Privacy policy

Last updated: 29th May 2026

1. Who We Are

ZaZa Homes Ltd  (“we”, “us”, “our”) is a company registered in England and Wales (Company No. 11669230), with registered address at 71 Trenoweth Road, Falmouth, Cornwall TR11 5GH. We operate the website https://zazahomes.co.uk/.

We are the data controller in respect of your personal data. We are registered with the Information Commissioner’s Office (ICO). Our ICO registration number is ZC157963..

If you have any questions about how we use your personal data, please contact us at:

Email: info@zazahomes.co.uk

2. Our Commitment to Your Privacy

We are committed to protecting your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains what personal data we collect, why we collect it, how we use it, who we share it with, how long we keep it, and your rights in relation to it.

This policy is provided to ensure you are fully informed of how we use your personal data, in accordance with our transparency obligations under Article 13 of the UK GDPR. We do not rely on your use of our website as consent for any processing that requires your explicit opt-in. Where we require your consent, we will ask for it separately and directly.

3. Personal Data We Collect

We collect and process the following categories of personal data:

• Identity data: name, username or similar identifier.

• Contact data: email address, telephone number, billing and delivery address.

• Transaction data: details of products you have purchased and payment history.

• Technical data: IP address, browser type and version, time zone setting, browser plug-in types, operating system and platform, and other technology on the devices you use to access our website.

• Usage data: information about how you use our website and services, including pages visited and products viewed.

• Marketing and communications preferences: your preferences for receiving marketing from us and your communication preferences.

• User-generated content: product reviews, photographs or other content you submit to us.

We do not collect any special categories of personal data (such as health data, racial or ethnic origin, religious beliefs, or biometric data) and we do not collect data relating to criminal convictions. We may use your purchase history and browsing behaviour on our website to personalise the products and content displayed to you. This does not constitute solely automated decision-making within the meaning of Article 22 UK GDPR, as it does not produce legal or similarly significant effects. For further detail, see Sections 5-14 & information on Automated Decision-Making and Profiling.Where you submit user-generated content such as product reviews or photographs, we collect and publish this content on the basis of your consent. You may withdraw consent at any time by contacting us at info@zazahomes.co.uk, and we will remove the content within a reasonable timeframe.

4. Why We Collect Your Personal Data

We collect personal data only for specific, legitimate purposes. This section explains clearly why we collect each category of data. More detail on the lawful basis for each purpose is set out in Section [5] — How and Why We Use Your Personal Data.

We do not collect personal data for any purpose other than those described in this policy. If we wish to use your data for a new purpose that is incompatible with the original purpose for which it was collected, we will inform you and, where required, seek your consent before doing so.

5. How and Why We Use Your Personal Data

We collect personal data through the following means:

• Directly from you: when you create an account, place an order, subscribe to our email list, contact our customer service team, or submit a product review.

• Automated technologies: as you interact with our website, we may automatically collect technical and usage data via cookies, server logs and similar technologies. Please see our Cookie Policy for more information.

• Third parties: we may receive data from payment processors, analytics providers, and advertising platforms such as Google, where you have consented to such sharing with those third parties.

The UK GDPR requires us to have a lawful basis for processing your personal data. The table below sets out the purposes for which we process your data and our corresponding lawful basis.

Where we rely on legitimate interests as our lawful basis, we have carried out a Legitimate Interests Assessment (LIA) to ensure that our interests are not overridden by your rights, freedoms or interests. A summary of our LIAs is available on request by contacting us at info@zazahomes.co.uk.  Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

6. Marketing and Email Communications

We will only send you marketing communications if you have opted in to receive them, for example by subscribing to our email list. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by contacting us directly at info@zazahomes.co.uk.

Withdrawal of consent does not affect the lawfulness of any processing carried out before you withdrew consent. Once you unsubscribe, we will process your request and remove you from our active mailing list within 10 business days. We will retain a suppression record of your email address indefinitely to ensure we do not contact you again for marketing purposes.

We use Klaviyo (a service of Intuit Inc.) to manage and send our email campaigns. Klaviyo processes your email address and related data on our behalf as a data processor. You can review Klaviyo’s Privacy Policy at https://privacy.klaviyo.com/. Your data is processed by Klaviyo in accordance with a Data Processing Agreement and appropriate safeguards under UK GDPR.

7. Online Advertising, Cookies and Analytics

We use cookies and similar tracking technologies on our website. Some of these are essential for the site to function; others are used for analytics and advertising and are only placed with your consent.

Retargeted advertising: if you have visited our website, you may see our advertisements on other websites or platforms (such as Google Display Network, Youtube or Meta). This is facilitated by advertising cookies placed with your consent. You can manage your cookie preferences at any time via our cookie consent banner or your browser settings.

Analytics: we use Google Analytics to understand how visitors use our website (e.g. pages visited, session duration). Where required under PECR, this is done only with your consent. Google Analytics does not identify individual users. For more information, see Google’s Privacy Policy at https://policies.google.com/privacy.

For full details of the cookies we use, their purpose and how to manage them, please see our Cookie Policy.

8. Sharing Your Personal Data

We do not sell your personal data. We only share your data with third parties where necessary to operate our business and fulfil your orders. These may include:

• Delivery and logistics providers: to arrange delivery of your order.

• Payment processors: Stripe, PayPal, or other payment service providers as applicable. These process your payment data under their own privacy policies and are themselves regulated as data controllers for payment purposes.

• Email marketing provider: Klaviyo (see section 6).

• IT service providers: hosting, platform and security providers who support our website.

• Analytics and advertising platforms: Google Analytics, Google Ads, Meta (where you have consented to advertising cookies).

• Professional advisers: solicitors, accountants and insurers, where necessary.

• Law enforcement or regulatory authorities: where required by law or court order.

All third-party processors are required to process your data only on our instructions and in compliance with UK GDPR. We conduct due diligence on our suppliers and require appropriate data processing agreements to be in place.

9. International Data Transfers

Some of our third-party service providers are based outside the UK, including in the United States. Where we transfer personal data outside the UK, we ensure that appropriate safeguards are in place in accordance with Chapter V of UK GDPR.

The specific mechanisms we rely upon are as follows:

Klaviyo relies on the UK Extension to the EU-U.S. Data Privacy Framework (DPF) and/or Standard Contractual Clauses (SCCs) to ensure lawful data transfers out of the UK

 Klaviyo (Intuit Inc., USA): Personal data is transferred to the United States under the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework) and/or Standard Contractual Clauses (UK Addendum to EU SCCs), as applicable. Please refer to Klaviyo's current privacy documentation Klaviyo Privacy Notice for details of their certification status.

Google LLC (USA):Personal data is transferred to the United States under Standard Contractual Clauses (UK Addendum to EU SCCs) and, where applicable, the UK–US Data Bridge.

Transfers to adequacy countries: Where we use providers based in countries that have received a UK adequacy decision, no further transfer safeguards are required.

You may request further information about the specific safeguards in place for any international transfer by contacting us at info@zazahomes.co.uk. A copy of the relevant transfer mechanism can be provided on request.

10. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by law. Our general retention periods are as follows:

• Order and transaction records: 7 years from the date of the transaction, to comply with HMRC requirements under the Taxes Management Act 1970.

• Customer account data: For the duration of the account, plus 6 years after the date of the last transaction or last account activity (whichever is the later), in accordance with the Limitation Act 1980.

• Marketing consent records: For as long as you remain subscribed to our marketing communications. A suppression record of your email address will be retained indefinitely after unsubscription, to ensure you are not re-contacted.

• Cookie consent records: For the duration of the consent and for a further 3 years thereafter, to enable us to demonstrate compliance with PECR if required.

•  General correspondence and customer enquiries: 6 years from the date of the correspondence or the resolution of any related matter, in accordance with the Limitation Act 1980.

•  Personal data breach records: A minimum of 3 years from the date of the breach, in accordance with Article 33(5) UK GDPR and ICO guidance.

Where personal data is no longer required, we securely delete or anonymise it in accordance with our internal data retention policy.

11. Security of Your Personal Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration. These include:

• SSL/TLS encryption for all data transmitted between your browser and our website.

• Secure hosting with reputable providers operating to recognised security standards.

• Access controls limiting who within our organisation can access personal data.

• Regular review of our security practices.

Whilst we take all reasonable steps to protect your data, no transmission over the internet can be guaranteed to be 100% secure. If you have reason to believe your personal data has been compromised, please contact us immediately.

12. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of these rights, please contact us at info@zazahomes.co.uk . We will respond within one calendar month of receiving your request. Where a request is complex, or where we receive multiple requests from you, we may extend this period by up to a further two months. We will notify you within the first month if an extension is required and explain the reasons for it.

• Right of access: you may request a copy of the personal data we hold about you (a Subject Access Request).

• Right to rectification: you may ask us to correct inaccurate or incomplete data.

• Right to erasure (‘right to be forgotten’): you may ask us to delete your personal data where there is no longer a legitimate reason to hold it.

• Right to restriction of processing: you may ask us to restrict how we use your data in certain circumstances.

• Right to data portability: you may request a copy of your data in a structured, commonly used, machine-readable format.

• Right to object: you may object to us processing your data on the basis of legitimate interests or for direct marketing purposes.

• Rights relating to automated decision-making: we do not currently carry out solely automated decision-making that produces legal or similarly significant effects on you.

• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.

We reserve the right to refuse to act on, or to charge a reasonable administrative fee for, requests that are manifestly unfounded or excessive — in particular where they are repetitive in nature. Where we refuse a request or charge a fee, we will inform you of our reasons and of your right to complain to the ICO or seek a judicial remedy.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at any time. The ICO’s contact details are: ico.org.uk | 0303 123 1113 | Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

13. Personal Data Breaches

We have internal procedures in place to detect, report, investigate and respond to personal data breaches. In the event of a breach that is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) **without undue delay and, where feasible, within 72 hours of becoming aware of the breach, in accordance with Article 33 UK GDPR.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly **without undue delay**, in accordance with Article 34 UK GDPR. Such notification will describe the nature of the breach, the likely consequences, the measures we have taken or propose to take to address the breach, and the contact details of our data protection point of contact.

We document all personal data breaches, whether or not they are notifiable to the ICO, and retain those records for a minimum of 3 years from the date of the breach, in accordance with Article 33(5) UK GDPR.

14. Automated Decision-Making and Profiling

We do not currently carry out any solely automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 UK GDPR.

 We may use automated tools to personalise the content and product recommendations displayed to you on our website, based on your browsing history and purchase activity. This activity is carried out on the basis of our legitimate interests in improving your experience on our website. It does not produce legal or similarly significant effects on you, and does not constitute automated decision-making for the purposes of Article 22 UK GDPR.

 If we introduce any new automated decision-making process that does produce legal or similarly significant effects, we will update this policy, provide you with meaningful information about the logic involved, and seek your explicit consent where required.

15. Children’s Privacy

Our website and services are intended for use by individuals aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18, and we do not enter into contracts with minors. This reflects both our commercial policy and our data protection obligations.

 If we become aware that we have collected personal data from a person under 18, we will delete that data promptly. If you believe we have done so, please contact us at info@zazahomes.co.uk

16. Links to Third-Party Websites

Our website may contain links to third-party websites. This Privacy Policy applies only to our website and services. We are not responsible for the privacy practices of third-party sites and we encourage you to review their privacy policies before providing any personal data.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, our data practices, or for other legitimate reasons. Any changes will be posted on this page with an updated effective date. We may also notify you by email where changes are material. We recommend you review this policy periodically.

ZaZa Homes Ltd 71 Trenoweth Road, Falmouth, Cornwall TR11 5GH| Company No. 11669230 | ICO Reg. No. ZC157963

For cookie-specific information, see our Cookie Policy.