Privacy Policy - Go Bespoke

Effective date: 8 October 2026
Last updated: 10 October 2026

This Privacy Policy explains how Go Bespoke (“Go Bespoke”, “we”, “us”, “our”) collects, uses, shares and protects personal information when you visit gobespoke.co.uk (the “Site”), watch our videos, contact us, commission a piece or buy from our shop. We are based in the United Kingdom but welcome visitors and customers from around the world, so this policy is written to meet the requirements of the UK GDPR and Data Protection Act 2018, the EU General Data Protection Regulation (EU GDPR), and other privacy laws that may apply to you, including US state privacy laws (such as the California Consumer Privacy Act as amended by the CPRA), Canada’s PIPEDA, Australia’s Privacy Act 1988 and Brazil’s LGPD.

1. Who we are and how to contact us

Go Bespoke is the data controller responsible for your personal information. If you have any questions about this policy or want to exercise your rights, please contact us:

Email: info@gobespoke.co.uk
Contact form: gobespoke.co.uk/contact
Post: Go Bespoke, 47 Ravenswood Road, London SW12 9PN, United Kingdom

2. Information we collect

We only collect the information we need. Depending on how you use the Site, this may include:

Contact and identity information: your name, email address, telephone number, and billing and delivery addresses.
Commission and order information: details of the pieces you enquire about or buy, design preferences, measurements, photos you choose to send us, order history and correspondence.
Payment information: payments are handled by our payment providers. We do not see or store your full card number; we receive only limited details such as a transaction reference, the payment status and the last four digits of your card.
Account information: if you create an account, your login details and saved addresses.
Marketing preferences: whether you have subscribed to our emails and your communication preferences.
Technical and usage information: your IP address, browser and device type, operating system, approximate location (country or city level), referring website, pages viewed, time spent on pages and similar information collected through cookies and similar technologies.

We do not knowingly collect special category (sensitive) personal data, and we ask that you do not send it to us.

3. How we collect information

Directly from you when you fill in a form, request a quote, place an order, create an account, subscribe to emails or contact us by email, phone or social media.
Automatically when you browse the Site, through cookies, pixels and server logs (see section 6).
From third parties such as payment providers (to confirm payment), delivery companies (to confirm delivery) and analytics or advertising partners (aggregated insights about how visitors find and use our Site).

4. How we use your information and our legal bases

If you are in the UK or the European Economic Area (EEA), we must have a legal basis for each use of your personal data. We rely on the following:

To respond to enquiries and provide quotes – to take steps at your request before entering a contract, and our legitimate interest in answering questions about our work.
To make, deliver and support your commission or order, including payment, delivery (including international shipping) and aftercare – performance of a contract.
To manage your account – performance of a contract.
To send service messages such as order confirmations, progress updates and delivery notifications – performance of a contract.
To keep business, tax and accounting records and to meet other legal requirements – legal obligation.
To answer questions through our website chat assistant – our legitimate interest in helping visitors with resin and furniture questions (see section 5a).
To prevent fraud, spam and misuse of the Site and keep it secure – our legitimate interests.
To understand how the Site is used and improve it – your consent where non-essential cookies are used, otherwise our legitimate interests.
To send marketing emails about new pieces, videos and offers – your consent, which you can withdraw at any time using the unsubscribe link in every email.
To show relevant advertising on other platforms and measure its effectiveness – your consent, given through our cookie banner.

Where we rely on legitimate interests, we have balanced those interests against your rights, and you can object at any time (see section 10). We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

5. Who we share information with

We do not sell your personal information for money. We share it only with trusted service providers who help us run our business, and only as much as they need. These include:

Website hosting and maintenance providers, including GoDaddy, which hosts the Site and measures its performance, and Bunny Fonts (BunnyWay), which delivers the Site’s fonts from European servers without using cookies.
E-commerce and payment providers, including WooCommerce, WooPayments (powered by Stripe) and PayPal, which process payments as independent controllers or on our behalf.
Delivery and courier companies, which need your name, address and contact details to deliver your order.
Email and form tools, such as MailPoet (for newsletters) and WPForms (for website forms).
Security and anti-spam services, such as Akismet and Jetpack (Automattic), which check form submissions and comments for spam and help protect the Site.
Analytics and advertising partners, such as Google (including Google Analytics, Google Ads and Google Merchant Center), Pinterest, TikTok, Snapchat and Reddit, where these tools are enabled and you have given consent.
YouTube (Google), when you choose to play an embedded video (see section 7).
Professional advisers such as accountants and lawyers, under a duty of confidentiality.
Authorities and others where required by law, to enforce our terms, or to protect our rights, property or safety and that of others.
A buyer or successor if our business is ever sold or reorganised, subject to this policy.

5a. Our website chat assistant

Our Site has an optional chat assistant that answers questions about resin, epoxy and our furniture. It is an automated AI assistant, not a person. It is powered by OpenAI through the AI Engine plugin: when you use it, the messages you type, and the content of the page you are viewing, are sent to OpenAI to generate a reply. OpenAI acts as our service provider, is based in the United States (see section 8 on international transfers), and under its API terms does not use this data to train its models by default. Your conversation is also saved in your own browser so it can continue as you move between pages; you can clear it at any time with the Clear button. Please do not share personal, sensitive or payment details in the chat. If you would like a quote, please use our contact form instead. Answers are general guidance only; always follow the manufacturer’s instructions and safety data sheet for any product you use.

6. Cookies and similar technologies

We use cookies, pixels and similar technologies to make the Site work, remember your preferences, understand how the Site is used and, with your consent, support advertising. Strictly necessary cookies (for example, those that keep items in your basket or your consent choices) are always used. Analytics and advertising cookies are only set if you agree to them through the cookie banner, and you can change your choice at any time using the “Cookie settings” link in the footer of every page. You can also block or delete cookies in your browser settings. For more detail, please see our Cookie Policy.

7. Embedded YouTube videos

Our pages include videos hosted on YouTube, including our own channel @go-bespoke. To protect your privacy, most videos only load from YouTube when you press play, and we use YouTube’s privacy-enhanced mode where possible. Once you play a video, YouTube (Google) may collect information such as your IP address and viewing activity and may set cookies, under Google’s Privacy Policy.

8. International transfers

Some of our service providers are based outside the UK and the EEA, including in the United States. When we transfer personal data internationally, we make sure it is protected by an appropriate safeguard, such as an adequacy decision (for example, the UK–US Data Bridge or the EU–US Data Privacy Framework for certified companies), the UK International Data Transfer Agreement or Addendum, or the European Commission’s Standard Contractual Clauses. If we deliver an order to you outside the UK, your delivery details will necessarily be shared with carriers and customs authorities in the destination country. You can contact us for more information about the safeguards we use.

9. How long we keep information

Orders, commissions and invoices: 6 years after the end of the financial year in which the transaction took place, to meet UK tax and accounting rules.
Enquiries that do not lead to an order: up to 2 years after our last contact.
Customer accounts: until you ask us to close your account, then as required for order records.
Marketing lists: until you unsubscribe; we then keep a minimal record so that we do not email you again.
Analytics data: in line with the retention settings of the relevant tool, typically 14 to 26 months.

When information is no longer needed, we delete it or anonymise it securely.

10. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

Access – to receive a copy of the personal information we hold about you.
Correction – to have inaccurate or incomplete information corrected.
Deletion – to ask us to delete your information, subject to legal exceptions.
Restriction – to ask us to limit how we use your information.
Objection – to object to processing based on legitimate interests, and to direct marketing at any time.
Portability – to receive information you gave us in a portable format, or have it sent to another organisation.
Withdraw consent – at any time, without affecting earlier processing.
Opt out of targeted advertising and of any “sale” or “sharing” of personal information for cross-context behavioural advertising, as defined by some US state laws.
Appeal – if we decline your request, you may ask us to reconsider it.

To exercise any of these rights, email info@gobespoke.co.uk. We may need to verify your identity before responding. We will reply within one month (UK and EEA), within 45 days (US states), or within any other period required by the law that applies to you. We do not charge a fee in most cases, and we will never treat you differently for exercising your rights.

Information for California and other US residents

In the last 12 months we have collected the categories of information described in section 2 (identifiers, commercial information, internet activity, approximate geolocation and inferences from browsing) from the sources in section 3, for the purposes in section 4. We do not sell personal information for money. Some advertising cookies and pixels may count as “selling” or “sharing” under certain state laws; you can opt out at any time by declining or changing your cookie preferences using the “Cookie settings” link in the footer of every page, or by contacting us. We also honour Global Privacy Control (GPC) browser signals as a valid opt-out. We do not knowingly sell or share the personal information of anyone under 16.

Information for Canada, Australia, Brazil and other countries

We handle personal information in line with the privacy principles of the laws that apply to you, including openness, purpose limitation, security, and your rights of access and correction. If you have a concern, please contact us first and we will try to resolve it.

11. How to complain

If you are unhappy with how we have handled your information, please contact us first so we can try to put things right. You also have the right to complain to a data protection authority:

United Kingdom: the Information Commissioner’s Office (ICO) – ico.org.uk/make-a-complaint, telephone 0303 123 1113.
European Economic Area: the data protection authority in the country where you live or work – a list is available from the European Data Protection Board.
Elsewhere: your local privacy regulator, such as the Office of the Australian Information Commissioner or the Office of the Privacy Commissioner of Canada.

12. Keeping your information secure

We use appropriate technical and organisational measures to protect your information, including encrypted (HTTPS) connections, secure payment processing by our payment providers, access controls and regular software updates. No method of sending or storing data online is completely secure, so we cannot guarantee absolute security, but we will notify you and the relevant authorities of a data breach where the law requires.

13. Children

The Site is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, please contact us and we will delete it.

14. Links to other websites

The Site links to other websites and platforms, such as YouTube and social media. Those sites have their own privacy policies, and we are not responsible for how they handle your information.

15. Changes to this policy

We may update this policy from time to time, for example when we add new features or the law changes. The latest version will always be on this page with the date it was last updated. If we make significant changes, we will make that clear on the Site or contact you where appropriate.

Questions? Email info@gobespoke.co.uk and we’ll be happy to help.