Privacy Policy

The short version

We collect as little as we can, we don’t sell it, and we won’t add you to a mailing list you didn’t ask to join.

• Browsing the site. Nothing that identifies you, unless you accept analytics or marketing cookies. You can reject them all, choose category by category, and change your mind later.
• Contacting us. What you type into the form, so we can reply. We keep a copy for three years, then delete your details.
• Buying or leasing. What’s needed to take payment, deliver the product and honour the warranty. Your card details go straight to Stripe – they never touch our systems.

The details are below. If anything here is unclear, ask us – the contact details are in the next section.

Who we are

Unicook Ltd is the data controller for this website (unicook.co.uk). That means we decide what personal information is collected here and why, and we are responsible to you for it.

Unicook Ltd, registered in England and Wales, company number 05837028. We are on the Information Commissioner’s Office register of data controllers under reference ZB617328.

Our office, and the address to write to: Unit 1, Villa Farm, Blackham, Tunbridge Wells, Kent TN3 9UN, United Kingdom.

Our registered office is 104 High Street, West Wickham, Kent BR4 0NF. That is our accountant’s address – post about your personal information should come to Villa Farm, where it will reach us faster.

For anything about your personal information – a question, a request, or a complaint – email enquiries@unicook.co.uk, or write to us at Villa Farm.

Our French and European sites (unicook.fr, unicook.eu) are operated by a different company, Sensia SARL, and have their own privacy notices. This one covers unicook.co.uk only.

What data we collect, and why

When you browse the site

Our website is hosted on Cloudflare. Cloudflare processes your IP address and basic request information to serve pages and to protect the site from attacks and abuse. This happens on every visit and we cannot switch it off – without it, the site can’t work safely.

Beyond that, we collect nothing about your browsing unless you accept analytics or marketing cookies. See Cookies below.

When you fill in a form

We have five forms – a general enquiry form, a quote request, a CPD presentation booking, a “call me back” box, and warranty registration. These ask for information that helps us to respond to your enquiry, including: your name, email address, phone number, your organisation, the sector you work in, which product you’re interested in and how many, when you’d prefer to meet, how you heard about us, and whatever you write in the message box.

Warranty registration asks for more, because it has to: your postal address, the date you bought the product, how many of each model you have, your order number, and up to ten photographs of the installation.

If you give us someone else’s details – warranty registration has an optional “site contact”, for the person at the property when that isn’t you – please make sure they are happy for you to. We use those details only to support that installation, and if they ask us where we got them, we’ll tell them.

Forms submitted on this site are emailed to our enquiries inbox through Resend, our email delivery provider.

We also keep a copy of every form you send, in a database on our website. It holds everything you entered, plus the page you sent it from, the date, the country your connection came from, and whether our email about it was delivered. If you attach photographs, we keep only their file names and sizes – the photographs themselves go to our inbox and are not stored in the database. We keep this copy for two reasons: so that an enquiry is not lost if an email goes astray, and so we can count how many enquiries each form receives over time.

After three years we delete your details from that copy. What remains is an anonymous count – which form, which page, when, and the country – that cannot be traced back to you.

If you have accepted marketing cookies, a copy of what you enter in our contact, quote, presentation, call-back and warranty registration forms also goes to HubSpot, the system we use to manage customer relationships, and is linked to the pages you have visited on the site (see Marketing). That never happens with the checkout, subscription or cancellation forms, or if you have refused marketing cookies – the form then works in exactly the same way.

We will not add you to a marketing or mailing list on the basis of an enquiry. If we ever think it would help to share your details with someone else, we will ask you first.

When you buy or lease a stove guard

At the checkout we ask for your email address and shipping address, and you enter your card details into a payment form provided by Stripe.

Your card details never reach us. The payment fields are Stripe’s, not ours, and the card number goes directly to Stripe. We can’t see it at any point in the process.

After a successful payment we keep a deliberately thin record: the amount, the currency, what you ordered, the date, when the warranty expires, and a reference number that points at Stripe. We do not store your name, email address or postal address in our own order database – those live with Stripe, and we look them up when we need them. We built it this way on purpose, so that our own records are of limited use to anyone who should not have them.

Leasing works the same way, with a record of the subscription, its monthly rate and its status.

Stripe runs automated fraud checks on payments and may decline one. If that happens and you think it’s wrong, contact us and we’ll look into it – a person, not a machine, will make the final call.

Our legal grounds for using your information

Where we rely on legitimate interests, we’ve considered whether it’s fair to you. If you disagree, you can object – see Your rights.

Cookies and similar technologies

Things we use that you cannot turn off

These are needed for the site to function, so they don’t require your consent:

• Your basket. Stored in your own browser’s local storage, not in a cookie, and never sent to us until you check out.
• Stripe’s fraud-prevention cookies (__stripe_mid, __stripe_sid). Set when the checkout loads, to detect fraudulent payments.
• Your cookie choice itself – so we don’t ask again on every page.

What you choose

When you first visit, a banner offers three buttons of the same size: Accept all, Reject all and Manage. “Manage” lets you accept or refuse two categories separately, both switched off to start with: analytics and marketing. Until you choose, none of the tools below is loaded and nothing is sent to them. None of their cookies lasts longer than 13 months.

Analytics – only with your consent

If you refuse analytics, nothing is sent to Google Analytics or Hotjar. If you accept, we use Google Analytics 4 (GA4) to see how many people visit, which pages they read, roughly where in the world they are, what kind of device they use, and how they found us. It sets the cookies _ga and _ga_<id>, which we limit to 13 months.

GA4 is loaded through Google Tag Manager, a Google tool that lets us manage the site’s analytics code in one place. Tag Manager loads only if you accept analytics, at the same moment as GA4, and is set up to load Google Analytics and nothing else. It sets no cookies of its own, but like anything fetched from Google, it means Google receives your IP address when it loads. Through it, GA4 also records some of what visitors do on a page – for example which links and buttons they click, how far down they scroll, and whether they play a video or send a form – but never what is typed into a form.

We use GA4 for statistics about the site, and nothing else. We don’t use it for advertising: the site tells Google on every page that advertising storage and ad personalisation are refused, and we don’t combine it with any advertising tools.

Analytics data is pseudonymous, not anonymous: this means it isn’t labelled with your name, but it is tied to an identifier that distinguishes your visits from other users’. We don’t try to work out who you are from it, and we don’t allow Google to either.

If you accept analytics, we also use Hotjar, which records how visitors use our pages – mouse movements, clicks and scrolling – and turns that into heatmaps, so we can see what works and what gets in the way. Hotjar masks everything typed into a form, so its recordings never contain your text. Like GA4, it ties your visits to an identifier, not to your name. It sets cookies whose names start with _hj, for a year at most, and its data is stored in the European Union.

Marketing – only with your consent

If you refuse marketing, nothing is sent to HubSpot. If you accept, HubSpot – the system we use to manage customer relationships – records which pages you visit on the site and how you arrived (an advert, a search engine, another site), under an identifier kept in its cookies __hstc, hubspotutk, __hssc and __hssrc, for 13 months at most. Until you contact us, that history carries no name. If you then send one of our enquiry forms, HubSpot keeps a copy and links it to that history: when you get in touch, we can see which pages you looked at, which helps us answer your enquiry and tells us which of our marketing brings customers. Our HubSpot data is stored in the United States.

Changing your mind

Use the Cookie settings link in the footer at any time to change either category. Withdrawing consent is as easy as giving it, and stops any further collection: we also delete the cookies concerned from your browser. We ask again after six months. You can also block or delete cookies in your browser, though parts of the site may work less well.

Video

Some pages embed YouTube videos. They don’t load until you click play, and we use YouTube’s privacy-enhanced mode, so YouTube doesn’t set cookies unless you actually watch. The preview thumbnail is served by Google, which means Google receives your IP address when the page loads.

External sites

This notice covers unicook.co.uk only. Where we link out to another site, that site’s own privacy notice applies.

Who we share it with

We do not sell, rent, or trade your personal information. We share it only with organisations that do a specific job for us, under contract, and only what they need:

Occasionally we use a different carrier for a particular delivery. They receive the same information Royal Mail would – the name, address and phone number needed to deliver the parcel – and nothing else.

We may also disclose information where the law requires it, or to establish or defend a legal claim.

Sending information outside the UK

Some of the providers above are based outside the United Kingdom, mostly in the United States. When information is transferred there we rely on the UK government’s adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards in place.

How long we keep it

When a retention period ends, we delete the information or strip it of anything that identifies you.

Your rights

Under UK data protection law you have the right to:

• Know what we hold about you and get a copy of it
• Correct anything inaccurate
• Erase it, where we have no continuing reason to hold it
• Restrict how we use it while a concern is being resolved
• Object to use we’ve justified by legitimate interests
• Move it to another provider in a portable format
• Withdraw consent at any time, where you gave it – including analytics and marketing

Email enquiries@unicook.co.uk and we’ll respond within one month. These rights are free to exercise.

If you’re unhappy with how we’ve handled your information, please tell us first – we’d rather fix it. You also have the right to complain to the Information Commissioner’s Office at any time: ico.org.uk or 0303 123 1113.

Keeping it safe

The site is served over HTTPS throughout. Card details are handled by Stripe and never stored by us. Our own order records are deliberately built to hold no names, email addresses or postal addresses – only totals and references – so that if they were ever exposed, there is little there to expose. The copies of forms you send are the exception, because they are what you wrote to us; they are cleared on the schedule above. Access to order data and form copies is restricted to staff who need it.

If a breach ever put your rights at risk, we would tell you and the ICO as the law requires.

Children

This site is aimed at adults – homeowners, families, landlords and construction professionals. We don’t knowingly collect information from children.

Changes to this notice

We review this notice regularly and whenever we change how the site works.

Last updated: 29 October 2026
Previous versions: 9 October 2026, 8 September 2026, 14 October 2021