Your Privacy, Our Promise
Privacy Policy
Latimer Living Ltd
Last Updated: 21 September 2026 | Version 2.2
1. Introduction
This Privacy Policy outlines how Latimer Living Ltd ("Latimer Living", "we", "us", or "our") collects, uses, stores, and protects personal data when you engage our interior design, refurbishment, procurement, project management, and related property services, or when you visit our website and digital portals.
We are committed to maintaining the highest standards of data privacy and compliance under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR).
This policy applies to personal data processed across all interaction channels, including:
Website interactions and contact form submissions
Telephone, video, and email communications
In-person property consultations, site visits, and refurbishment surveys
Payment processing and commercial transactions
Our shared Customer Relationship Management (CRM) platform, client portal, and pricing systems
2. Who We Are and Data Controller Details
Latimer Living Ltd is a company registered in England and Wales under Company Registration Number 10650330, with its registered office located at 30 North Street, Bourne, England, PE10 9AB.
For the purposes of the UK GDPR, Latimer Living Ltd acts as the primary Data Controller for personal data collected in connection with our interior design, procurement, and project execution services.
Contact Information:
Email: enquiries@latimerliving.com
Telephone: +44 (0) 20 3932 3387
Postal Address: Latimer Living Ltd, 30 North Street, Bourne, England, PE10 9AB
2.1 Sister Company Relationship and Shared CRM (Joint Controller Arrangements)
Latimer Living Ltd operates alongside our sister company, FIKO Facilities Management Ltd. While each company is a distinct legal entity with separate client contracts, both businesses are supported by a unified central administrative and operational team.
To manage enquiries, client onboarding, scheduling, procurement, pricing, and project workflows efficiently, we share custom CRM and client portal platforms constructed using Google AppSheet and Replit. These platforms integrate securely with our respective, separate Google Workspace cloud storage environments.
Where personal data is shared or processed within these shared systems, Latimer Living Ltd and FIKO Facilities Management Ltd act as Joint Controllers under Article 26 of the UK GDPR. An internal Joint Controller Arrangement is in place establishing each entity's data protection obligations. Sharing infrastructure does not blend our underlying client contracts, nor does it grant permission for either entity to market its services to the other entity's clients without an appropriate lawful basis.
3. Personal Data We Collect
We collect personal data required to deliver high-quality interior design, procurement, refurbishment, and project management services. This information includes:
Identity and Contact Data: Full name, title, billing address, site/property address, email address, primary phone numbers, and emergency/site contact details.
Project and Design Specifications: Architectural plans, floor layouts, room measurements, aesthetic preferences, furniture, fixtures & equipment (FF&E) schedules, procurement lists, property photographs, site access instructions, and trade specialist correspondence.
Service and Booking Records: Consultations, site survey notes, progress reports, defect assessments, contractor schedules, and completed work documentation.
Financial and Transactional Data: Payment history, invoice records, bank details for refunds, and transaction reference numbers processed via secure third-party payment gateways (e.g., Stripe). Full payment card numbers are never stored on our internal systems.
Technical and Portal Usage Data: Access logs, IP addresses, browser types, and usage data derived when clients log into our shared client portal or interact with our website.
4. Lawful Bases for Processing
Under Article 6 of the UK GDPR, we process your personal data under the following lawful bases:
Performance of Contract: Providing design consultations, issuing fee proposals, managing procurement, coordinating trade contractors, conducting property visits, issuing invoices, and fulfilling client agreements.
Compliance with Legal Obligations: Maintaining mandatory accounting and statutory financial records, tax reporting to HMRC, complying with building safety regulations, and responding to lawful statutory queries.
Legitimate Interests: Managing client relationships, operating shared CRM and administrative systems across sister companies, ensuring IT/cloud security, and defending potential legal or defect claims.
Consent: Sending opt-in marketing newsletters, promotional portfolios, or utilizing non-essential website cookies under PECR. Consent can be withdrawn at any time.
5. Data Sharing and Third-Party Disclosures
To execute interior design and refurbishment projects effectively, personal data may be shared with vetted third parties on a strict need-to-know basis:
Trade Contractors and Suppliers: Specialized artisans, joiners, structural engineers, builders, lighting consultants, and logistics/delivery personnel requiring site access details, contact names, and project specifications.
Third-Party Technology Service Providers: Secure cloud infrastructure providers including Google Workspace (cloud storage), Google AppSheet / Replit (shared CRM and custom portal engines), Xero (accounting and invoicing software), and Stripe (payment processing).
Sister Entity Personnel: Key operational and administrative personnel shared with FIKO Facilities Management Ltd for central client intake and project scheduling.
Professional Advisers: Insurers, legal counsel, auditors, and regulatory bodies where necessary for legal compliance or claims defence.
6. International Data Transfers and Remote Overseas Access
Latimer Living Ltd utilizes a blended operational model. Central administrative support, client intake, and CRM maintenance are conducted in part by remote team members located in South Africa.
Under UK GDPR Chapter V, allowing remote access to cloud-stored data from outside the UK constitutes an international data transfer. To ensure your personal data remains fully protected, we enforce the following safeguards:
Legal Transfer Mechanisms: All international data access by South African personnel is governed by standard contractual clauses, specifically the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, pursuant to Article 46(2) of the UK GDPR.
Strict Device and Access Controls: Remote team members access data exclusively via encrypted cloud environments (Google Workspace / AppSheet). Downloading, saving, or storing client personal data onto personal or local physical devices is strictly prohibited. All data remains hosted in encrypted cloud storage with strict session controls and multi-factor authentication (MFA).
7. Data Storage, Technical, and Organisational Security
We implement robust technical and organizational measures to safeguard personal data against unauthorized access, loss, destruction, or alteration:
Data is encrypted in transit (TLS/SSL) and at rest within enterprise-grade cloud environments.
Access is restricted via Role-Based Access Control (RBAC) and enforced through multi-factor authentication (MFA).
Local device downloading is disabled for operational files, ensuring client property data remains centralized within our audited cloud perimeter.
8. Specific Data Retention Schedule
In alignment with UK statutory requirements, HMRC guidelines, and construction/interior design industry standards (under the Limitation Act 1980), we retain personal data only for as long as necessary to fulfill the purposes for which it was collected:
Financial & Tax Records: Retained for 7 Years. Compliance with HMRC requirements under the Taxes Management Act 1970 and Companies Act 2006.
Standard Client Contracts & Project Records: Retained for 6 Years post-completion. Statutory limitation period for breach of simple contracts under the Limitation Act 1980.
Contracts Executed as Deeds / Structural Works: Retained for 12 Years post-completion. Statutory limitation period for specialty contracts and structural defect claims under the Limitation Act 1980.
Initial Enquiries & Unconverted Leads: Retained for 12 to 24 Months. Legitimate administrative follow-up, after which unengaged lead records are deleted or anonymized.
9. Your Data Protection Rights under UK GDPR
Under UK data protection law, you possess key rights regarding your personal information:
Right of Access (Subject Access Request): Request copies of personal data held by us.
Right to Rectification: Request correction of inaccurate or incomplete personal data.
Right to Erasure ('Right to be Forgotten'): Request deletion of data where processing is no longer necessary, subject to statutory retention exceptions.
Right to Restriction and Objection: Restrict or object to data processing based on legitimate interests or direct marketing.
Right to Data Portability: Request transfer of your data to another controller in a structured format.