Privacy policy

Last updated: 24 October 2026

This privacy notice explains how The Automation House collects and uses your personal data when you visit our website, buy from us or contact us. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

The data controller is Arran Group Limited, trading as The Automation House, a company registered in Scotland with company number SC898043, registered office Dippin Lodge, Dippen, Isle of Arran, Scotland, KA27 8RN. You can contact us about privacy at pj@theautomationhouse.co.uk.

2. The personal data we collect

Identity and contact data: name, company name and job title (for trade customers), billing and delivery addresses, email address and phone number.
Order and transaction data: products bought, order history, payment status, returns and warranty claims. Card details are handled by our payment providers; we do not see or store your full card number.
Account data: login details, preferences and saved addresses if you create an account.
Project and support data: information you give us about your property or installation (for example floor plans or system configuration) when you ask for advice, quotes or technical support.
Communications: emails, messages and other correspondence with us.
Technical and usage data: IP address, browser and device information, and how you use our website, collected through cookies and similar technologies.
Marketing preferences: whether you have agreed to receive marketing from us.

We collect this data directly from you, automatically when you use our website, and from service providers such as payment and delivery companies.

3. How we use your data and our lawful bases

To take, process and deliver your order, handle returns and warranty claims, and provide support (lawful basis: performance of a contract with you, or steps at your request before entering into one).
To keep accounting, tax and VAT records and meet other legal requirements (lawful basis: legal obligation).
To prevent fraud and keep our website and payments secure (lawful basis: legitimate interests in protecting our business and customers).
To manage trade accounts, send service messages, improve our website and products, and keep business records (lawful basis: legitimate interests in running and developing our business).
To send you marketing emails (lawful basis: your consent, or, for existing customers, our legitimate interests under the Privacy and Electronic Communications Regulations "soft opt-in" for similar products; you can opt out at any time).
To set non-essential cookies, such as analytics and advertising cookies (lawful basis: your consent, which you can give or withdraw through our cookie banner).

4. Who we share your data with

We share personal data only where necessary, with:

Shopify, which hosts our online store and processes data on our behalf as our data processor;
payment providers, who process payments and help prevent fraud;
our supplier, Loxone UK Ltd (part of the Loxone group), which receives your name, delivery address, phone number and order details so that it can deliver your order directly to you and, where relevant, handle returns and warranty repairs on our behalf;
couriers and delivery companies, to deliver your order;
the manufacturer (Loxone Electronics GmbH, Austria) or its authorised service partners, where needed to register a product or process a warranty or technical claim;
IT, email, accounting and professional advisers who support our business;
HMRC, law enforcement or other authorities where we are required by law.

Where Shopify uses data for its own purposes (for example for Shop Pay or its own fraud tools), Shopify acts as a separate controller under its own privacy policy, available at shopify.com/legal/privacy. We do not sell your personal data.

5. International transfers

Some of our providers, including Shopify, may process data outside the UK. Where this happens, we make sure the transfer is protected by UK adequacy regulations or by appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

6. How long we keep your data

Order, invoice and accounting records: six years from the end of the financial year in which the transaction took place, to meet tax and company law requirements.
Customer account data: while your account is active, and deleted or anonymised within two years of the account becoming inactive unless we need to keep it for the reasons above.
Support and warranty correspondence: for the warranty period of the product plus six years.
Marketing data: until you unsubscribe or withdraw consent, after which we keep a suppression record so that we do not contact you again.
Cookies: for the periods set out in our cookie banner.

7. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased in certain circumstances;
restrict or object to our processing, including objecting at any time to direct marketing;
data portability, where processing is based on consent or contract and carried out by automated means;
withdraw consent at any time, where we rely on consent;
not be subject to decisions based solely on automated processing that have legal or similarly significant effects. Payment fraud screening may be partly automated; you can ask for a human review.

To exercise any right, email pj@theautomationhouse.co.uk. We will respond within one month and there is normally no charge.

8. Complaints

If you are unhappy with how we have handled your data, please contact us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113.

9. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections and access controls. No system is completely secure, so please do not send sensitive information to us by unencrypted email.