User data policy

01What we collect when you send an enquiry

The enquiry form asks for your name, and optionally your company, email address, phone number, what you are interested in, a quantity or size, and a description of the job. All of it is what you choose to type.

Alongside it we record the date and time, the quote list you had built if any, your IP address and your browser's user-agent string. The IP and user agent are kept for one reason: they let us tell a real enquiry from an automated one, and identify abuse of the form.

The quote list is stored as it stood when you sent it, including the prices shown at the time. Prices move, and a record that silently updated itself would be useless when we come back to you.

02Why we hold it, and what we do not do with it

We hold your enquiry to answer it, to quote for the work, and to keep a record of what was discussed if you come back to us later. That is the whole purpose.

We do not sell your details, rent them, share them for marketing, or pass them to anyone outside our trade desk. We do not add you to a mailing list. We do not use your details to build a profile of you, and there is no advertising network involved in this site at any point.

If we need to involve a third party to fulfil an order — a freight forwarder, for example — we will tell you before we pass anything on.

03How long we keep it

Enquiries are kept for 24 months from the date they arrive, then deleted. Trade enquiries often turn into orders months later, and a quote we cannot find is worse than useless, but there is no reason to keep them indefinitely.

Security records — the log of sign-ins, blocked requests and rejected uploads described below — are kept for 90 days.

If you ask us to delete your enquiry sooner, we will, and it is removed from our database rather than merely hidden.

04Cookies

This site sets one cookie, named SBGSESSID. It exists so the quote list you build follows you between pages and between our net, mat and store sites. It contains a random identifier and nothing else — no name, no email, no history.

It is marked HttpOnly, so scripts cannot read it, and SameSite=Lax, so it is not sent when another site links to us. It is deleted when you close your browser.

There are no advertising cookies, no analytics cookies and no third-party cookies. That is also why you are not being asked to dismiss a consent banner: a cookie that is strictly necessary to provide the feature you are using does not need one.

05Other services this site touches

Typefaces on this site are loaded from Google Fonts. That means your browser requests two files from Google's servers, and in doing so your IP address is visible to Google. We do not send them anything else, and we receive nothing back about you. If you would rather this did not happen, a browser extension that blocks third-party requests will stop it without breaking the site.

The "WhatsApp" and "chat" buttons are ordinary links to wa.me. Nothing is sent anywhere until you click one; from that point you are in WhatsApp, and Meta's terms and privacy policy apply to the conversation, not ours.

The "open in email" button hands the message to your own email program. It does not send anything from this website.

06How we protect it

The site is served over HTTPS, so what you type reaches us encrypted. The admin area is behind a password stored only as a hash, sign-in attempts are rate limited, and every change made to the site is logged.

Enquiries are held in a database that is not reachable from the web, under an account that can read and write rows but cannot alter the database structure. Uploaded images are stored outside the folders the web server will serve.

We keep a short security log of events such as failed sign-ins, blocked uploads and rate-limited requests. It records the IP address, browser user-agent and the address requested. It exists to detect and investigate attacks on the site, and for nothing else.

07Your rights

You can ask us what we hold about you, ask for a copy of it, ask us to correct anything wrong, or ask us to delete it. Write to the address below and we will respond within 30 days. There is no charge.

We will ask you to confirm something only you and we would know — usually a detail from the enquiry itself — before we send or delete anything, so that a request cannot be made in your name by somebody else.

If you are unhappy with how we have handled your data, you are entitled to complain to a data protection authority in your country.

08Changes to this policy

If we change what we collect or what we do with it, this page changes with it and the date at the top is updated. We will not start doing something new with data we already hold without telling you first.