Hiddensystems Limited, trading as Hidden Systems. Last updated 31 October 2026, effective 1 November 2026. How we use cookies is explained in our Cookie Policy.
1. Who we are
1.1 Hiddensystems Limited, trading as Hidden Systems (“we”, “us”), is the controller of the personal data described in this policy. We are registered in England and Wales under company number 05963873. Our trading address is The Old Court House, London Road, Ascot, Berkshire, SL5 7EN, and our registered office is 32 Merlin Clove, Winkfield Row, Bracknell, RG42 7TD.
1.2 For privacy questions or requests, contact James Clayton at info@hiddensystems.co.uk, telephone 01344 511 612, or write to us at the address above. We are not required to appoint a Data Protection Officer.
2. The personal data we collect and where it comes from
2.1 Directly from you, when you:
(a) buy online. We collect your name, billing and delivery addresses, email, telephone number, order details and, if you create one, your account log-in. Card payments are handled by Stripe, and we do not see or store your full card number.
(b) send an enquiry or use our contact forms. We collect your name, email, telephone number (which is required), your message and the product you are asking about. We require your telephone number because most Hi-Fi enquiries are best handled by a call: we use it to discuss your system, arrange demonstrations and confirm availability.
(c) visit our showroom or book a home visit. We collect your contact details, address, details of your system and listening room, access information and appointment notes. We only record any health information, such as mobility or access needs, if you choose to tell us, and we use it only to plan the visit.
(d) attend an event. We collect your registration details and any dietary or access requirements you give us. We may also take photographs or video at the event (see clause 15 of our Terms and Conditions).
(e) trade in equipment. We collect a description of the item, its serial numbers, your proof of ownership and identity documents, and the valuation.
(f) use our servicing and repair services. We collect details of the equipment and fault, service records and your communications with us.
(g) sign up for our newsletter. We collect your name, email address and your marketing preferences.
2.2 Automatically, when you use our website. We collect device, browser and usage data through cookies and similar technologies. See our Cookie Policy.
2.3 From third parties:
(a) Stripe, which tells us whether your payment succeeded and gives us fraud-check results;
(b) Henley Audio and couriers, which give us delivery status updates;
(c) manufacturers, which give us warranty and registration information;
(d) Google Business Profile, Facebook, Instagram, TikTok and LinkedIn, which show us messages, reviews and comments you post about us or send to us; and
(e) our historic customer records, which were originally held in Sage and are now held in our customer relationship system.
3. Why we use your data and our lawful bases
| Purpose | Data used | Lawful basis (UK GDPR) |
|---|---|---|
| Processing and delivering orders, including drop-shipped orders, collection and installation | Identity, contact, address, order and payment status | Contract |
| Responding to enquiries and preparing quotations | Identity, contact (including telephone), enquiry details | Steps at your request before entering a contract, and legitimate interests (responding to customers) |
| Home demonstrations, installation, set-up and servicing | Contact, address, access notes, system details, service history | Contract. Explicit consent for any health or access information you choose to give us |
| Trade-ins | Identity, ownership evidence, item details | Contract, and legitimate interests (preventing the handling of stolen goods) |
| Warranty registration with manufacturers | Name, contact, product, serial number, purchase date | Contract (where you ask us to register), or legitimate interests (supporting your warranty) |
| Payments and fraud prevention | Transaction data and device signals (via Stripe) | Contract, and legitimate interests (fraud prevention) |
| Accounting, tax and record-keeping | Order and payment records | Legal obligation |
| Handling complaints and legal claims | Communications, order records | Legal obligation, and legitimate interests (resolving disputes) |
| Email marketing to existing customers and people who have asked about buying from us (soft opt-in) | Name, email | Legitimate interests (direct marketing), as permitted by PECR regulation 22(3), with an opt-out every time |
| Newsletter sign-ups | Name, email, preferences | Consent |
| Event registration and attendance | Contact, requirements, photographs | Legitimate interests (running events). Explicit consent for any health or dietary information |
| Website security and spam protection on our forms | IP address, browser information, form content | Legitimate interests (keeping our website and forms secure) |
| Website analytics and advertising measurement | Cookie and device data | Consent (see our Cookie Policy) |
| Social media pages and advertising | Interactions with our pages, and pixel data if you consent | Legitimate interests (managing our pages). Consent for pixels and tags |
3.1 We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
3.2 Our website and services are not aimed at children under 18.
4. Who we share your data with
4.1 We share data only where necessary, with:
| Recipient | Role | What for | Location and transfer safeguard |
|---|---|---|---|
| Stripe (Stripe Payments Europe Ltd / Stripe, LLC) | Payment processor, and independent controller for its own fraud and regulatory checks | Card payments, fraud prevention | EU and US. US transfers are covered by Stripe’s certification to the UK Extension to the EU-US Data Privacy Framework, plus the IDTA/UK Addendum in Stripe’s data processing terms |
| Lilac Software | Website host and administrator | Hosting, maintenance and support for our WordPress/WooCommerce site | UK company. If data is stored outside the UK, it is protected as described in 4.3 |
| Automattic (WooCommerce services, Jetpack) | Processor | Store functions, site security and statistics | US. Covered by Automattic’s certification to the UK Extension to the EU-US Data Privacy Framework |
| Google (Analytics, Site Kit, Search Console, Google for WooCommerce, Business Profile) | Processor for analytics. Independent controller for some advertising and Business Profile services | Analytics, search performance, product listings, reviews | US. Covered by Google LLC’s certification to the UK Extension to the EU-US Data Privacy Framework |
| Atlassian (Trello) | Processor | Our customer relationship records | US. Covered by Atlassian’s certification to the UK Extension, which includes Trello, Inc. |
| Zapier | Processor | Sending website enquiries into Trello | US. Covered by Zapier’s certification to the UK Extension |
| Sender (UAB Sender.lt) | Processor | Email marketing | Lithuania (EU). The UK recognises the EU as adequate |
| Meta (Facebook and Instagram, Meta Business Suite) | Joint controller for Page Insights. Independent controller otherwise | Social media pages, messages, advertising (only with your consent) | Ireland and US. Meta is responsible for its own transfers under its terms |
| TikTok, LinkedIn | Independent controllers | Our social media pages. We do not use their advertising tags on our website | Their own privacy policies and safeguards apply |
| Henley Audio | Independent controller / service provider | Direct delivery of Pro-Ject Audio Systems, Ortofon and WiiM orders | UK |
| Couriers (including UPS) | Independent controllers | Delivery | UK |
| Manufacturers (Linn, Naim Audio, Devialet, Kudos Audio, Lejonklou, Totem Acoustic and others) | Independent controllers | Warranty registration and claims, when needed or requested | UK, EU (France, Sweden), Canada. The UK recognises these countries as adequate |
| Our accountant | Independent controller / processor | Accounts and tax | UK |
| Professional advisers, insurers, police and regulators | Independent controllers | Legal claims, insurance, crime prevention, legal obligations | UK |
4.2 We do not sell your personal data.
4.3 Where we transfer data outside the UK, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US companies, or on the ICO’s International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses. Contact us for more information about these safeguards.
5. How long we keep your data
| Data | Retention period |
|---|---|
| Orders, invoices and payment records | 6 years from the end of the financial year of the transaction (tax and limitation periods) |
| Customer account and CRM record | Until you ask us to close it, or 6 years after your last purchase or service, whichever is earlier, unless still needed for warranty or legal claims |
| Enquiries that do not lead to a purchase | 24 months from your last contact |
| Home-visit, installation and servicing records | 6 years after the last work we did for you (warranty and legal claims) |
| Trade-in and ownership evidence | 6 years from the trade-in |
| Event registrations | 12 months after the event. Photographs used in marketing are kept until you ask us to remove them |
| Newsletter list | Until you unsubscribe. We then keep your email on a suppression list so that we do not contact you again |
| Health or access notes | Deleted after the visit or event, unless you ask us to keep them for future visits |
| Records imported from Sage | Reviewed and cleansed by 31 March 2027, in line with this table |
6. Marketing and how to opt out
6.1 Existing customers and enquirers. If you buy from us, or ask about buying from us, we may email you about similar products, services and events. This is called the soft opt-in. We will always give you the chance to refuse when we collect your details, and in every message we send.
6.2 Everyone else. We will only email you if you have signed up to our newsletter.
6.3 Opting out. You can opt out at any time by clicking “unsubscribe” in any email, emailing info@hiddensystems.co.uk or calling 01344 511 612. Opting out is free.
6.4 Telephone and post. We do not make marketing calls to numbers registered with the Telephone Preference Service unless you have told us you are happy to receive them. We may send occasional postal mailings to customers, and you can ask us to stop at any time.
7. Your rights
7.1 You have the right to:
(a) access your personal data;
(b) have inaccurate data corrected;
(c) have your data erased;
(d) restrict how we use your data;
(e) data portability;
(f) object to our use of your data, and in particular to object to direct marketing at any time, which we will always respect; and
(g) withdraw your consent at any time, where we rely on consent.
7.2 We will respond within one month. If we need you to clarify your request, the time limit pauses until you reply. For complex or numerous requests, we may extend the time limit by up to two further months and will tell you why. We usually do not charge a fee.
8. Complaints
8.1 If you are unhappy with how we have handled your personal data, please complain to us first, using the details in section 1.2. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed and tell you the outcome.
8.2 You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
9. Security
9.1 We use appropriate technical and organisational measures to protect your data. These include encrypted (HTTPS) connections, card processing by Stripe, access controls and two-factor authentication on our systems, and staff training.
10. Changes to this policy
10.1 We will update this policy when our practices or the law change. We will tell you about significant changes by email or with a notice on our website.