Last updated: 6 September 2026
This privacy policy applies to the websites operated by Hudson Lighting:
When we say “we”, “us”, or “our” in this policy, we mean the relevant Hudson Lighting entity that operates the website you are using. Hudson Lighting Ltd is the data controller for hudsonlighting.co.uk and Hudson Lighting Limited is the data controller for hudsonlighting.ie.
| When | Data collected |
|---|---|
| Creating an account (Public or Trade) | Name, email address, phone number, company name, billing/delivery address, password (hashed), account type |
| Guest checkout | Name, email address, phone number, delivery address, optional password |
| Placing an order | Order details, payment method, delivery address, any order notes |
| Contacting us (email, phone, contact form) | Name, email address, phone number, message content |
| Requesting a brochure or marketing materials | Name, postal address, email address |
| Newsletter sign-up | Email address, name (if provided) |
| Social messaging (Facebook Messenger, Instagram DMs) | Your social media user ID, display name, profile picture URL, message content including any images or attachments you send |
| Lighting design consultations | Name, contact and project details, site plans, property information and an enquiry reference. With marketing consent, campaign tags and an advertising click reference may also be recorded against the enquiry. |
| Technology | Data collected | Purpose |
|---|---|---|
| Essential cookies | Session ID, login state, basket contents | Site functionality |
| First-party analytics (optional) | Page views, searches, shopping steps, visitor/session identifiers and aggregated click, scroll and attention data | Understanding how visitors use our site, with analytics consent |
| Google Ads (AW-11123832819) | Conversion events (add to cart, purchase) | Measuring advertising effectiveness |
| Meta Pixel and Conversions API (1043562269981773) | Page views, add to cart, checkout, purchase events | Measuring social media advertising effectiveness |
| Internal campaign attribution (optional) | Campaign tags (UTM) and an OpenAI advertising click reference (oppref) associated with an enquiry | Measuring ChatGPT advertising effectiveness through consented server-side events |
| Google reCAPTCHA | Browser and interaction data | Preventing spam and abuse on forms |
| Server logs | IP address, browser type, pages requested, timestamps | Security and troubleshooting |
We accept payments via Stripe (credit/debit cards) and BACS bank transfer. When you pay by card, your payment details are processed directly by Stripe and are never stored on our servers. We only receive a confirmation of payment and a truncated card reference. For BACS payments, you transfer funds to our bank account using details we provide.
| Purpose | Legal basis (GDPR) |
|---|---|
| Processing and fulfilling your orders | Contract performance |
| Managing your account | Contract performance |
| Sending order confirmations and delivery updates | Contract performance |
| Responding to your enquiries (email, phone, social messaging) | Legitimate interest / Contract performance |
| Sending brochures and marketing materials you’ve requested | Consent |
| Sending our newsletter | Consent (you can unsubscribe at any time) |
| Following up on dispatched marketing materials | Legitimate interest |
| Optional website analytics | Consent (analytics preference) |
| Running advertising campaigns and measuring their effectiveness | Consent (cookie consent) |
| Preventing fraud and ensuring site security | Legitimate interest |
| Complying with tax, accounting, and legal obligations | Legal obligation |
| Managing lighting design projects and storing design files | Contract performance / Legitimate interest |
We use Facebook Messenger and Instagram Direct Messages to communicate with customers who contact us through those platforms. When you message us on Facebook or Instagram:
This applies to messages sent to our UK page (Hudson Lighting Ltd) and our Ireland page (Hudson Lighting Ireland) on both Facebook and Instagram.
Cookies are small text files placed on your device when you visit our website. We use the following types:
These support essential functions such as session management, shopping baskets and sign-in. The hl_consent cookie remembers your analytics and marketing choices for 180 days on the current website hostname. Rejecting optional tracking does not disable shopping or prevent you from sending an enquiry.
With analytics consent, our first-party analytics records site usage, searches and shopping steps, using the hl_vid and hl_sid identifiers. Heatmaps summarise clicks, scroll depth and attention. These are not enabled before you choose analytics. Server-side analytics applies your choice on subsequent requests; withdrawing analytics stops further heatmap submissions from the current page.
With marketing consent, we load Google Ads and the Meta (Facebook) Pixel to measure advertising-related visits and actions, including successful design enquiries and purchases. Meta automatic advanced matching and automatic details are disabled in our business settings; Google enhanced conversions are disabled in our website configuration.
With marketing consent, confirmed enquiries and completed checkouts are also sent from our server to Meta. These events use the same event reference as browser events to avoid counting an action twice. They may include advertising browser identifiers, IP address and browser type, plus order value and currency for purchases. We do not include contact details, project notes or uploaded documents in these server events.
OpenAI browser tracking remains disabled even when you accept marketing cookies. OpenAI documents automatic contact capture for advanced matching, and we have not found a supported way to disable that matching. Its documented personalisation opt-out is not a contact-matching opt-out. We therefore do not load or initialise its browser SDK or send browser measurement events to OpenAI. Omitting contact fields from manually written events alone would not prevent an SDK from collecting them automatically.
With marketing consent, we send confirmed design-enquiry and completed-checkout events from our server to OpenAI to measure ChatGPT advertising. Events include an event reference, action, time and public page address. Purchase events include the order value and currency; an OpenAI advertising click reference (oppref) is included when available. Contact details, project notes and uploaded documents are not sent for this measurement. Temporary delivery records are retained for up to six days while delivery is retried. We also retain campaign tags with your enquiry to help understand how you found us.
Use the Cookie preferences button on the website to accept all, reject all, or choose analytics and marketing separately. Both optional categories are off until you choose them. You can change or withdraw your choice at any time. Withdrawal stops future measurement through our consent controls; it cannot recall information already sent. We also remove design-attribution data stored in this browser and accessible advertising identifiers when marketing is rejected. This does not erase an enquiry or attribution already recorded against it; contact us to exercise your data rights. Browser restrictions may prevent us from removing cookies set on other domains.
You can also manage provider and browser settings through:
We share your personal data only where necessary:
| Recipient | Purpose |
|---|---|
| Stripe | Processing card payments securely |
| Royal Mail / courier services | Delivering orders and marketing materials |
| Meta (Facebook/Instagram) | Delivering social media messages you send us; advertising measurement |
| OpenAI | ChatGPT advertising measurement with marketing consent |
| Advertising measurement with marketing consent; spam prevention on forms | |
| IONOS | Web hosting provider (servers located in the EU/UK) |
| Dropbox | Storing lighting design project files |
| Anthropic (Claude AI) | Automated email categorisation and customer service assistance (email content only, used to improve response times) |
We do not sell your personal data to any third party. We will disclose personal data if required by law or to protect our legal rights.
Some of our service providers (Stripe, Google, Meta, OpenAI, Anthropic) may process data outside the UK and the European Economic Area (EEA). Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner’s Office (ICO), or the service provider’s participation in an approved certification framework.
| Data type | Retention period |
|---|---|
| Customer accounts and order history | Duration of account + 7 years (for tax/legal obligations) |
| Guest checkout data | 7 years from order date |
| Social messaging conversations | 3 years from last message, or until you request deletion |
| Newsletter subscribers | Until you unsubscribe |
| Brochure dispatch records | 2 years |
| Lighting-design enquiries that do not become projects | 12 months from receipt. Enquiries that become projects or orders are reviewed under the applicable project or customer/order retention policy. |
Cookie preference (hl_consent) | 180 days from your last choice |
| Server logs | 90 days |
Under the UK GDPR and EU GDPR, you have the following rights:
To exercise any of these rights, please contact us using the details below. We will respond within one month.
Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us and we will delete it promptly.
We take appropriate technical and organisational measures to protect your personal data, including:
No method of transmission over the Internet is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.
If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority:
We may update this privacy policy from time to time. Any changes will be posted on this page with an updated “Last updated” date. We encourage you to review this policy periodically.
