Privacy
What we do with your details
We sell lanterns, not lists. This page sets out exactly what arrives with an order, where it sits, who else ever sees it and how long before it is deleted.
Who is responsible
The controller of any personal data collected through this site is:
Lanternrow Ltd
42A Park Ln, Norwich NR2 3EF, United Kingdom
Company No. 11482097, registered in England and Wales
VAT GB348112944
Registered with the Information Commissioner’s Office, reference ZB512204
[email protected] · +44 1603 614266
We are a workshop of five people and have not appointed a data protection officer; UK GDPR does not require one of a business this size. Anything on this page is answered by whoever picks up the phone, and if they cannot answer it they will find out and ring you back.
What we actually collect
Three things, and only three:
- —The enquiry form. Your name, email address, phone number if you give one, the postcode you want us to deliver to, what you wrote in the message box and the contents of the basket at the moment you pressed send.
- —The cutting list signup. Just an email address and the date you added it.
- —Server records. Your IP address, the time, the page you asked for, the size of what was sent back, the page you came from if your browser passes it, and your browser and operating system.
The basket itself is not one of them. It lives in your own browser under the name basket-lanternrow and we cannot read it until you press send on the form. Clearing site data for lanternrow.live removes it.
Why we hold it, and on what legal basis
| What | Why | Lawful basis |
|---|---|---|
| Enquiry form | To price the job, order the parts and get the delivery to the right address | Article 6(1)(b) — steps before, and performance of, a contract |
| Cutting list | To send four emails a year about stock and prices | Article 6(1)(a) — your consent |
| Server records | Keeping the site up and turning away automated abuse | Article 6(1)(f) — our legitimate interest in a working, unabused site |
| Abuse counter | Refusing more than five messages an hour from one connection | Article 6(1)(f) — same interest |
The abuse counter deserves a sentence of its own. We write a small file whose name is a SHA-1 hash of your IP address and the current hour, containing a number. The address cannot sensibly be recovered from the hash, the file holds nothing else, and it is never read again once the hour turns over.
How long any of it stays
| Record | Kept for |
|---|---|
| Enquiry that did not become an order | Six months, then deleted |
| Order, invoice and delivery note | Six years from the end of the accounting period, because HMRC and the Companies Act 2006 require it |
| Cutting list address | Until you ask to come off, then deleted within seven days |
| Server records | Seven days, unless we are looking into an incident |
| Abuse counter file | One hour |
We do not keep “just in case” copies. When the period above runs out the record goes, including from the backup set at its next rotation, which is thirty days behind the live system at most.
Who else ever sees it
Inside the business, only the person dealing with your job. Outside it:
- —the company that hosts the site and the mailbox, under a written processor contract required by Article 28, on servers in the United Kingdom;
- —the courier, when a parcel goes outside our own delivery runs — name, address and a phone number if you gave one;
- —our accountant and, through them, HMRC, for the invoices they are legally obliged to see.
That is the whole list. We do not sell, rent or swap addresses, we run no advertising pixels, and nobody buys space in the cutting list.
Fonts loaded from Google
The typefaces on this site — Roboto, Roboto Condensed and Roboto Slab — are fetched from fonts.googleapis.com and fonts.gstatic.com, run by Google Ireland Limited. Your IP address reaches Google as part of that request, because without it the file cannot be sent back. No cookie is set.
Our basis is Article 6(1)(f): a site that looks the same on every machine and loads quickly. Google may process the request outside the United Kingdom; those transfers rely on the UK adequacy regulations and, where they do not apply, on the International Data Transfer Addendum. If that is not acceptable to you, blocking the two domains leaves the site perfectly readable in your system font.
Keeping it safe
The site is served over TLS. The enquiry form has a hidden field that must stay empty, a check on how quickly the form was completed, and the hourly counter described above — between them they stop essentially all of the automated traffic.
Worth saying plainly: we never take card details on this site. There is no checkout. You send a list, we price it, and payment happens by bank transfer or in person when the goods change hands. If a page ever asks you for a card number in our name, it is not ours.
What you can ask us to do
Under UK GDPR you may ask for a copy of what we hold (Article 15), ask us to correct it (Article 16) or delete it (Article 17), ask us to stop using it for a while (Article 18), ask for it in a portable form (Article 20), and object to anything we do on the legitimate-interests basis (Article 21). Where we rely on consent you can withdraw it at any time without affecting what was lawful before.
Email or ring and we will deal with it within one month, free of charge. We will ask one or two questions to be sure we are talking to the right person — usually the address an order went to.
If we get it wrong you can complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, on 0303 123 1113 or at ico.org.uk. We would rather hear about it first, but it is your call.
Children
Nothing here is aimed at children and we do not knowingly hold data about anyone under eighteen. If a child has sent us something through the form, tell us and it will be deleted the same day.
Changes to this page
When the site changes, this page changes with it — before the change goes live, not after. The version number and date at the top tell you which text you are reading. People on the cutting list are told about anything substantial with the next quarterly email.