POS Workplace Intelligence

Privacy notice

What we collect, why we use it and how to raise a concern.

Last updated: 9 September 2026 · Version 1.0

Who is responsible

Point of Sale Limited ("POS Interiors"), registered in Guernsey under registration number 12154, is responsible for this marketing website and decides how website enquiries are handled. Our registered office address is Unit 9 Anfre Estate, Route de la Garenne, St. Peter Port, Guernsey, GY1 2RL. Contact the POS team using the details below.

Our Guernsey Office of the Data Protection Authority registration reference is DPA4087, under Point of Sale Limited (POS Interiors).

This notice covers the website and discovery enquiries. It does not replace the participant notice or agreed data arrangements for a live employee survey.

POS is the controller for these activities: we decide why and how enquiry information is used. This notice covers visitors, enquirers and their business contacts, not all POS activities. The public website has no employee questionnaire, client login or file-upload facility. Guernsey's Data Protection (Bailiwick of Guernsey) Law, 2017 is relevant to our processing.

What we collect

• Enquiries: the name, organisation, work email, area of interest and business question you give us through the form, plus subsequent correspondence.
• Technical information: our hosting and security providers process IP addresses, browser/device information, request times and security-check results to deliver and protect the site.
• Preferences and optional measurement: your saved cookie choice and, only where enabled and accepted, information about use of public marketing pages. See the cookie policy.

The form requires contact details and a question to send an enquiry. You can contact us by telephone or email instead. Keep the question high level: do not include raw employee responses, health details, named redundancy plans or confidential strategy documents.

Information normally comes from you, or from a colleague contacting us on your organisation's behalf. Please tell colleagues if you provide their details. We do not obtain enquiry lists from data brokers or collect payment-card details here. If sensitive information reaches us unexpectedly, we assess what is necessary and arrange appropriate handling or removal. Accidental disclosure is not permission for unrelated use.

Purposes and lawful bases

We use enquiry details to respond, arrange a discovery session and understand the service you need. Our basis is legitimate interests in responding to business enquiries and providing an appropriate service. Where you personally request necessary steps towards a contract with you, the pre-contract basis may apply instead. An enquiry on behalf of a company does not automatically make every employee's information necessary for a contract with that individual.

We use necessary technical information to operate and protect the site, based on legitimate interests in security and reliability. Legal obligations may require particular records to be retained or disclosed. Optional analytics uses consent, separate from an enquiry. Sending a message does not sign you up to marketing.

We consider the purpose, necessity and effect on people when relying on legitimate interests. The form is limited to an initial enquiry and we do not use its contents for employee assessment, advertising profiles or unrelated research. We use relevant information to handle rights requests and legal obligations, or to resolve complaints and establish, exercise or defend legal claims where appropriate.

Follow-up and optional analytics

We may reply and follow up reasonably about the service you requested. Tell us if you no longer want that follow-up. We do not add you to a general promotional mailing list or advertising audience because you contacted us. Any distinct marketing activity needs its own appropriate basis and required choices.

Google Analytics is currently switched off on this website. We do not send website analytics events to Google, use session replay or run advertising pixels. Security processing is separate from marketing analytics.

Who receives information

Enquiries go to the designated POS mailbox. The form does not publish your message, send it to a generative AI model or store it in a survey database.

• Vercel: hosts the website and processes the form through its server function, including request contents during delivery and operational metadata.
• Cloudflare: provides domain/DNS services and Turnstile security checks. Our verification request sends the security token, not your enquiry text. Cloudflare describes its processing of browser and security signals in its Turnstile Privacy Addendum.
• Resend: delivers the enquiry email, including the form contents, to POS. Our sending route uses Ireland with encrypted delivery required. Resend stores message content and logs in the United States; the sending region does not change that storage location. See Resend's data-processing information.
• Google Workspace and POS personnel: our enquiry and general contact mailboxes use Gmail through paid Google Workspace. POS personnel who need the information handle enquiries and relevant correspondence.

The form sends enquiries to one designated POS recipient. Our general contact address, hello@posinteriors.com, is a shared Google Workspace group accessible to four authorised POS team members, so correspondence sent there may reach more than one person.

Cloudflare processes Turnstile security signals on our behalf to protect this website. It also acts as a separate controller when using those signals to improve its bot detection, as explained in its linked privacy addendum.

Providers use authorised subcontractors for service delivery and support. Their terms explain any separate responsibilities for security, account administration and legal compliance. We do not pass enquiry information to furniture manufacturers or other commercial partners simply because you contact us.

We do not sell enquiry information or provide it to advertising partners. Service providers process information under their applicable terms. Advisers or authorities may receive information where necessary for legal obligations or legal claims.

International processing

A hosting or sending region does not determine all processing, storage, backup and support locations. Providers operate internationally, including in the United Kingdom, European Economic Area and United States. Our contact function is configured for London; the email sending route uses Ireland. Google Workspace is not described here as a Guernsey-only or Europe-only mailbox service.

International transfers are subject to the applicable data-protection requirements. Relevant protections may include an authorised jurisdiction or adequacy arrangement, or approved contractual safeguards with the necessary assessment and supplementary measures. Provider terms describe their transfer arrangements. You can ask POS which protection applies to a particular transfer and how to obtain information about it, subject to proportionate redaction of confidential or security-sensitive material.

Retention

Our retention period for discovery enquiries that do not become projects is 12 months after the last meaningful contact, unless a legal obligation or specific dispute justifies keeping them longer. Enquiries that become projects follow the separately agreed client-record schedule.

Routine automated messages do not, by themselves, restart the enquiry period. Rights-request and complaint records are kept as necessary to handle the matter, demonstrate the response and meet applicable obligations or resolve a specific dispute. We do not keep unnecessary identity evidence merely because it was supplied.

There is no separate website enquiry database. Messages and technical records exist in provider systems and POS mailboxes, with distinct operational lifecycles. Resend publishes a 30-day email/log period for standard plans. Browser preferences last up to 180 days. Security records may be preserved longer where needed for a particular investigation or legal claim.

Deleting an active record does not necessarily erase every protected backup immediately: recovery periods, backup expiry and legal preservation obligations may apply. Ask us about the handling of a particular record. We do not promise instant erasure of every supplier copy or apply the enquiry period to unrelated project and accounting records.

Security and incident handling

The form uses encrypted connections, server-side validation, origin checks, bounded inputs and server-verified anti-abuse tokens. Delivery credentials stay on the server and the recipient is fixed by POS. Our application code does not log enquiry text, names, email addresses or security tokens; providers still process their own operational metadata.

These controls reduce risk, but no internet service or ordinary email route is guaranteed completely secure. Use the form only for an initial enquiry. Report suspected exposure or misdirected information promptly using the details below. We assess incidents, take appropriate containment and recovery action and make notifications required by applicable law.

Confidential surveys and business information

Business plans may be commercially confidential without being personal data. They become personal data where they relate to identifiable people, and answers may reveal health or other specially protected information. Both confidentiality and data-protection controls matter.

Employee responses are treated as confidential, not automatically anonymous. Names may be absent but a role, small team, access record or distinctive comment can still identify someone. Participation administration must stay separate from analysis. Free text needs disclosure review, and identifying groups must be combined or omitted from reports.

Each live review needs a participant notice and client agreement identifying the controller/processor roles for each activity, purposes, lawful basis, recipients, tools, access, retention and rights routes. Roles depend on what the parties actually do. A label saying “anonymous survey” is not sufficient. This contact form is not a route for collecting that evidence.

AI and decisions

The contact form makes no AI assessment or automated decision about people. Our AI and human oversight statement explains the service boundaries. This privacy notice is not permission to upload employee responses or confidential documents into an AI tool.

Your rights

Depending on the applicable law and activity, you may request access, correction, erasure, restriction or portability, object to processing, and withdraw consent where we rely on it. Rights are subject to legal conditions. Withdrawal does not undo lawful processing before withdrawal. You may object to legitimate-interest processing and to direct marketing where applicable.

Contact POS by email, telephone, post or the contact route below. Explain your request and provide enough information to locate the relevant records. We check identity or authority proportionately; do not send identity documents unless requested through an agreed route.

We normally respond within one month. If a lawful extension or exception applies, we explain the reason and timing. Requests are normally free; a charge or refusal is considered only where permitted by law. Some records must be preserved for a legal obligation or claim, and disclosure may need to protect other people's rights. If we cannot fulfil a request, we explain the decision and complaint route.

Where another organisation controls survey data, we help direct the request. Genuinely anonymised responses may no longer be attributable to an individual for retrieval or deletion. We do not collect extra identifiers merely to reverse genuine anonymisation.

Complaints and changes

You may complain to the relevant authority without first contacting POS: the Guernsey ODPA, Jersey OIC, or UK ICO where applicable. Guernsey and Jersey have their own laws; UK or EU GDPR may also apply depending on the activity.

We date notice changes and provide appropriate information before materially changing how data is used. Survey-specific changes require review of the participant information and client arrangements.

This is a business-facing website, not a service directed at children. Contact us if you believe a child has supplied information that should not be here. A change to this website notice does not alter an agreed client contract or authorise a new use of survey information.

Contact POS

You can contact POS through the contact form on this site, by email at hello@posinteriors.com or by telephone on 01481 740222.

For privacy questions, rights requests or concerns about information shared, use these same contact details. Do not send identity documents or further sensitive information unless requested through an agreed route.