1. Who we are
This policy explains how Grajko handles personal data when you browse grajko.co.uk, order from us, or write to us about a games room. Grajko is a trading name of GRAJKO LTD, the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
GRAJKO LTD
Company number: 17443774
Registered address: Office 21177 182-184 High Street North, East Ham, London, United Kingdom, E6 2JA
Email: [email protected]
Phone: +44 7723 418596
Website: grajko.co.uk
For any question about this policy or your data, email us at the address above with “Privacy” in the subject line.
2. Data we collect
We collect only what we need to sell, deliver and fit your order and to answer your questions.
Order and contact details
- Name, email address and phone number.
- Delivery address, town or city and postcode.
- The items you order, quantities, prices, order number and your chosen payment method.
- Any comment you add at checkout.
Delivery and installation details
A slate table is heavy and arrives in sections, so to plan the delivery we may ask about and record:
- access to the property: parking, steps, gates, the route from the van to the room;
- the floor the room is on, whether there is a lift, and the width of doors, hallways and staircases;
- preferred delivery dates and times, and who will be at home to let the fitters in.
Room dimensions and photographs
To recommend a table size you may send us the room measurements and photographs or video of the room. Please avoid including people, documents or anything personal in the frame; if they appear, we use the images only for planning your table.
Specification choices
Cloth colour, timber and finish, pocket style, cue measurements and any text you ask us to engrave, such as a name, a date or a crest.
Correspondence
Emails and phone notes about your enquiry, order, delivery, aftercare or a return.
Payment data
Card, wallet, Klarna and PayPal payments are processed by our payment provider. We do not see or store your full card number or security code; we receive a confirmation of payment, the amount, the method and a transaction reference. For bank transfers we see the payer name, amount and reference shown on our bank statement.
Technical data
When you visit the site our hosting provider automatically records server logs: IP address, browser type, pages requested and time of request. The site does not use analytics or advertising trackers.
3. Purposes and legal bases
We must have a legal basis under Article 6 UK GDPR for each use of your data.
| Purpose | Data | Legal basis |
|---|---|---|
| Taking and processing your order, payment and confirmation | Order and contact details, payment confirmation | Contract |
| Planning delivery, assembly and levelling | Address, access, floor, door widths, dates | Contract |
| Recommending a table size before you order | Room dimensions, photographs | Steps taken at your request before a contract (contract) |
| Building made-to-order tables and engraving | Specification choices, engraving text | Contract |
| Answering enquiries and aftercare | Contact details, correspondence | Legitimate interests in responding to customers and supporting the products we sell |
| Handling cancellations, returns and complaints | Order details, correspondence | Contract and legal obligation (Consumer Contracts Regulations 2013, Consumer Rights Act 2015) |
| Accounting, tax and VAT records | Order and payment records | Legal obligation |
| Keeping the site secure and preventing fraud | Server logs, order data | Legitimate interests in protecting our customers and business |
| Using photos of your finished room in our gallery | Photographs you agree to share | Consent |
| Occasional emails about new tables, if you ask for them | Name, email | Consent |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment.
If you do not give us the data needed to deliver and fit a table, we may be unable to complete the order.
4. Who we share data with
We do not sell your personal data. We share it only with people who need it to do their part of the job:
- Payment provider — processes card, wallet, Klarna and PayPal payments and receives the data needed to take payment and prevent fraud. Klarna and PayPal act as independent controllers for their own services under their own privacy notices.
- Specialist large-item carriers — receive your name, phone number, delivery address, access details and delivery window.
- Fitters and installers — receive your name, phone number, address, access notes, room details and table specification to assemble and level the table.
- Workshops making bespoke tables and cues — receive the specification and engraving text, but not your contact details unless needed.
- Email and hosting providers — store our correspondence and serve the website.
- Our bank and accountants — for payments, bookkeeping and tax.
- Authorities — HMRC, police or courts where the law requires it.
Service providers acting on our behalf are bound by written contracts to use your data only on our instructions and to keep it secure.
5. International transfers
We store and use your data mainly in the United Kingdom. Some providers, such as email, hosting or payment services, may process data in the European Economic Area or the United States. Where data leaves the UK, we make sure it is protected by UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or, for the United States, the UK Extension to the EU–US Data Privacy Framework where the recipient is certified. You can ask us for a copy of the relevant safeguards.
6. How long we keep data
| Data | Retention |
|---|---|
| Orders, invoices and payment records | 6 years after the end of the financial year of the order (tax and accounting law) |
| Delivery and access notes | 12 months after delivery, then deleted or reduced to the address on the invoice |
| Room dimensions and photographs | 12 months after the last contact if you do not order; 2 years after delivery if you do, for aftercare and re-levelling |
| Specification and engraving records | 6 years after delivery, to support repairs, re-clothing and claims |
| Enquiry correspondence that did not lead to an order | 12 months after the last message |
| Correspondence about orders, returns and complaints | 6 years after the order, to deal with any legal claims |
| Server logs | Up to 30 days |
| Data held on the basis of consent | Until you withdraw consent |
7. Security
The site is served over HTTPS. Access to customer data is limited to staff and contractors who need it, accounts are protected with strong passwords and two-factor authentication where available, and fitters receive only the details of the jobs they are booked for. Card data is handled by the payment provider and never stored on our systems.
No system is completely secure. If a breach is likely to put your rights at risk, we will tell you and the ICO as the law requires.
8. Cookies
The site does not set cookies and does not use analytics, advertising or social media tracking. Your cart lives only in the open browser tab and is cleared when you close or reload the page; nothing is saved in your browser’s storage. If we ever add non-essential cookies, we will ask for your consent first, as required by the Privacy and Electronic Communications Regulations 2003, and update this policy.
9. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete data where there is no longer a reason to keep it.
- Restriction — ask us to limit how we use your data, for example while a dispute is resolved.
- Portability — receive data you gave us under contract or consent in a commonly used, machine-readable format, or have it sent to another organisation.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — at any time, where we rely on consent.
We do not make decisions about you based solely on automated processing. To exercise any right, email [email protected]. We will reply within one month, free of charge, and may ask for proof of identity first. The period can be extended by two further months for complex requests; we will tell you if so.
10. Withdrawing consent
Where we use your data on the basis of consent — for example to show photos of your room in our gallery or to send you emails about new tables — you can withdraw it at any time by emailing [email protected] or by using the unsubscribe link in any marketing email. Withdrawal does not affect anything done before it, and we will remove published photos within 14 days.
11. Complaints to the ICO
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
12. Age restriction
Our products and services are sold to adults. You must be 18 or over to place an order. We do not knowingly collect personal data from children; if you believe a child has sent us their details, contact us and we will delete them.
13. Changes to this policy
We review this policy when our services or the law change. The current version is always on this page with its date. If a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.
Last updated: 21 October 2026.