Privacy Policy

Welcome, and thank you for your interest in Bowman Bathrooms ("Bowman Bathrooms", "Bowmans", "we," or "us"). This Privacy Policy explains how we collect, use, and protect your personal information when you visit our website at https://www.bowmanbathrooms.co.uk (the "Site") or use our bathroom design and supply services.

This Privacy Policy complies with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR). By using our Site or services, you agree to the data practices described in this Policy.

Data Controller: Bowman Bathrooms Ltd (company number 14004226), trading as Bowman Bathrooms, is the data controller responsible for your personal information. You can contact us using the details in the "How to Contact Us" section below.

1. Information We Collect

1.1 Information You Provide to Us

When you use our services, you may provide us with personal information, including:

• Contact Information: Name, email address, phone number, postal address, postcode
• Project Information: Details about your bathroom project, budget, timeline, preferences
• Communication Records: Content of enquiries, emails, phone calls, and messages
• Booking Information: Showroom visit appointments, consultation bookings
• Marketing Preferences: Your consent choices for receiving marketing communications

Legal Basis: We process this information based on:

• Contract Performance: To provide the services you've requested
• Legitimate Interests: To respond to enquiries and improve our services
• Consent: For marketing communications (you can withdraw consent at any time)

Home and Area Information: When you make an enquiry, we may use your details to look up information about your home and the area around it, such as the type of property and location or area. This information is kept with your enquiry in our customer system.

1.2 Information Collected Automatically

When you visit our Site, we automatically collect certain information:

• Device Information: IP address, browser type, device type, operating system
• Usage Information: Pages visited, time spent, navigation paths, referring websites
• Location Data: General geographic location based on IP address
• Cookie Data: See "Cookies and Tracking Technologies" section below

Legal Basis: Legitimate interests (website security, analytics, improving user experience). For analytics cookies, we rely on your consent obtained through our cookie banner.

1.3 Marketing Attribution Data

To understand which marketing brings visitors to us, we can record attribution details — the campaign parameters (utm_source and similar) and advertising click identifiers (Google's gclid, Meta's fbclid, Microsoft's msclkid) from the URL you arrived through, the site that referred you, your landing page, and a randomly-generated visitor identifier (bb_uid).

This is stored only with your consent. If you have not accepted marketing cookies, none of it is saved to your device: attribution is held in memory for the page you are viewing and discarded when you leave. If you accept marketing cookies, it is stored in your browser (see section 3) so that a later enquiry can be credited to the campaign that first brought you to us. If you reject marketing cookies, any previously stored attribution values are deleted.

When you submit an enquiry, whatever attribution information is available in that moment is sent alongside your form so we can connect the enquiry to the right marketing channel, together with your consent status. Anything that comes from your device (advertising click identifiers, cookie values, your IP address and browser details) is only passed to advertising partners when you consented. Separately, we share a hashed copy of your contact details and what your enquiry became with Google and Meta: see section 4.2.

If you accept cookies, we also keep a note of the pages you look at on our site and send it with your enquiry, so we can understand what you are interested in. Turning cookies off deletes it.

Legal Basis: Consent (PECR regulation 6 for storage on your device; UK GDPR Article 6(1)(a) for the associated processing). You can withdraw at any time via the "Cookie settings" link in the page footer.

2. How We Use Your Information

We use the information we collect to:

• Respond to your enquiries and provide the design, supply, and showroom services you request
• Arrange and manage showroom visits and design consultations
• Send brochures, price guides, and other materials you ask for
• Understand how visitors use our Site and improve it (analytics, with your consent)
• Measure which of our adverts bring customers to us, and show our adverts to the right people (see sections 3, 4.1 and 4.2)
• Send marketing communications where you have opted in (see section 6)
• Meet our legal and accounting obligations

3. Cookies and Tracking Technologies

3.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our Site. They help us provide you with a better experience by remembering your preferences and understanding how you use our Site.

3.2 Cookie Consent

When you first visit our Site, a banner offers three equally available choices:

• Accept All: allows analytics and marketing cookies
• Reject All: only strictly necessary storage is used — nothing else is set
• Manage preferences: choose Analytics and Marketing independently

Your choice is stored in your browser and honoured for up to 6 months, after which we ask again. You can review or change it at any time — including withdrawing consent entirely — via the "Cookie settings" link in the footer of every page, which reopens the preferences panel with your current choices shown. Withdrawing is as easy as accepting.

3.3 What We Store, By Category

Strictly Necessary (always active)

• bowmans_cookie_consent: Records your cookie choice so we can honour it. (Browser local storage; your decision is valid for 6 months, then we ask again.)
• bb_brochures_unlocked: Remembers that you have asked for our brochures, so you can open them without filling in your details again on this device. (Browser local storage, 12 months.)
• bb_brochure_gate_passed: The same, for the current browser session only. (Browser session storage, cleared when you close the browser.)

Analytics (only with your consent)

Used to understand how visitors use our Site and improve it.

• _ga, _ga_[ID]: Google Analytics 4 — distinguishes visitors and sessions. (First-party cookies, 2 years.)
• _clck, _clsk: Microsoft Clarity — session and user identifiers for aggregated interaction data and anonymised session replays. We only link your sessions across visits (the Clarity Identify feature) when you have consented to analytics. (First-party cookies, 1 year / 1 day.)

If you do not consent to analytics: Google Analytics runs in cookieless mode — no cookies or identifiers are stored, and Google receives only anonymous, aggregate signals used for statistical modelling. Clarity likewise sets no cookies and cannot link your visits. Our hosting provider (Vercel) separately collects cookieless, aggregated performance metrics that involve no identifiers.

Page statistics (no cookies)

On the pages of our site we count how long each page is open, how far it is scrolled, and which sections and buttons are used, along with where the visit came from in general terms (for example a search engine, social media or one of our emails, and the campaign name in the link) and whether it was on a phone, tablet or computer. Each page view is counted on its own: nothing links one page to the next or one visit to another. We use these counts only to improve our pages. Nothing is stored on your device for this, and the counts do not identify you: we do not keep your IP address, any identifier, or anything you type. They are not shared with anyone else. The law allows statistics of this kind without consent, provided you are told about them and can object.

To object: choose "Reject All" on the banner, or switch Analytics off under "Cookie settings" in the footer, and your visits are not counted. We also do not count visits from browsers that send a Global Privacy Control signal.

Cookie banner tests

We test different versions of our cookie banner to improve the site. The version you were shown is remembered on your device so you see the same one each time, and we keep anonymous daily counts of which version was shown and which choice was made. Nothing identifies you: we keep no identifier, IP address or browser details, and the counts are not shared with anyone else.

• bowmans_cookie_banner_variant: Which version of the cookie banner you were shown, so you see the same one. (Browser local storage, kept with your cookie choice.)

To object: the same as for page statistics above. Browsers that send a Global Privacy Control signal are left out of the test and always see the usual banner.

Marketing & Advertising (only with your consent)

Used to measure which advertising brings customers to us and to make advertising more relevant. Nothing in this category is stored unless you accept marketing cookies; rejecting deletes any values stored earlier.

• bb_uid: Our randomly-generated visitor identifier, used to recognise that two visits came from the same browser and shared with our advertising platforms in hashed form. (First-party cookie + local storage, 365 days.)
• bb_first_touch: The campaign, referral source and landing page of your first visit. (Local storage, 30 days.)
• bb_click_ids: Advertising click identifiers (gclid, fbclid, msclkid) from the URL you arrived through. (Local storage, 90 days.)
• bb_last_touch: The most recent marketing channel this session. (Session storage.)
• bb_journey: The pages you have looked at on our site and when, sent with your enquiry. Kept only while you accept both analytics and marketing cookies; turning either off deletes it. (Local storage; pages older than 90 days are dropped.)
• _gcl_aw, _gcl_au: Set by Google's advertising tag for conversion measurement once you consent. (First-party cookies, 90 days.)
• _fbp, _fbc: Set by the Meta Pixel, which loads only after marketing consent — browser and ad-click identifiers for advertising attribution. (First-party cookies, 90 days.)

With marketing consent, Google and Meta may also set cookies on their own domains (for example Google's IDE cookie) for ad personalisation and remarketing — showing you our adverts on other sites after you visited ours. Their own policies govern those: how Google uses data from partner sites and the Meta Privacy Policy.

Consent Mode: We implement Google's Consent Mode v2. Every signal defaults to "denied", your banner choice is applied per category (an analytics-only choice does not grant advertising), and until you decide, Google receives only cookieless, anonymous pings.

3.4 Managing Cookies and Ad Preferences

You can control cookies and advertising through:

• Our "Cookie settings" link in the footer of every page — change or withdraw your consent at any time
• Browser Settings: Most browsers allow you to refuse or delete cookies. Visit allaboutcookies.org for guidance.
• Google Ads personalisation: Google My Ad Center
• Meta ad preferences: facebook.com/adpreferences
• Google Analytics Opt-out: the Google Analytics Opt-out Browser Add-on

Note: Disabling cookies may affect Site functionality and your user experience.

4. Who We Share Your Information With

We do not sell, rent, or trade your personal information. We share it only as described here, and every provider is contractually required to protect it and use it solely for the purposes we specify.

4.1 Service Providers

• Website hosting — Vercel: hosts our Site and our serverless enquiry handling, including a secured, access-restricted capture log of form submissions (encrypted at rest) kept for reliability.
• Email services: to send communications and manage enquiries.
• CRM system: your enquiry details, project information, and the marketing-attribution data described in section 1.3 (including your consent status) are passed to our customer-relationship system so we can manage your project.
• Google — Analytics: usage analytics, only with your analytics consent (cookieless aggregate signals otherwise).
• Google Ads: with your marketing consent, we share advertising click identifiers for conversion measurement, and, when you submit an enquiry, a one-way hashed (SHA-256) version of your email, phone number, name, and postcode via Google's Enhanced Conversions, so Google can match the enquiry to the advert that led to it. We also use Google Ads remarketing with marketing consent. Without marketing consent, Google receives only the hashed contact details and results described in section 4.2.
• Meta (Facebook/Instagram): with your marketing consent, the Meta Pixel and Meta's server-side Conversions API receive event data including hashed (SHA-256) email, phone number, name and postcode, our hashed visitor identifier, and technical data (IP address, browser type) for advertising measurement and audience building. Without marketing consent, Meta receives only the hashed contact details and results described in section 4.2, never anything from your device.
• Microsoft — Clarity: session analytics and anonymised replays, only with your analytics consent.

4.2 Advertising with Google and Meta using your contact details

What we share. When you enquire with us, we share a scrambled ("hashed", SHA-256) copy of your email address and phone number with Google and with Meta (which runs Facebook and Instagram), and with Meta also your hashed first name, last name and postcode. Hashing turns them into a code that can only be used to recognise someone who has already given the same details to that platform. With it, we tell them what your enquiry became: for example a design consultation, a design fee paid or an order, and its value.

Why. The platforms try to "match" the hashed details with the hashed details of their own registered users. Where there is a match:

• we can see which of our adverts bring real customers, so we stop paying for the ones that don't;
• Google and Meta can show our adverts to the right people, and not to people they would be wasted on;
• our adverts may be shown to you when you use Google, Facebook or Instagram ("custom audience" advertising). We keep three lists for this: customers who have placed an order (with its value), customers who have had a design consultation, and people who have enquired in the last 12 months;
• Meta may show our adverts to other people who have similar interests and characteristics to our customers ("lookalike" advertising). That is based on information Meta holds about its own users, which we never receive.

What we don't share this way. Nothing from your device (advertising click identifiers, cookie values, your IP address or browser details, our visitor identifier) goes to Google or Meta unless you accepted marketing cookies; that stays under your cookie choice (section 3). We never share your browsing history, your project notes or anything about your health or home life. Our lists only go to Google (Customer Match) for customers who gave marketing consent, because Google asks for consent for that use.

Who receives it. Google acts for us: it uses the data only to measure our adverts and run our campaigns, not for its own purposes. Meta matches your hashed contact details as our processor and deletes customer-list data once matching is done. For the results we send about your enquiry, used to choose who sees our adverts and to deliver them, we and Meta Platforms, Inc. are joint controllers under Meta's UK Controller Addendum; we are responsible for telling you about it here, and Meta is responsible for its own processing, as explained in the Meta Privacy Policy. Meta may keep that event data for up to two years.

Legal basis. Legitimate interests (UK GDPR Article 6(1)(f)). Our interest is knowing which adverts bring customers, so we don't waste money on the ones that don't, and promoting our services to people likely to want them. Our customer lists go to Google only with your consent (Article 6(1)(a)).

How long. We keep the record of what we sent with your enquiry or project (see section 10). You stay in our advertising lists only while you meet the description above; people who enquired leave that list 12 months after their last enquiry.

Your right to object. You can tell us to stop at any time, and we will. It's free and you don't have to give a reason:

• use this form;
• email info@bowmanbathrooms.co.uk;
• call us on 01376 617001 (Braintree) or 01702 419229 (Leigh-on-Sea).

Once you object, nothing more about you goes to Google or Meta, anything waiting to be sent is stopped, and you are taken out of our advertising lists within 24 hours. We can't call back what has already been sent, but nothing is added to it. You can also control the adverts you see in Google My Ad Center and Meta's ad preferences.

4.3 Aggregated Information

We may share aggregated, non-identifiable statistics (for example, visitor counts or enquiry volumes) with partners or in reporting. This information cannot be used to identify you.

4.4 Law Enforcement, Legal Process and Compliance

We may disclose Personal Data or other information if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a facially valid court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies.

We also reserve the right to disclose Personal Data or other information that we believe, in good faith, is appropriate or necessary to (i) take precautions against liability, (ii) protect ourselves or others from fraudulent, abusive, or unlawful uses or activity, (iii) investigate and defend ourselves against any third-party claims or allegations, (iv) protect the security or integrity of the Site and any facilities or equipment used to make the Site available, or (v) protect our property or other legal rights, enforce our contracts, or protect the rights, property, or safety of others.

4.5 Change of Ownership

Personal information may be disclosed and transferred to an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction — as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred as one of our business assets — but only if the recipient commits to a privacy policy with terms substantially consistent with this one.

5. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights:

5.1 Right of Access

You can request a copy of the personal information we hold about you (Subject Access Request). We'll provide this within one month, free of charge.

5.2 Right to Rectification

You can ask us to correct inaccurate or incomplete personal information.

5.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal information in certain circumstances, such as:

• The information is no longer necessary for the purpose it was collected
• You withdraw consent (where consent was the legal basis)
• You object to processing and there are no overriding legitimate grounds
• The information has been unlawfully processed

5.4 Right to Restriction of Processing

You can ask us to suspend processing your personal information in certain situations.

5.5 Right to Data Portability

You can request your personal information in a structured, commonly used, and machine-readable format and transfer it to another controller.

5.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes (including profiling). To stop us sharing your details with Google and Meta for advertising, see section 4.2: objecting stops it straight away.

5.7 Rights Related to Automated Decision Making

You have the right not to be subject to decisions based solely on automated processing, including profiling. We do not currently use automated decision-making.

5.8 Right to Withdraw Consent

Where we rely on consent to process your data, you can withdraw it at any time. For cookies and tracking, use the "Cookie settings" link in the page footer — withdrawal takes effect immediately and deletes the stored marketing identifiers. For marketing emails, use the unsubscribe link or contact us.

5.9 How to Exercise Your Rights

To exercise any of these rights, please contact us at info@bowmanbathrooms.co.uk. We'll respond within one month. If your request is complex, we may extend this by two months and will let you know.

Right to Complain: If you're unhappy with how we've handled your personal information, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

6. Marketing Communications

We will only send you marketing communications if you have:

• Opted in to receive them (e.g., via checkbox on contact forms)
• Previously enquired about our services (soft opt-in under PECR)

Every marketing email includes an unsubscribe link. You can also opt out by:

• Emailing us at info@bowmanbathrooms.co.uk
• Calling our showrooms

We'll process your opt-out request within 10 business days. You'll continue to receive essential service communications (e.g., booking confirmations) even if you opt out of marketing.

7. Third Party Services

The Site may contain features or links to web sites and services provided by third parties. Any information you provide on third-party sites or services is provided directly to the operators of such services and is subject to those operators' policies, if any, governing privacy and security, even if accessed through the Site. We are not responsible for the content or privacy and security practices and policies of third-party sites or services to which links or access are provided through the Site. We encourage you to learn about third parties' privacy and security policies before providing them with information.

8. Children's Privacy

Our services are not intended for children under 18 years of age. We do not knowingly collect personal information from children. If you are under 18, please do not use our Site or provide any information.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at info@bowmanbathrooms.co.uk and we will delete it.

9. Data Security

We follow generally accepted industry standards to protect the information submitted to us, both during transmission and once we receive it. We maintain appropriate administrative, technical and physical safeguards to protect Personal Data against accidental or unlawful destruction, accidental loss, unauthorised alteration, unauthorised disclosure or access, misuse, and any other unlawful form of processing of the Personal Data in our possession. This includes, for example, firewalls, password protection and other access and authentication controls. We use SSL technology to encrypt data during transmission through public internet, and we also employ application-layer security features to further anonymize Personal Data.

However, no method of transmission over the Internet, or method of electronic storage, is 100% secure. We cannot ensure or warrant the security of any information you transmit to us or store on the Site, and you do so at your own risk. We also cannot guarantee that such information may not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial safeguards. If you believe your Personal Data has been compromised, please contact us as set forth in the "How to Contact Us" section.

If we learn of a security systems breach, we will inform you and the authorities of the occurrence of the breach in accordance with UK GDPR.

10. Data Retention

We only keep your personal information for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements.

Retention periods:

• Enquiries (no project): 2 years from last contact
• Project information: 6 years after project completion (UK tax law requirement)
• Marketing consent: Until withdrawn or 2 years of inactivity
• Website analytics (GA4 event data): up to 14 months
• Website enquiry capture log: reviewed and purged periodically; the CRM is the system of record
• Cookie consent decision: 6 months, after which we ask again (you can change it sooner at any time)
• Advertising lists with Google and Meta: only while you meet the list's description (section 4.2), and never after you object

After these periods, we securely delete or anonymise your information. Some information may be retained in backups for up to 3 months before permanent deletion.

11. International Data Transfers

Your information is primarily stored and processed in the United Kingdom. Some of our service providers may process data outside the UK, including:

• Google (Analytics and Ads): may process data in the USA and EEA countries
• Meta Platforms Ireland Ltd: data shared with Meta (sections 4.1 and 4.2) may be transferred to Meta Platforms, Inc. in the USA
• Microsoft (Clarity): may process data in the USA and EEA countries
• Vercel (hosting): may process data in the USA and EEA countries

Where we transfer data outside the UK, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the UK authorities
• The recipient is in a country with adequacy regulations from the UK
• The recipient has appropriate certifications (e.g., EU-US Data Privacy Framework)

12. Changes to This Policy

Please revisit this page periodically to stay aware of any changes to this Policy, which we may update from time to time. If we modify the Policy, we will make it available through the Site, and indicate the date of the latest revision, and will comply with applicable law. Your continued use of the Site after the revised Policy has become effective indicates that you have read, understood and agreed to the current version of the Policy.

13. How to Contact Us

If you have any questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your personal information, please contact us:

We aim to respond to all enquiries within one month. For complex requests, we may extend this by two months and will let you know if this is necessary.