Website Privacy Notice
Who we are
Crystal Galleries Limited, 1 Letitia Street, Middlesbrough TS1 4BE, United Kingdom ("we", "us") operates this website and is the data controller for the personal data described here. Questions about this notice: sales@crystalgalleries.co.uk or +44 (0)1642 225 799.
What this website does
This is a trade website. Approved trade customers can sign in, browse account-specific pricing, build a cart, place orders and request quotes against their trade account. We do not take card or other payment details on this website — orders are placed to your trade account and invoiced under your agreed terms.
The data we collect and why
- Trade accounts and sign-in: your name, business email, company details and a securely hashed password (or your account code sign-in). Used to operate your account, show your pricing and process your orders. Legal basis: contract.
- Orders, quotes and carts: what you order or save, delivery addresses, and order history synced with our internal systems. Legal basis: contract.
- Contact and enquiry forms: the details you submit so we can respond. Legal basis: legitimate interest (answering you).
- Product assistant (chat): messages you type to the on-site assistant are processed for us by Anthropic (Claude) to generate replies. Don't include sensitive personal information in chat. Legal basis: legitimate interest. Anthropic's own privacy notice is at anthropic.com/legal/privacy.
- Stock alerts: if you ask to be emailed when an item is back in stock, we store that request against your account and email you once. These are service messages.
- Marketing email: we email trade contacts who have not opted out of marketing. Every marketing email carries a one-click unsubscribe, honoured immediately and permanently. We measure opens and clicks on our own systems to understand what's useful. Legal basis: legitimate interest for existing trade relationships (soft opt-in) / consent where required.
- Site analytics: we run our own first-party measurement. When you are signed in to a trade account, we link your activity on the site to that account so we can support you and improve our service. It sets no advertising or third-party tracking cookies; visits are counted using an anonymised identifier that changes daily, and full IP addresses are not kept in analytics records.
- Cookies: only what the site needs to work — a session cookie (sign-in, cart) and a CSRF token. No third-party advertising cookies.
Who processes data for us
- Amazon Web Services — hosting (London, UK region), email delivery (SES), and file/image storage and delivery (S3 and CloudFront).
- Anthropic — the on-site product assistant, as above.
- Carriers (DPD, DHL, Royal Mail, InPost and others) — delivery details for despatched orders, and tracking status shown in your account.
We do not sell personal data, and we do not share it with advertisers.
Embedded content
Videos are embedded in privacy-enhanced mode and load nothing from the provider until you press play. Maps are provided by OpenStreetMap.
How long we keep things
Account and order records are kept for as long as you hold a trade account with us and afterwards as required for tax and accounting law (typically six years). Contact-form enquiries are kept for up to 24 months. Unsubscribes are kept permanently so we never email you again by mistake.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, object to or restrict processing, and ask for it in a portable format. Email sales@crystalgalleries.co.uk and we'll respond within one month. You can complain to the Information Commissioner's Office (ico.org.uk) at any time.
Changes
We'll update this notice when the website's behaviour changes, and show the date of the latest revision here. Last updated: 13 September 2026.