Last reviewed: May 2026.
This policy explains how Telos Studio Ltd (“Telos”, “we”, “us”, “our”) collects and uses personal data when you visit teloswellness.co.uk, place an order with us, or otherwise interact with our business. We are the data controller for the personal data described below and we are committed to handling your information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
Telos Studio Ltd is a company registered in England and Wales (Company No. 14829076). Our registered office is The Old Mill, High Street, Stow-on-the-Wold, Gloucestershire, GL54 1BB. You can reach us at support@teloswellness.co.uk or by telephone on +44 7383 567 839. Our VAT number is GB 459 218 304.
2. The personal data we collect
We collect the data described below directly from you, automatically when you use our website, and from third parties who work with us to fulfil your order.
Information you give us. When you place an order or open a customer account we collect your name, billing and delivery addresses, telephone number, email address and the contents of your order. When you contact us by email, telephone or our enquiry forms we collect the content of your message, your contact details and any other information you choose to share. If you sign up to our quarterly letter we record the email address you provide and your consent timestamp.
Information collected automatically. When you browse our website we collect your IP address, device type, browser type, referring URL, pages viewed, the dates and times of your visits and certain cookie identifiers. This is described in more detail in our Cookie Policy.
Information from third parties. Our payment processors (Shopify Payments, PayPal and Klarna) confirm that a payment has cleared and provide the last four digits of the card used and the cardholder name. Couriers such as DPD, Pall-Ex and our white-glove installation partner share delivery status updates. We do not receive or store full payment card numbers at any time.
3. Why we use your data and our lawful basis
We process your personal data only where the law allows us to do so. The lawful basis we rely on depends on the activity.
- To take steps before entering into and to perform our contract with you (UK GDPR Article 6(1)(b)): processing your order, accepting payment, arranging delivery and installation, providing your warranty and home trial, dealing with complaints and refunds.
- Legitimate interests (Article 6(1)(f)): protecting our website from fraud and abuse, recovering debts, training our team, defending legal claims, improving our products, sending postal mail to existing customers about similar products. Where we rely on legitimate interests, we have weighed our interests against your rights and you may object at any time.
- Consent (Article 6(1)(a)): sending you our quarterly email letter, setting non-essential cookies (analytics and any marketing pixels), and any optional research we invite you to take part in. You may withdraw consent at any time without affecting prior processing.
- Compliance with a legal obligation (Article 6(1)(c)): keeping VAT and accounting records, responding to lawful requests from regulators or law enforcement, retaining warranty and consumer-rights records.
4. Who we share your data with
We share your data only with carefully selected processors and partners who help us run our business:
- Shopify Inc. hosts our store and processes core order data. Shopify acts as our data processor and operates from infrastructure in Canada, the United States and Ireland.
- Payment providers (Shopify Payments, PayPal Europe S.à r.l. et Cie, S.C.A., Klarna Bank AB) process your payment and run anti-fraud checks. Where Klarna or PayPal offer financing, they are independent controllers for the credit decision.
- Couriers and installation partners (currently DPD, Pall-Ex, and our UK fitting partners) receive your name, delivery address, phone number and order details to deliver and install your purchase.
- Email service providers (Klaviyo, used for transactional and marketing email) process your email address and engagement data on our behalf.
- Professional advisers (accountants, lawyers, insurers) where we are required to take advice or defend a claim.
- Public authorities (HMRC, the police, the courts) where we are legally required to disclose information.
We do not sell your personal data and we do not allow our processors to use it for their own commercial purposes.
5. International transfers
Some of our processors, including Shopify and Klaviyo, are based in or operate from outside the UK. Where personal data is transferred outside the UK we rely on the UK extension to the EU Standard Contractual Clauses (the International Data Transfer Addendum), the UK–US Data Bridge where applicable, or another lawful transfer mechanism. We carry out a transfer risk assessment before relying on these tools and apply additional safeguards (encryption in transit and at rest) where appropriate.
6. How long we keep your data
We keep personal data only for as long as we need it. As a guide:
- Order, invoice and tax records: at least six years from the end of the tax year in which the transaction took place, in line with HMRC requirements.
- Customer account data: while your account is active and for two years after your last order, then deleted or anonymised.
- Warranty records (lifetime warranty on cabinetry): for the life of the product plus six years.
- Marketing email subscribers: until you unsubscribe, plus a suppression record so we do not contact you again.
- Enquiry correspondence: 24 months from your last contact, then deleted.
- CCTV at our atelier (where in use): 30 days, then automatically overwritten.
7. Your rights under UK data protection law
You have the right to: be informed about how we use your data; access a copy of the personal data we hold about you; have inaccurate data corrected; have your data erased in certain circumstances; restrict our processing; object to processing based on legitimate interests or direct marketing; receive your data in a portable format; and not be subject to a decision based solely on automated processing that has a legal or similarly significant effect (we do not carry out such automated decision-making).
To exercise any of these rights, email support@teloswellness.co.uk with the subject line “Data Subject Request”, or write to the registered office above. We will respond within one calendar month. The service is free unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act and will explain why.
8. Marketing
We send our quarterly letter only to people who have asked for it. Every email we send carries a one-click unsubscribe link and unsubscribing is honoured immediately. If you have purchased from us, we may write to you by post about similar products in line with the soft opt-in under PECR; you can ask us to stop at any time.
9. Security
Personal data is held on Shopify’s PCI DSS Level 1 infrastructure and on a small number of UK and EU systems we use to run the business. Access is restricted to staff and contractors who need it for their work, all logins use strong passwords and multi-factor authentication, and devices are encrypted. We test our processes regularly and would notify the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of a personal data breach that posed a risk to you, and we would tell you directly where the risk is high.
10. Children
Our products are intended for adults. We do not knowingly market to or collect data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will remove it.
11. Cookies
For information about cookies and similar technologies on our website, including how to opt in or out, please see our Cookie Policy.
12. Complaints
If you are unhappy with how we have handled your personal data, please tell us first — we want the chance to put it right. You also have the right to complain to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, or via ico.org.uk.
13. Changes to this policy
We review this policy at least once a year and whenever the way we process data materially changes. The current version is dated above. Earlier versions are kept on file and available on request.