Privacy Policy
Last updated: 17 October 2026
This policy explains how Plumbing Objects collects, uses and protects your personal data when you visit or buy from plumbingobjects.com, and the rights you have. It is written to meet the EU General Data Protection Regulation (GDPR), the UK GDPR, and related data-protection laws.
1. Who we are (Data Controller)
This website, plumbingobjects.com (“Plumbing Objects”, “we”, “us”, “our”), operates an online store selling plumbing products and fixtures, and serves customers internationally.
The data controller responsible for your personal data is:
- Krome USA Inc., operating as Plumbing Objects
- 3069 McCall Drive, Suite 7, Atlanta, GA 30340, United States
- Email: info@plumbingobject.com
- Telephone: +1 678-666-2001
- Website: https://plumbingobjects.com
If you have any questions about this policy or how we handle your personal data, please contact us using the details above.
2. Scope of this policy
This policy explains what personal data we collect through this website, why we collect it, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have. It also explains, in Section 10, exactly which cookies and similar technologies we use and how you control them.
3. The personal data we collect
Depending on how you use the site, we may process the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account & order data | Name, email address, telephone number, billing and shipping address, order history, account credentials | Provided by you when you create an account or place an order (WooCommerce) |
| Enquiry & contact data | Name, email, phone and the content of your message | Provided by you via our contact form |
| Newsletter data | Email address | Provided by you if you subscribe to our newsletter |
| Payment data | Payment method and transaction confirmation. Full card details are processed directly by our payment provider and are not stored on our servers beyond what is retained in the order record. | Provided by you at checkout; processed by the payment provider |
| Technical & usage data | IP address, and device and browser information needed to deliver the site | Collected automatically to serve and secure the website |
| Security & server logs | IP address, request metadata and security events | Collected automatically by our hosting provider for security and operation |
We do not intentionally collect special-category data (such as health, biometric or political data) through this website. Please do not submit such data to us.
4. How and why we use your data, and our legal bases
We only process your personal data where we have a lawful basis under Article 6 GDPR:
| Purpose | What this involves | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Operating the shop & fulfilling orders | Processing orders, payments, delivery, accounts, customer service, and order-related communications | Contract (Art. 6(1)(b)) |
| Responding to enquiries | Handling contact-form submissions | Legitimate interests (Art. 6(1)(f)) in responding to you, and/or consent (Art. 6(1)(a)) where you provide it |
| Sending our newsletter | Sending product news and offers to subscribers | Consent (Art. 6(1)(a)) — you may unsubscribe at any time |
| Displaying the site’s typefaces | Serving display fonts via Adobe Fonts (see Section 10) | Legitimate interests (Art. 6(1)(f)) — you can opt out |
| Security, hosting & site delivery | Serving the website reliably and protecting it against abuse | Legitimate interests (Art. 6(1)(f)) in keeping the site secure and available |
| Legal & tax compliance | Retaining invoices and orders and responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object to processing based on legitimate interests (see Section 8).
5. Who we share your data with
We share personal data only where necessary, with:
- Payment provider — CyberSource / Visa Acceptance Solutions, to process card payments securely at checkout.
- Shipping carrier — UPS, which receives the destination address and package details to calculate live shipping rates and deliver your order.
- Hosting provider — our website is hosted by WP Engine, which processes server and security logs (including IP addresses) on our behalf.
- Font provider — Adobe, which serves some of the site’s display typefaces (see Section 10).
- Professional advisers and authorities — where required by law, regulation, or to establish, exercise or defend legal claims.
Our newsletter is sent from our own website infrastructure, so your subscription email is not shared with a third-party marketing platform. We do not sell your personal data. Each processor acts under a written data-processing agreement and may only process your data on our instructions.
6. International data transfers
We are based in the United States, and some of our providers are located in the United States, including Adobe and the content-delivery networks that serve common website libraries. For visitors in the European Economic Area (EEA) and the United Kingdom, this means your personal data is transferred to the United States.
Where a provider is certified under the EU–US Data Privacy Framework (DPF) — as Adobe is — that framework covers the transfer. Otherwise, we rely on the European Commission’s Standard Contractual Clauses (SCCs) (with the UK Addendum for UK data), together with supplementary measures where needed. You can request more information about these safeguards using the contact details in Section 1.
7. How long we keep your data (retention)
We keep personal data only for as long as necessary for the purposes described above:
- Order and invoice records — retained as long as necessary to meet our tax, accounting and legal obligations (generally up to 7 years).
- Account data — retained while your account is active; you can ask us to delete it at any time.
- Newsletter subscription — retained until you unsubscribe.
- Contact-form enquiries — retained for a reasonable period after your enquiry is resolved (up to about 24 months).
- Cookie consent records — logged as proof of your consent choices and refreshed periodically.
- Server and security logs — retained for a short period for security and troubleshooting.
Erasure on request is enabled: when you make a verified erasure request, personal data within your orders and account is removed in line with Section 8, except where we are legally required to retain certain records.
8. Your rights
Subject to the conditions and exemptions in applicable law, you have the right to:
- Access — obtain a copy of the personal data we hold about you;
- Rectification — have inaccurate or incomplete data corrected;
- Erasure — ask us to delete your data (the “right to be forgotten”);
- Restriction — ask us to limit how we use your data;
- Portability — receive certain data in a portable, machine-readable format;
- Object — object to processing based on legitimate interests (including the Adobe Fonts service), and to direct marketing at any time;
- Withdraw consent — where we rely on consent (such as the newsletter), withdraw it at any time, without affecting the lawfulness of processing before withdrawal.
To exercise any of these rights, contact us using the details in Section 1. We will respond within the timeframe required by law (generally one month). We may need to verify your identity before acting on a request.
Right to complain: if you believe we have not handled your data properly, you may lodge a complaint with your local data protection supervisory authority — in the EEA, your national Data Protection Authority; in the UK, the Information Commissioner’s Office (ICO).
9. Children
This website and shop are intended for adults and business customers. We do not knowingly collect personal data from children. In line with the GDPR, visitors under the age of 16 should not consent to optional services themselves — a parent or legal guardian should agree on their behalf. If you believe a child has provided us with personal data without appropriate consent, please contact us and we will delete it.
10. Cookies and similar technologies
We use cookies and similar technologies to operate the website. We use Real Cookie Banner to obtain and manage your consent. Importantly, we do not use any analytics, advertising or social-media tracking technologies on this website — there is no Google Analytics, no advertising pixel and no behavioural tracking.
10.1 How consent works
- When you first visit, our cookie banner lets you Accept all, continue without consent, or set your preferences individually.
- Only strictly necessary (essential) technologies run automatically, because the site cannot function without them.
- One functional service — Adobe Fonts — loads by default on the basis of our legitimate interest in presenting the site correctly. You can object to it at any time through the cookie settings, and the site will fall back to standard system fonts.
- You can change or withdraw your choices at any time — withdrawing is as easy as giving consent — using the floating “Cookie settings” control shown on every page, which also lets you view your consent history.
- Your choice is stored so we can prove consent and respect your preferences.
10.2 Cookie and service categories
Essential — always active (strictly necessary; no opt-in required)
| Service | Provider | Purpose | Legal basis |
|---|---|---|---|
| WooCommerce | Self-hosted (us) | Shopping cart, checkout, session and order functionality (cookies such as woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*) | Contract / strictly necessary |
| Real Cookie Banner | Self-hosted (software by devowl.io; your consent choices are stored in our own website database and are not sent to the vendor) | Stores your cookie-consent choices | Legal obligation (Art. 6(1)(c)) |
Functional
| Service | Provider | Purpose | Legal basis |
|---|---|---|---|
| Adobe Fonts (Typekit) | Adobe (United States) | Serves some of the site’s display typefaces from Adobe’s content-delivery network. Your IP address is transmitted to Adobe to deliver the fonts; it sets no tracking cookies. | Legitimate interest (Art. 6(1)(f)), opt-out; US transfer covered by the EU–US Data Privacy Framework |
No statistics or marketing cookies. We run no analytics, advertising or tracking services, so there are no statistics or marketing categories to accept or reject.
Non-tracking delivery assets. To display correctly, the site also serves its main typeface (Bai Jamjuree) from our own server — so no request is made to Google Fonts — and loads standard website libraries from reputable content-delivery networks (jsDelivr, Cloudflare cdnjs and the jQuery CDN) and a core WordPress asset from WordPress.org (s.w.org). These deliver code or fonts only and do not track you; they may receive your IP address purely to serve the file.
10.3 Managing cookies in your browser
In addition to our cookie settings, you can control or delete cookies through your browser settings. Blocking essential cookies may stop parts of the site (such as the cart or checkout) from working.
11. How we protect your data
We use appropriate technical and organisational measures to protect your personal data, including encryption in transit (HTTPS), access controls, and reputable managed hosting (WP Engine). No method of transmission or storage is completely secure, but we work to protect your data and to notify you and the relevant authority of any breach where legally required.
12. Changes to this policy
We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you or ask for renewed consent.
13. Contact
For any privacy question or to exercise your rights, contact us at:
- Email: info@plumbingobject.com
- Telephone: +1 678-666-2001
- Postal address: Krome USA Inc., 3069 McCall Drive, Suite 7, Atlanta, GA 30340, United States