes data outside the UK, we make sure the transfer is covered by an appropriate safeguard — UK adequacy regulations for the destination country, the International Data Transfer Agreement, or the UK Addendum to the European Commission's standard contractual clauses — together with any additional measures needed. You can ask us for details of the safeguard used for a particular transfer.

6. How long we keep data

• Order and transaction records: six years from the end of the financial year in which the order was completed, to meet accounting and tax requirements.
• Delivery and access notes: deleted once the order is complete and the return period and any warranty claim has been resolved.
• Correspondence: normally up to two years from the last message, unless it relates to an order, a claim or a dispute, in which case it is kept with the order record.
• Server logs: short retention periods set by our hosting provider, typically measured in weeks.

When a retention period ends, data is deleted or anonymised.

7. Security

The website is served over an encrypted connection. Access to order data is limited to the people who need it to run the business, and is protected by individual accounts and authentication. Our providers are chosen on the basis of the security measures they offer and are bound by written processing terms. No transmission over the internet can be guaranteed to be completely secure, but we take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access.

8. Cookies

This website uses only cookies and similar technologies that are strictly necessary to make the site work and to keep it secure. We do not use advertising cookies, cross-site trackers or analytics profiling on this site, and we do not store any data about you in your browser's local storage. Strictly necessary cookies do not require consent. If we introduce optional cookies in future, we will ask for consent before they are set and update this section.

You can block or delete cookies through your browser settings. Blocking strictly necessary cookies may stop parts of the site working.

9. Your rights

Under the UK GDPR you have the right to:

• Access — obtain confirmation of whether we process your data and receive a copy of it.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — ask us to delete data, where we have no overriding obligation or legitimate ground to keep it.
• Restriction — ask us to limit processing while a query about accuracy or lawfulness is resolved.
• Portability — receive data you provided to us in a structured, commonly used, machine-readable format, or have it sent to another controller.
• Objection — object to processing based on our legitimate interests, and object at any time to direct marketing.
• Withdraw consent — where processing is based on consent.

To exercise any of these rights, email ceo@shomono.uk. We respond within one month, and will tell you if the request is complex and that period needs to be extended. We may ask for information to confirm your identity before acting on a request.

10. Withdrawing consent

Where we rely on your consent, you can withdraw it at any time by emailing ceo@shomono.uk or by using the unsubscribe link in any message we send on that basis. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal, and it does not affect processing that rests on another legal basis — for example the records we must keep about a completed order.

11. Complaints to the ICO

If you are not satisfied with how we handle your personal data, please contact us first so that we can put things right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, helpline 0303 123 1113, ico.org.uk.

12. Age restriction

This website is intended for adults. We do not knowingly sell to, or collect personal data from, anyone under 18. If you believe a child has provided us with personal data, contact ceo@shomono.uk and we will delete it.

13. Changes to this policy

We review this policy when our processing changes and at least once a year. The current version always appears on this page, and the date below shows when it was last revised. Where a change materially affects how we use your data, we will bring it to your attention.

Last updated: 10 September 2026