Privacy notice

Last updated: October 2026

Who we are

The Heritage Exchange Ltd is responsible for the personal data described here (in data protection terms, we're the "controller"). We're registered in England and Wales, company no. 17452426. Registered office: 7 Parrish View, Pudding Chare, Newcastle upon Tyne NE1 1UD. Email: lucas.barker@theheritageexchange.uk

We work only with businesses. We're an importer of Japanese spectacle frames for optical practices in Great Britain. We can offer UK Responsible Person services to overseas frame makers. Most of what we hold is business contact details, which still count as personal data. This notice explains how we handle them.

What we collect, why, and our legal basis

If you contact us

Through the form on this site or by email: your name, practice or company, email address and anything you put in your message. We use it to reply and to deal with your enquiry.

Legal basis: our legitimate interest in answering business enquiries, or steps you've asked us to take before a contract. You don't have to give us your details, but we can't reply without an email address.

If you work at a practice we'd like to supply

Your name, job title, business email and phone number, and your practice's name and address. We get these from public sources, such as your practice's website and Companies House, and from business cards and conversations at trade events. We use them to introduce our frames and services and to keep in touch.

Legal basis: our legitimate interest in telling businesses about what we offer. Electronic marketing must also comply with PECR: where consent is required, including for sole traders and some partnerships, we obtain it before sending marketing unless a valid statutory exception applies. You can tell us to stop at any time, and we will.

If you're a frame maker, or work for one

Your name, role, business contact details, business card and our correspondence. We get these from you, at trade shows, and through introductions from trade organisations. We use them to discuss working together, to buy products, to act as your UK Responsible Person if you appoint us, and to introduce your products to businesses in Great Britain.

Legal basis: our legitimate interests in discussing and managing business relationships; a contract, or requested steps before a contract, where you are personally a party to it; and our legal duties when we act as a UK Responsible Person. Where you work for a company, we normally use legitimate interests for its business contact details.

If we do business together

Contact, order, delivery, invoice and payment details.

Legal basis: a contract where you are personally a party to it; our legitimate interests in managing orders and business relationships where you represent a company; and our legal duty to keep tax and accounting records.

If you report a problem with a frame

Your contact details and what you tell us. Where we act as UK Responsible Person for a frame's maker, the law requires us to pass complaints and reports of suspected incidents to the manufacturer, and serious incidents are reported to the MHRA.

Legal basis: our legal duties as UK Responsible Person where we are appointed, or our legitimate interests in addressing product safety concerns. Please do not include health information in the general enquiry form. If a safety report requires health information, we explain the purpose and the applicable condition under Article 9 of the UK GDPR before asking for it. We use explicit consent where appropriate; we do not assume that a general regulatory duty alone permits us to process health data. We minimise identifying details, restrict access, and retain records where the law requires. Withdrawing consent does not affect processing already carried out lawfully.

When you visit this website

See Cookies below.

Cookies

This site runs on Squarespace. It uses cookies the site needs to work and stay secure. If you accept them through the cookie banner, it also uses analytics cookies that tell us how visitors use the site: pages viewed, how you arrived, your device and rough location. We use this only to improve the site. You can accept, decline or manage optional cookies in the banner, and change your choice later using Cookie Preferences. We rely on your consent for analytics cookies, and our legitimate interests in operating and securing this site for necessary processing. We add no advertising tracking.

Who we share it with

• Providers that run our website, email and software, including Squarespace for this website and form submissions.
• Professional advisers, such as our accountant, lawyers and insurers, where needed.
• Couriers and customs agents who move goods for us.
• Makers and practices, when we introduce one to another. We only share business contact details, and only once you've agreed.
• Regulators and public bodies where the law requires it, for example the MHRA when we register devices or report incidents, HMRC, and the police or courts.

We don't sell personal data.

Sending data outside the UK

Some providers, including Squarespace, store and process data in the US. Transfers are covered by an applicable adequacy decision or contractual safeguards recognised under UK law, such as the UK international data transfer addendum. You can ask us for more information about the safeguards that apply. When we share details with makers in Japan, we rely on the UK's adequacy decision where it covers the recipient, or other lawful safeguards where required.

How long we keep it

• Enquiries that don't lead to business: 2 years from our last contact.
• Details of practices and makers we're in touch with: 2 years from our last contact, unless you ask us to stop sooner. If you ask us not to contact you, we keep just enough to make sure we don't.
• Records of business we do together: 6 years after it ends, to meet tax and legal requirements.
• UK Responsible Person and problem-report records: for as long as medical device law requires.
• Website analytics: analytics cookies last from 30 minutes to two years, depending on the cookie. Squarespace retains aggregated traffic statistics while the site operates.

Your rights

You can ask us to:

• give you a copy of your personal data
• correct it
• delete it
• limit how we use it
• send it to you or another organisation in a reusable format, where we rely on your consent or a contract

You can object to us using your data for our legitimate interests, and you can always tell us to stop marketing to you. We'll stop. Where we rely on your consent, you can withdraw it at any time.

To do any of this, email lucas.barker@theheritageexchange.uk. There's normally no charge, and we'll reply within one month. We don't make decisions about you by automated means.

Complaints

If you're unhappy with how we've handled your data, tell us: email lucas.barker@theheritageexchange.uk with "Privacy complaint" in the subject, or use the contact form on this site. We'll acknowledge it within 30 days, look into it without undue delay, and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113.

Changes

If we change how we use personal data, we'll update this notice and the date at the top.