1. Who is responsible for your data
The data controller is INCORPORATED BLIND SOLUTIONS LTD, trading as Veil & Ray, at 8 Whites Neuk, ML11 7EE, Scotland, United Kingdom. For any privacy question, email support@blinsolu.shop or call +44 7514867186. We operate the website at blinsolu.shop and sell standard-size, finished window treatments shipped worldwide and priced in USD.
2. What we collect
- Order and delivery data: name, email, phone (optional), shipping address, city, postal code and country provided at checkout for order fulfilment, dispatch and returns.
- Account and membership data: if you subscribe to a Comfort or Curator membership, the plan, billing interval and subscription status.
- Support and enquiry data: messages, subject lines and contact details you send through our contact and wholesale enquiry forms.
- Room Light Finder / colour suggestion inputs: the room, priority and window type you select, and any window photo you optionally upload for a decorative colour suggestion.
- Payment metadata: confirmation of payment, the last four digits and card brand as returned by our payment processor. We never see or store your full card number.
- Technical data: IP address, device and browser type, and essential cookie identifiers needed to run the cart and secure the site.
3. Collection sources: where the data comes from
Most data is collected directly from you when you browse, add items to the cart, complete checkout, subscribe, or contact us. Payment confirmation metadata comes from our payment processor, and delivery status comes from the carrier handling your parcel.
4. Why we use it and our legal bases
- To perform our contract with you (UK/EU GDPR Art. 6(1)(b)): processing orders, taking payment, arranging delivery, managing memberships and handling returns.
- Legitimate interests (Art. 6(1)(f)): preventing fraud, securing the site, retaining checkout enquiries so we can follow up on an incomplete order, and improving our product range. You can object at any time.
- Consent (Art. 6(1)(a)): non-essential analytics cookies, optional marketing email, and processing any window photo you upload for a colour suggestion.
- Legal obligation (Art. 6(1)(c)): keeping tax, accounting and consumer-law records.
5. Payment provider boundary
Card payments are processed by our PCI-DSS compliant payment processor through a hosted checkout. Your full card number, expiry and security code are entered on the processor's secure page and are never transmitted to or stored on our servers. We receive only a payment confirmation, the card brand and the last four digits for order reconciliation and refunds.
6. Who we share it with
We share the minimum necessary data with the following categories of processor:
- Hosting and application platform that runs this website and its serverless functions.
- Payment processor for card authorisation, subscriptions, refunds and disputes.
- Database and storage provider that holds order, enquiry and membership records.
- Email provider used to send order, support and enquiry correspondence.
- Shipping carriers and fulfilment partners that deliver your parcel.
We do not sell your personal data. We disclose data to authorities only where legally required.
7. International transfers
Some processors operate outside the United Kingdom and the EEA. Where data is transferred internationally we rely on adequacy decisions or Standard Contractual Clauses (with the UK International Data Transfer Addendum where applicable) to keep your data protected to the same standard.
8. How long we keep it
Order and tax records are retained for up to seven years to meet accounting obligations. Contact and wholesale enquiries are kept for up to 24 months. Uploaded window photos used for colour suggestions are cached for a maximum of 30 days and then deleted. Membership records are kept for the life of the subscription plus the statutory retention period.
9. Security
We use HTTPS across the site, hosted PCI-DSS checkout, access-controlled databases and server-only handling of secrets. No system is perfectly secure, but we apply appropriate technical and organisational measures and review them regularly.
10. Your rights
Under UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. Under the California Consumer Privacy Act (CCPA/CPRA) you have the right to know, delete, correct and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of, but you may still exercise every other right. To make a request, email support@blinsolu.shop. We respond within the statutory time limit and never charge for a valid request.
11. Cookies and analytics
We use essential cookies to run the cart, secure the checkout and remember your preferences. Non-essential analytics run only with your consent. See our Cookie Policy for the full breakdown and how to change your choice.
12. Automated decisions and children
We do not carry out automated decision-making that produces legal effects about you. Our colour and Room Light Finder suggestions are decorative guidance only. The store is not directed at children: ordering is not permitted under 13, and customers aged 13–17 must have the consent of a parent or guardian.
13. Complaints and contact
Contact us first at support@blinsolu.shopand we will try to resolve any concern. You also have the right to complain to the UK Information Commissioner's Office, or to your local supervisory authority in the EEA.