Privacy Policy

CREST PROPERTIES (SCOTLAND) LTD.(“Crest”, “we”, “us”) is the data controller for personal data processed through creprosco.shop. Our registered office is 8 Pendreich Road Bridge Of Allan, FK9 4LY. You can reach us at support@creprosco.shop or +44 7513353153.

Crest sells physical home-furnishing kits and an optional membership. We are not a property, letting or rent-handling business, and we never hold deposits or property funds.

We collect only what we need:

• Order and delivery data — name, email, phone, delivery address, city, postal code and country you enter at checkout.
• Account and membership data — email and subscription status if you subscribe to a membership plan.
• Support data — the messages, subject and contact details you send through our contact and enquiry forms.
• Kit Matcher inputs — the property type, rooms, budget and style you enter to generate a recommendation.
• Payment metadata — confirmation of payment, amount, currency and a masked reference from our payment processor. We never receive or store your full card number.
• Technical data — limited device, browser and usage data needed to run and secure the site.

We do not collect identity documents or plaintext card numbers.

Our collection sources are:

• Directly from you — the details you enter at checkout, when you subscribe, use the Kit Matcher, or contact us through our forms.
• From our payment processor — confirmation of payment and a masked reference (never your full card number).
• From delivery carriers — dispatch and tracking status for your order.
• Automatically from your device — limited technical and usage data generated as you interact with the site.

Because Crest ships physical kits, order fulfilment requires certain delivery details. For order fulfilment we process your name, contact details, billing details and the shipping address (street, city, postal code and country) you provide at checkout.

• Shipping address and contact details — shared with delivery carriers strictly to complete order fulfilment and delivery.
• Order contents and history — the kits purchased, amounts and status, used for order fulfilment, returns, exchanges and support.
• Billing data — amount, currency and a masked payment reference from our payment processor for reconciliation; we never hold your full card number.

We keep order fulfilment records for the periods set out below and to meet tax and accounting obligations.

• To fulfil orders and deliver kits — performance of a contract.
• To manage membership subscriptions — performance of a contract.
• To provide support and respond to enquiries — legitimate interests and, for order issues, contract.
• To keep records for tax, accounting and dispute handling — legal obligation and legitimate interests.
• To secure the site and prevent fraud — legitimate interests.
• To send service messages (order and delivery updates) — contract. Marketing messages, where offered, rely on consent you can withdraw at any time.

We share data only with processors that help us run the store:

• Payment processing — Stripe, Inc., which handles card data on its own secure systems. Crest never sees your full card number.
• Hosting and infrastructure — our website hosting provider.
• Database and storage — our managed database provider for orders, membership and enquiry records.
• Delivery and logistics — the carriers who deliver your kit, using your delivery address and contact details.
• Email — our transactional email provider for order and support messages.

We do not sell your personal data.

Card payments are processed by Stripe on a secure, hosted checkout page. Your full card number, CVC and expiry are entered on Stripe’s systems and are never transmitted to or stored by Crest. We receive only confirmation of the payment, the amount, the currency and a masked reference for reconciliation.

Some processors operate outside the UK and EEA. Where data is transferred internationally, we rely on appropriate safeguards such as UK/EU Standard Contractual Clauses, the UK Addendum, or an adequacy decision, so your data keeps an equivalent level of protection.

• Order and transaction records: retained as required for tax and accounting, then deleted.
• Enquiry and lead data: kept up to 24 months, then deleted or anonymised.
• Kit Matcher inputs and any uploaded planning content: cached and cleared by default within 30 days.
• Membership records: kept for the life of the subscription and a limited period afterwards for legal and accounting needs.

Under UK GDPR and EU GDPR you can request access, correction, deletion, restriction, portability, and object to certain processing. Where we rely on consent, you can withdraw it at any time.

If you are a California resident, the CCPA/CPRA gives you the right to know, delete, correct and to opt out of the “sale” or “sharing” of personal information. We do not sell or share personal information as those terms are defined. To exercise any right, email support@creprosco.shop.

We use only the cookies needed to run the store, remember your cart and keep the site secure, plus limited analytics to improve the service. See the Cookie Policy for detail and choices.

The Kit Matcher produces reference recommendations only; it does not make legal or similarly significant automated decisions about you. Crest is not intended for children under 13, who may not use the service. Customers aged 13–17 must have the consent of a parent or guardian, whose contact details we may request for orders.

We use technical and organisational measures appropriate to the data we hold, and payment card data is isolated with our payment processor. If you have a concern, contact us first at support@creprosco.shop. UK and EEA users also have the right to complain to their data protection authority, such as the UK Information Commissioner’s Office.

Governing law for this policy is England and Wales. We may update this policy and will change the “last updated” date above. Material changes will be highlighted on this page.