Privacy Policy

At VeltHaven, we design and build premium garden buildings and garages — and we treat your personal information with the same care we put into our work. This policy explains, in plain English, what information we collect, why we collect it, how we look after it, and the rights you have over it.

This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) as amended by the Data (Use and Access) Act 2025, the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

VeltHaven Ltd is the "data controller" responsible for your personal information. That means we decide how and why your data is used.

• Company: VeltHaven Ltd
• Registered in England & Wales, company number: 17261887
• Registered office: Office 19313, 182–184 High Street North, East Ham, London, E6 2JA, United Kingdom
• Email (data protection enquiries): [email protected]

If you have any questions about this policy or about how we handle your data, please email us at [email protected] and we will be glad to help.

2. The information we collect

We only collect what we need to answer your enquiry, prepare your quote, fulfil your order, and run our business responsibly. Depending on how you interact with us, this may include:

Information you give us

• Your name, email address, telephone number and postal address
• Your delivery/installation site address and postcode
• Details about your project — the building you are interested in, your configuration choices, site photographs you send us, and any requirements you tell us about
• Order and payment reference information (see section 6 for how payments are handled)
• Any messages, enquiries or feedback you send us, including via our contact forms, quote requests, live chat, social media messages, SMS or telephone
• Recordings and transcripts of your telephone calls with us, and transcripts of your live-chat and social media conversations — including those handled by our AI assistant. We also keep a record of SMS messages you send us or that we send you (see section 10)

Information we collect automatically when you use our website

• Your IP address, browser type, device information and approximate location
• Pages you visit, links you click, and how you move through the site
• Cookie and similar-technology data (see our separate Cookie Policy for full detail)

Information from third parties

• Analytics and advertising platforms may provide aggregated or pseudonymised information about how visitors find and use our website (see section 6)

We do not intentionally collect special category data (such as health or ethnicity), and our products and website are intended for adults — we do not knowingly collect data from anyone under 18.

Do you have to provide your information? When you ask us for a quote or place an order, providing your contact and site details is necessary for us to take those steps and to perform our contract with you — without them we cannot prepare a quote, deliver, or install your building. Providing information for marketing is always optional and never a condition of buying from us.

3. How and why we use your information

4. Our lawful bases for using your data

Under UK data protection law, we must have a valid reason ("lawful basis") for using your personal data. We rely on the following:

• Contract — where we need your data to take steps before entering a contract (such as preparing a quote) or to perform our contract with you (such as fulfilling and installing your order).
• Consent — where you have given us clear permission, for example to send you marketing emails or to set non-essential cookies. You can withdraw consent at any time.
• Legal obligation — where we must process data to comply with the law, such as keeping accounting and tax records.
• Legitimate interests — where we use your data in ways you would reasonably expect and which do not override your rights, such as securing our website, preventing fraud, recording and transcribing our calls so we hold an accurate record of what was discussed, and improving our products and services. Where we rely on legitimate interests, we have weighed them against your interests. You can ask us about this balancing at any time.

Where the Data (Use and Access) Act 2025 recognises a specific legitimate interest (for example, preventing crime or responding to emergencies), we may rely on that basis where it applies.

Automated decisions and profiling. Two parts of our service run automatically: our online configurator, which builds an instant price estimate from the options you choose, and our AI assistant, which answers calls, live chat and social media messages and can take your details or book a callback.

Neither produces a legal effect for you, and neither makes a decision of similar significance. Your order is formed only when you choose to proceed and pay, the price is fixed by our published price list rather than by anything the assistant decides, and a person at VeltHaven reviews every order before manufacture begins. On that basis we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, within the meaning of the automated decision-making provisions of the Data (Use and Access) Act 2025.

If you ever believe an automated step has significantly affected you, you have the right to be given information about it, to make representations, to obtain human intervention on our part, and to contest it. Email [email protected] and a person — not the assistant — will deal with it.

We and our analytics providers may use cookies and similar technologies to understand how our site is used (a form of profiling); this is based on your consent and you can change it at any time through our Cookie Policy. We do not currently set any advertising cookies.

5. Marketing communications

We will send you marketing emails about our products where at least one of the following applies, and only where you have not asked us to stop:

• You have opted in to marketing communications;
• You are an existing customer, and we are telling you about products similar to what you bought (the "soft opt-in" permitted under PECR); or
• You have contacted us about a specific product — for example, requesting a price guide, a callback, or starting a design in our configurator — and we are telling you about products similar to the one you enquired about. This is also a "soft opt-in" under PECR regulation 22, which permits marketing arising from a sale or from negotiations for a sale, where a means to refuse marketing was offered both when your details were collected and in every message we send.

Every marketing email includes a one-click unsubscribe link. You can also email [email protected] at any time to opt out. Opting out of marketing will not affect service messages we need to send you about an order you have placed.

6. Who we share your information with

We do not sell your personal data. We share it only with trusted service providers ("processors") who help us run our business, and only to the extent they need it. These currently include:

• Website hosting & security — OVH, which hosts our website. We may also use a content-delivery and security network to keep the site fast and protected.
• Customer relationship management (CRM), forms, live chat, SMS, telephony & email — GoHighLevel, which we use to manage enquiries, leads, order communications and marketing. GoHighLevel also provides the AI assistant that answers our calls and chats, and the recording and transcription of those conversations. To deliver those features GoHighLevel engages specialist AI sub-processors; it states that it does not use customer data to train generalised, public AI models.
• Website analytics — Google Analytics (Google), to understand how our website is used.
• Website behaviour insights — Microsoft Clarity (Microsoft), to see how visitors use our pages so we can improve them.
• Payments — Revolut, which processes our online card and deposit payments on our behalf. Balance payments are made by bank transfer to our UK business bank account; banks handle those payments as independent controllers under their own legal and regulatory duties, not as our processors.

We may also share your data with professional advisers (such as accountants or lawyers), with our installation and delivery partners where needed to complete your order, and with public authorities where we are legally required to do so. If our business is ever sold or reorganised, your data may be transferred as part of that transaction, subject to this policy.

Each processor is bound by a contract requiring them to keep your data secure and use it only as we instruct.

7. International data transfers

Some of our service providers (including Google, Microsoft and GoHighLevel) are based outside the United Kingdom, principally in the United States. GoHighLevel is headquartered in the United States and may process data in the United States and in India — including through the AI sub-processors behind our AI assistant, call recording and transcription. Where your data is transferred outside the UK, we make sure it is protected by an appropriate safeguard recognised under UK law — such as UK "adequacy" regulations, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses.

You can ask us for more information about these safeguards by emailing [email protected].

8. How long we keep your information

We keep your data only for as long as we need it:

• Enquiries and quotes that don't become orders — up to 24 months, then deleted or anonymised.
• Saved designs — if you save a configurator design so you can return to it, we store that design and your email address for up to 90 days, after which they are automatically deleted.
• Customer order records — for the duration of your warranty plus a reasonable period afterwards, to handle any claims.
• Accounting and tax records — at least 6 years, as required by HMRC.
• Call recordings — 12 months from the date of the call, then deleted. Where a call relates to an order you have placed, we keep the recording with your order record instead, so we hold an accurate record of what was agreed.
• Live-chat and social media transcripts, and SMS message logs — 24 months, or for as long as we keep your order record where the conversation relates to an order.
• Marketing data — until you unsubscribe or withdraw consent, after which we suppress your details so we don't contact you again.

When we no longer need your data, we securely delete or anonymise it.

9. How we keep your information secure

We use appropriate technical and organisational measures to protect your data, including secure hosting, encryption in transit (HTTPS), access controls, and limiting access to staff and partners who need it. While no online service can be guaranteed to be 100% secure, we take our responsibility to protect your information seriously.

10. Calls, live chat and our AI assistant

We think you should always know who — or what — you are talking to.

We record our calls. Calls to and from VeltHaven are recorded and transcribed. We tell you at the start of the call, and this section is your standing notice. We do it so we hold an accurate record of what was discussed and agreed, so we can resolve questions and complaints fairly, and so we can check and improve the quality of the answers we give. Our lawful basis is our legitimate interests in accurate record-keeping and service quality and, where the call concerns an order, performance of our contract with you.

You can ask us not to record. If you would rather your call was not recorded, say so at the start. We can't switch the recording off on that line, but one of our founders can call you back on a line that isn't recorded — by the next working day, at a time that suits you — or we can carry on by email instead, whichever you prefer. Asking us not to record will never affect the price you are quoted or the service you receive.

We use an AI assistant. Calls to our telephone number, the live chat on this website, and messages you send us on Facebook and Instagram are answered by an AI assistant rather than by a person. It tells you so at the start, and it will tell you again if you ask. On the telephone it takes your details, confirms what we make and where we install, and arranges for a member of our team to call you back — on the phone it does not quote prices. In live chat and on social media it can also answer questions about our buildings, our published prices and our process, and point you to the configurator for an exact figure. On every channel it cannot agree terms or take payment, and it cannot put you through to a person. Text messages to and from our SMS number are handled by a person, not the assistant — if we can't take your call, you'll get an automatic text letting you know we've got it and will call back.

What the AI assistant cannot do. It cannot form a contract, agree or vary a price, change these or any other terms, approve a discount, or commit us to anything. Prices and specifications are confirmed only in our configurator checkout and in your written order confirmation — see our Sales Terms & Conditions. If the assistant tells you something that turns out to be wrong, the written terms and the price you actually paid are what count, and your statutory rights are unaffected.

You can always reach a person. On a call, ask to speak to a human and we will try to transfer you to one of our founders during the call; if nobody is available, we will arrange a callback instead. In chat or on social media, ask and we will arrange a callback. You can also email us using the details in section 1 or on our Contact page.

What happens to what you tell it. Conversations with the AI assistant are stored alongside the rest of your enquiry or order record and used for the purposes set out in section 3. They are processed by GoHighLevel and its AI sub-processors (section 6), which may involve transfers outside the UK (section 7). Please do not share payment card details, passwords, or health or other sensitive information in a call or chat — we will never ask you for them there.

Children. Our AI assistant, like the rest of our service, is intended for adults.

11. Your rights

Under UK data protection law, you have the right to:

• Be informed about how we use your data (this policy)
• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), in certain circumstances
• Restrict how we use your data, in certain circumstances
• Data portability — receive your data in a portable format
• Object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent at any time, where we rely on consent

To exercise any of these rights, email [email protected]. We will respond within one month. There is normally no charge.

12. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at [email protected] — we operate an internal complaints procedure and will acknowledge your complaint promptly and work to put things right.

You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office (ICO) Website: ico.org.uk Helpline: 0303 123 1113

13. Cookies

Our website uses cookies and similar technologies. These are explained in full in our separate Cookie Policy, including how to manage your preferences.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. When we do, we will update the "Last updated" date at the top. The version published on our website applies to your use of the site and any order you place.

This policy does not reduce any rights you have under the Consumer Rights Act 2015 or other applicable UK law.