Privacy policy
Updated 2 October 2026
This Privacy Notice explains how Harbour Outdoor Living Limited uses personal information about customers, prospective customers, website and account users, showroom and site visitors, callers, delivery and installation recipients, warranty and repair contacts, competition entrants, business contacts and job applicants.
We aim to be clear about what we collect, why we use it, who we share it with and how long we keep it. We also use shorter, just-in-time privacy information where a particular activity needs additional explanation.
At checkout, this Privacy Notice explains how personal information used to create, verify, fulfil and support your Order is handled. It operates alongside our Terms & Conditions of Sale, Delivery & Installation Policy, Product Guarantee information, Website Terms of Use and Cookie & Tracking Notice. Accepting the Terms & Conditions of Sale is not treated as consent to optional marketing or optional tracking technologies.
1. Who we are
Harbour Outdoor Living Limited ('Harbour', 'we', 'us' or 'our') is the controller of personal information covered by this Notice unless we tell you that another organisation is acting as a separate controller.
Harbour Outdoor Living Limited is registered in England and Wales under company number 12934430. Our registered office and principal trading address is The Foaling Yard, Hope Hall Farm, Dullingham, CB8 9UW, United Kingdom.
Privacy enquiries and requests may be sent to customerservices@harbourlifestyle.co.uk, by telephone on +44 3308 081744, or by post to the address above.
2. Who this Notice covers
This Notice covers personal information we use in connection with our websites, customer accounts, showroom, orders, payments, customer service, marketing, delivery, installation, warranty and repair services, competitions, recruitment and business relationships.
Our products and consumer ordering services are intended for adults. We do not knowingly accept consumer Orders from anyone under 18. If we introduce age-restricted products, additional age or identity checks may apply.
3. The information we collect
Depending on how you interact with us, we may collect:
- identity and contact information, such as your name, postal and delivery address, email address and telephone number;
- account, order and transaction information, including products, swatches, order history, payment status and references, refunds, promotions and finance-related transaction information. We do not intend to collect or retain full payment-card details ourselves;
- customer-service information, including emails, live chat, social-media messages, WhatsApp messages, call notes, complaints, returns, fault reports and other correspondence;
- telephone-call recordings and related metadata. We record inbound and outbound customer-service calls and provide a notice to callers;
- information supplied during live video calls. Video calls used for sales or diagnosis are not recorded by Harbour;
- delivery and installation information, including access instructions, gate codes or other site notes, delivery coordinates, vehicle/location data associated with a job, signatures, proof-of-delivery images and information needed to plan or complete an installation;
- photographs, videos and descriptions supplied by you or created by our delivery, installation, inspection, repair or customer-service teams to plan work, record condition, diagnose a fault, evidence attendance or completion, or investigate a complaint;
- product, warranty and repair information, including serial/batch details where relevant, fault history, engineer notes, parts used, remedies and sign-off;
- website, device and online activity information, including IP address, device/browser information, cookie or similar identifiers, referral/affiliate information and interaction data where applicable;
- marketing and preference information, such as subscriptions, campaign engagement and communication preferences;
- CCTV images of our showroom, offices and grounds. Continuous CCTV audio is not used as a routine surveillance measure; if audio recording is introduced for a specific purpose, we will assess necessity and proportionality and provide appropriate notice.
- recruitment information, including CVs, contact details, employment and education history, interview notes, right-to-work information and other information relevant to an application;
- competition or giveaway entry and administration information; and
- information you choose to provide about additional support needs. This can sometimes include health, disability or other sensitive information. We seek to use only what is necessary to provide the support or deal with the matter.
4. Where we get information from
We usually obtain personal information directly from you, including through our website, Shopify account and checkout, web forms, showroom, telephone, email, live chat, social messaging, WhatsApp, video calls and information or media you provide for delivery, installation, returns or fault diagnosis.
We may also receive information from people acting for you; payment, finance and fraud-screening providers; marketplace or retail partners through which you purchase our products; delivery and installation partners; repairers and engineers; review platforms; affiliate and advertising partners; recruitment agencies; and our technology providers and integrated business systems.
Where another person places an Order or arranges a service for you, we may receive your contact and delivery information from them. Where required, we provide privacy information at the appropriate time.
5. Why we use personal information and our lawful bases
| Activity | Why we use it | Main lawful basis |
|---|---|---|
| Accounts, enquiries, swatches and Orders | Create/manage accounts; respond to enquiries; provide samples; process and fulfil Orders. | Contract or steps at your request; legitimate interests in operating customer services. |
| Payments, refunds and finance | Take payment, issue refunds, provide payment links and facilitate third-party finance/payment options. | Contract; legal obligations; legitimate interests in secure payment and fraud prevention. |
| Customer service, returns, faults and complaints | Answer questions, manage changes/returns, diagnose faults, resolve complaints and keep an appropriate service history. | Contract; legal obligations, including consumer-law obligations; legitimate interests in effective service and dispute resolution. |
| Recorded telephone calls | Provide evidence of what was discussed; monitor quality; train staff; investigate complaints and improve service. | Legitimate interests in quality, training, service improvement and dispute resolution; contract support where relevant. |
| AI-assisted customer service and quality analysis | Assist or summarise customer communications, use account/order context, identify service issues and flag cases for human review. | Legitimate interests in efficient, consistent and high-quality service, subject to appropriate safeguards and minimisation. |
| Delivery and installation | Plan routes and access, communicate with you, perform delivery/installation, record attendance/condition/completion and resolve operational issues. | Contract; legitimate interests in safe and efficient operations and evidence. |
| Warranty, repairs and product safety | Assess faults; administer statutory rights and guarantees; arrange inspection/repair; maintain claim/service history; investigate safety issues. | Contract; legal obligations; legitimate interests in warranty administration, safety and legal claims. |
| Marketing | Send marketing where you have opted in or another lawful electronic-marketing basis applies; measure campaign performance. | Consent where required; legitimate interests for limited marketing administration and measurement where lawful. |
| Advertising, analytics and affiliates | Measure traffic/referrals and advertising performance and, where enabled lawfully, provide relevant advertising. | Consent where required for cookies/similar technologies; legitimate interests for limited administration not requiring consent. |
| Reviews | Invite and verify reviews and manage review-related customer interactions. | Legitimate interests in obtaining genuine customer feedback and protecting review integrity. |
| CCTV | Protect people and property; deter/investigate incidents; support safety and security. | Legitimate interests in security and safety. |
| Fraud and misuse | Protect customers and Harbour from payment, returns, promotional or claims abuse and investigate credible concerns. | Legitimate interests in preventing and establishing fraud or misuse; legal claims and obligations where applicable. |
| Recruitment | Receive applications, assess candidates, conduct recruitment and comply with employment/right-to-work requirements. | Steps before a contract; legal obligations; legitimate interests in recruitment; an appropriate condition for special-category data where required. |
| Competitions | Administer entries, select/contact winners and meet associated legal/accounting requirements. | Contract or legitimate interests; separate consent where competition data is also used for marketing. |
| Legal, regulatory and business administration | Keep required records, respond to rights requests, establish or defend claims, comply with regulators and manage business operations. | Legal obligations; legitimate interests; establishment/exercise/defence of legal claims where applicable. |
Where we rely on legitimate interests, those interests include operating and improving our business and customer service, protecting people, property and systems, preventing misuse, keeping appropriate evidence, administering warranties and resolving disputes. We consider the impact on individuals and do not rely on legitimate interests where their rights and interests override ours.
Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that was lawful before withdrawal.
6. AI and automated processing
We use AI-enabled tools in customer service and quality management. Depending on the workflow, these tools may analyse customer communications together with relevant account, order and service history held in systems such as our customer-service, ecommerce and business-management platforms. We use this to assist responses, summarise information, identify possible service failures and escalate cases for human attention.
Our current quality-analysis model is designed to flag matters for human review rather than make solely automated decisions about customers with legal or similarly significant effects. If we introduce materially different automated decision-making or profiling, we will assess the privacy impact and provide additional information where required.
We require appropriate contractual, security and data-protection arrangements with AI providers and seek to limit access and retention to what is necessary for the relevant purpose.
7. Marketing, advertising, reviews and communications
We currently use email marketing and only send promotional email to people who have the appropriate marketing permission. You can unsubscribe using the link in a marketing email or by contacting us. We do not currently send promotional SMS messages, but may introduce them in future only after implementing the required permission, transparency and opt-out controls.
We use online advertising, analytics and affiliate arrangements. Some of these activities use cookies, pixels or similar technologies and are described in our Cookie & Tracking Notice. We currently use advertising channels including Google and Meta/Facebook and affiliate referrals. We do not currently use customer-list audience matching as a standard activity; if we introduce a materially new use of customer data for audience matching or profiling, we will complete the appropriate privacy review and update our information before starting.
We may use review platforms such as Trustpilot, Google and Yotpo to request, verify or manage customer reviews. Those providers may also act as separate controllers for aspects of their services and provide their own privacy information.
Operational communications about an Order, Delivery, Installation, fault or service are not marketing and may continue even if you have opted out of promotional marketing.
8. Delivery, installation, images, video and location information
To provide delivery and installation services, we may share the information reasonably required with our own teams and with delivery, carrier, installation and field-service partners. This can include your name, address, telephone number, email address, order/product information, access instructions and relevant site notes.
Our systems and those of delivery partners may record route and vehicle location, delivery coordinates, timestamps, signatures and proof-of-delivery images. We and our installers may take before/after or issue-specific photographs or video of the product, installation area or relevant property features. You may also be asked to provide site photographs or video before a visit.
These records may be used to perform the service, plan access, establish condition or attendance, investigate property or product damage, resolve disputes and support safety. We do not use customer-supplied fault or site evidence as advertising material merely because you supplied it for customer-service purposes.
If we introduce body-worn video for field teams, it will only be used following an appropriate privacy impact assessment, with proportionate operating controls and clear notice to affected people.
9. Warranty, repairs and third-party cover
When you report a fault, we may collect your order and contact details, a description of the issue and desired resolution, photographs or video, product information and later engineer/repair notes. We may use live, unrecorded video calls to help diagnose an issue.
We may share relevant customer and case information with installers, engineers and repair partners where they need it to inspect or resolve the matter. We may provide manufacturers or suppliers with technical product/fault information without identifying the customer where customer identity is not required.
Where a separate warranty, protection or service product is provided or administered by another organisation, such as Loxacover, we may provide the information required to establish that service when the qualifying purchase is made. The third-party provider may then act as a separate controller and apply its own privacy notice when dealing directly with you.
10. Who we share information with
We share personal information only where reasonably necessary for the purposes described in this Notice. Recipients can include:
- ecommerce, hosting, customer-service, communications, AI, analytics and other technology providers;
- payment, finance, fraud-screening and banking providers;
- delivery carriers, our field teams, installation contractors, engineers and repairers;
- warranty, protection and service providers;
- review, marketing, advertising and affiliate providers;
- retail, marketplace or commercial partners where they are involved in your Order or service;
- professional advisers, insurers, auditors and service providers supporting our business;
- police, regulators, courts, government bodies or other authorities where required or appropriate by law; and
- a buyer, investor, lender or adviser in connection with a genuine corporate transaction, subject to appropriate confidentiality and data-protection safeguards.
Some providers process information on our instructions as processors. Others, such as certain payment, finance, review, marketplace or warranty providers, may act as separate controllers for their own services. We do not sell personal information to advertisers.
11. International transfers
Some of our technology, communications, payment, marketing and other service providers operate internationally, so personal information may be processed outside the United Kingdom and, where relevant, outside the European Economic Area.
Where data-protection law requires safeguards for an international transfer, we use an applicable adequacy arrangement or appropriate contractual and supplementary safeguards, such as the UK International Data Transfer Agreement or UK Addendum and, for EU GDPR transfers where applicable, approved EU Standard Contractual Clauses. You may contact us for more information about the safeguards used for a particular transfer.
If Harbour actively targets customers in the European Union or another jurisdiction with additional data-protection requirements, we will assess and implement the additional transparency, representative and transfer requirements that apply.
12. How long we keep information
We do not keep all information for the same period. We use a retention schedule based on the purpose of the record, legal and accounting requirements, warranty or guarantee commitments, the need to resolve disputes and the sensitivity and volume of the information.
| Record type | Typical approach |
|---|---|
| Core Order, invoice and accounting records | Normally 7 years. |
| General customer-service correspondence and history | Normally 10 years from the last substantive interaction. We may retain relevant history longer where needed for a continuing or lifetime guarantee, active claim, product-safety matter or legal hold. |
| Core warranty/guarantee entitlement and material claim/service history | For the warranty or guarantee period and, where appropriate, an additional period for legal claims. For lifetime guarantees, core entitlement and relevant service history may therefore be retained for a very long period. |
| Routine diagnostic photos/videos and installation/site media | Normally reviewed for deletion sooner than core warranty history; routine closed-case diagnostic media may be retained for around 3 years unless still needed. |
| Telephone recordings | Normally around 12 months. A relevant recording may be preserved with a complaint, dispute or legal case where necessary. |
| Routine delivery/POD/GPS evidence | Normally around 18 months, unless relevant to a continuing case. |
| CCTV | Normally around 30 days for unflagged footage. Relevant incident footage may be retained with the incident/case. |
| Marketing information | Until you unsubscribe or withdraw permission, subject to periodic inactivity review. We retain minimal suppression information where needed to respect an opt-out. |
| Unsuccessful job applications | Normally around 6 months after the recruitment process unless you agree to longer talent-pool retention. |
| Data-protection rights requests | Normally around 3 years after closure as evidence of how the request was handled. |
Where a legal hold applies, normal deletion may be suspended for information reasonably required for an active complaint, warranty or safety matter, chargeback, fraud investigation, litigation, regulatory enquiry or other legal obligation. When the reason for the hold ends, the normal retention rules resume.
Long warranties do not mean that every recording, image or piece of correspondence is kept indefinitely. We aim to preserve the core information needed to establish entitlement and service history while deleting transient or excessive evidence when it is no longer necessary.
13. CCTV and surveillance
CCTV is used at our showroom, offices and grounds for security, safety and incident investigation.
Continuous audio is not used as a routine CCTV surveillance measure. Any future use of audio would require a specific necessity and proportionality assessment and appropriate notice.
Footage may be disclosed where reasonably necessary to investigate an incident, establish or defend a legal claim, comply with law or assist law-enforcement or regulatory authorities.
14. Job applicants
If you apply to work for Harbour, we use the information in your application and recruitment process to assess suitability, communicate with you, arrange interviews, make recruitment decisions and comply with legal obligations. We may obtain information from recruitment agencies, referees or other sources you identify or where lawful.
If your application is unsuccessful, we normally keep the recruitment record for around six months unless a longer period is necessary for a legal matter or you agree to us keeping it for future opportunities. If you join Harbour, relevant recruitment information becomes part of the employment record and is governed by the applicable employee privacy arrangements and retention requirements.
15. Your data-protection rights
Depending on the circumstances and the law that applies, you may have rights to:
- ask for access to your personal information and information about how we use it;
- ask us to correct inaccurate or incomplete information;
- ask us to erase information in circumstances where we no longer have a lawful reason to keep it;
- ask us to restrict processing in certain circumstances;
- object to processing based on legitimate interests. We will consider your objection and stop unless we have an overriding lawful reason to continue;
- object at any time to the use of your personal information for direct marketing. This right is absolute;
- receive certain information you provided to us in a portable format where the right to data portability applies;
- withdraw consent at any time where processing is based on consent; and
- raise concerns about applicable automated decision-making and, where the law provides, obtain human intervention and challenge a decision.
These rights are not all absolute and can depend on the lawful basis and circumstances. We may need to verify your identity before responding. We will not normally charge a fee, although the law allows limited exceptions.
To exercise a right, contact us using the details in section 1.
16. Complaints
Please contact us first if you have a privacy concern so that we can investigate it.
In the United Kingdom, you also have the right to complain to the Information Commissioner's Office (ICO). The ICO's contact information is available on its official website.
If EU GDPR applies to your processing, you may also have the right to complain to the relevant European supervisory authority.
17. Cookies and similar technologies
Our website uses cookies and similar technologies for functions such as website operation, analytics, affiliate attribution and advertising.
Our separate Cookie & Tracking Notice explains the categories of storage and access technologies we use, their purposes and the choices available to you. Where consent is required, optional technologies are not activated until the required choice has been obtained.
18. Security
We use organisational and technical measures designed to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
No system is completely secure. Where a personal-data breach occurs, we will investigate it and notify affected individuals and/or regulators where the law requires.
19. Changes to this Notice
We review this Notice as our services, technology and legal obligations change. We will publish the current version with an update date. If we plan a materially new or unexpected use of personal information, we will update our privacy information and bring the change to affected people before starting the new processing where required.
