Legal Privacy policy

This notice covers this website. It explains what personal information we collect when you contact us or ask us for a catalogue, what we do with it, and the choices you have.

Last updated: 28 September 2026.

Who we are

This website is operated by Cyan Group Ltd, registered in England and Wales under company number 3452166. We are the data controller for the information described here — that means we decide why and how it is used.

For anything about your personal information, please write to gdpr@cyan-group.com, or by post to Cyan Group Ltd, 2nd Floor, 17 Heritage Park, Hayes Way, Cannock, WS11 7LT. For general business enquiries, use newbusiness@cyan-group.com.

What we collect and why

When you send us an enquiry

The enquiry form on our contact page asks for your name, company and email address. You can also give us a phone number if you would like us to call, and you can tell us about your project: which of our services you are interested in, a short brief, and optionally quantities, a date you need things by, delivery destinations, a budget range, and how you heard about us. There is also an optional field where you can say which of our catalogues interest you.

We use all of this to reply to you, to ask any questions we need to understand the brief, to prepare a quotation or recommendation, and to keep a record of the conversation. Only the name, company, email and brief are required — everything else is up to you, and leaving it out will not stop us responding.

When you request a catalogue

The catalogue request form asks for your name, company, email address, an optional phone number, and which catalogues you want. We use these to email you the links to the catalogues you selected, and to follow up on that request — for example, to answer a question about something you saw, or to check whether you need anything else.

You do not have to agree to receive marketing to get the catalogues you asked for. We do not add you to a marketing list automatically, and there is no tick box on our forms that signs you up to one.

Records we keep of your messages

Enquiries and catalogue requests are saved in our own database and are also sent to our team by email, so the contents of what you send us are held in both. Our email notifications use your email address as the reply-to address, so that replying to you is straightforward.

Technical and security information

Our website and its hosting produce ordinary technical records — for example server and error logs used to keep the site working and to investigate faults. Our forms include simple anti-abuse measures, such as a short delay between repeat submissions from the same email address, which involves briefly checking recent requests. If you accept optional cookies, we also switch on analytics and advertising technologies to understand visits and measure the effectiveness of our advertising — see the cookies section below. None of them load before you accept.

If you have a staff login

Parts of this site are restricted to Cyan Group staff and administrators, who sign in with an email address and password. That account information is used only to control access.

Our legal basis

Data protection law requires us to have a lawful reason for using your personal information. The reasons we rely on are:

• A contract with you, or steps you ask us to take towards one. Where we are dealing with you as an individual customer — or you have asked us to take steps towards a contract with you personally, such as preparing a quotation in your name — we use your details to do what is needed for that.
• Our legitimate interests. Most of what we do with your details falls here: responding to business-to-business enquiries (including where you contact us on behalf of your employer), fulfilling the catalogue requests you make, appropriate follow-up on those conversations, keeping records of our dealings with you, keeping this website secure and working, and protecting our legal position if we ever need to. When we rely on this, we consider whether it is fair to you — and you can object (see below).
• Legal obligations. Sometimes we have to use or keep information to comply with the law.

We do not ask for special category information (such as health data) through this website. Americano orders can be paid by bank transfer or through Stripe’s secure card checkout. We do not receive or store your full card number or security code.

Who we share it with

We do not sell your personal information. We share it only where it is needed:

• Stripe. When you choose Card for an Americano order, Stripe receives the order amount, contact and delivery details needed to process payment and calculate tax. Card details are entered directly into Stripe’s secure form. We keep payment references and status to confirm your order; payment security tools are required for that checkout and are separate from optional advertising cookies.
• Our website, database and email providers. This website is built and hosted on the Lovable platform, which also provides the database where enquiries and catalogue requests are stored and the service that sends our notification and catalogue emails on our behalf. The database for this site is hosted in the European Union (Stockholm region).
• Suppliers and subcontractors. Where a project requires it — for example manufacturing, printing, packing or delivery — we pass on what those partners need to do the work, such as a delivery address and contact name.
• Professional advisers and insurers, where reasonably necessary for advice, insurance or a legal claim.
• Anyone we are legally required to disclose to.
• Meta Platforms Ireland Limited. If you accept optional cookies, the Meta Pixel sends information about your visit to Meta so that we can measure visits and advertising performance. Meta may combine that information with information it already holds about you. This sharing does not take place through the Pixel when you decline optional cookies.
• Google. Our optional measurement tools are delivered through Google Tag Manager, a service operated by Google. If you accept optional cookies, any analytics or advertising tags we activate through it — for example Google Analytics or Google Ads — would send information about your visit, browser and device to Google so that we can measure visits and advertising performance. Before you accept, these tools are switched off and send nothing that identifies you.

Some of these providers may process information outside the UK. Lovable, which hosts this website and its database, publishes a data processing agreement describing its own transfer arrangements: it states that transfers outside the UK or the European Economic Area are covered by adequacy decisions or by standard contractual clauses approved for the purpose (the European Commission's 2021 standard contractual clauses, and the UK Information Commissioner's addendum to them for UK data). Those are Lovable's stated arrangements for its own service; if you would like to know how they apply to the information you give us, please ask using the contact details below.

Cookies and your browser

When you first visit, we ask whether you want to accept or decline optional cookies. Declining is as easy as accepting. We save your choice in your browser so we can respect it on later visits. You can reopen the choice at any time using Cookie settings in the footer.

Necessary browser storage

We use necessary browser storage without asking for consent because it provides features you request or records your privacy choice. This includes your cookie choice, a saved product project list, and a login session for authorised staff. Your project list stays on your device and is not sent to us until you choose to make an enquiry. The Americano order basket also stays in your browser until checkout; we store the details you submit to process your order, proof, invoice and delivery. Clearing browser storage can remove your choice, empty that list or sign staff out.

Optional analytics and advertising tools

We use Google Tag Manager, a service operated by Google, to manage the optional measurement tools on this website. It loads with the site so that it can respond to your choice, but every tool it controls is set to “denied” until you accept: no cookies are set, no identifiers are created and visitors are not tracked before that point. If you decline, it stays that way.

If you accept optional cookies, these tools may include the Meta Pixel supplied by Meta Platforms, and others such as Google Analytics or Google Ads if we add them. For example, the Meta Pixel records a page-view event as you move around the site and can use browser identifiers such as _fbp and, after a visit from a Meta advert, _fbc. The information sent can include the page visited, time of the visit, browser and device information, and your IP address. We use this to measure whether our advertising leads people to the site and which pages are visited. With your permission, Americano basket additions, checkout starts and placed orders are also reported to Google and Meta, including product codes, quantities and order values excluding VAT. These events do not include your name, email, delivery address or bank details. You can withdraw permission using Cookie settings in the footer.

Our legal basis for this optional tracking is your consent. The tools are not loaded and no page-view events are sent before you accept. If you decline, they remain off. If you later withdraw consent through Cookie settings, we switch these tools off for this site and remove the cookies we can access, including any Meta cookies. Withdrawal does not affect processing that took place while consent was active.

Meta and Google each act separately in deciding how they use information they receive. You can read Meta's information at facebook.com/privacy/policy and Google's at policies.google.com/technologies/partner-sites. You can also clear cookies and local storage through your browser settings.

Catalogue links and other sites

Our catalogues are hosted by Flipsnack, an external service. When you ask for catalogues, we email you links to them; the catalogues are not embedded in this website and we do not attach any of your form details to those links. Following a link takes you to Flipsnack's own website, where their privacy notice and cookies apply, not ours. The same is true of any other external site we link to.

How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it. In practice, how long that is depends on:

• whether your enquiry becomes a live project, and how long that project runs;
• whether we may reasonably need the record for a follow-up, a repeat order or a query;
• how long we need to keep records to meet legal, accounting, insurance or dispute-related obligations.

When none of those reasons continue to apply, the information is no longer needed and is removed. If you would like your details removed, ask us and we will do so unless we have to keep them for one of the reasons above.

Security

Enquiries and catalogue requests are stored in a database that is not publicly readable — access is restricted to authorised Cyan Group accounts and the site's own server code. Our internal notifications go only to fixed Cyan Group addresses that cannot be changed by a website visitor. No system can be guaranteed completely secure, but we take reasonable steps to protect the information you give us.

Your rights

You have rights over your personal information. Some of them apply only in certain circumstances, so we have noted where that is the case:

• Be informed — which is what this notice is for.
• Access a copy of the personal information we hold about you, along with information about how we use it.
• Correction of anything inaccurate, and completion of anything incomplete.
• Erasure of your information — this applies in certain circumstances, for example where we no longer need it, or where you have objected and we have no overriding reason to continue. It does not apply where we must keep the information by law or need it for a legal claim.
• Restriction of how we use your information in certain circumstances, such as while we check a correction you have asked for.
• Object to our use of your information — see the next section.
• Portability — receiving certain information in a machine-readable format. This applies where we are using it based on your consent or a contract with you, and by automated means.
• Withdraw consent, where we have asked for your consent for something. Withdrawing it does not make our earlier use unlawful.

To use any of these rights, contact us at gdpr@cyan-group.com or by post to the address above. We may need to check who you are before we act on a request.

Objecting to our use of your details

You can object at any time to us using your personal information on the basis of our legitimate interests — for example, to follow-up contact after an enquiry or catalogue request. If you object, we will stop unless we can show compelling grounds to continue, or we need the information for a legal claim.

You can also tell us at any time to stop sending you marketing, and we will stop. There is no qualification on that one. Email gdpr@cyan-group.com and say the word, or reply to any message we have sent you.

Complaints

If you are unhappy with how we have handled your personal information, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes to this notice

We may update this notice when the website or the way we handle information changes. The current version is always the one published here.

Contact us

Cyan Group Ltd
2nd Floor, 17 Heritage Park, Hayes Way, Cannock, WS11 7LT
Privacy enquiries: gdpr@cyan-group.com
General enquiries: newbusiness@cyan-group.com