Privacy & Cookies Notice (UK GDPR & PECR)
Effective date: 27 January 2026
Last updated: 27 January 2026
1. Who We Are
This website is operated by:
Core Leisure Ltd
Unit 4 Lloyds Court, Manor Royal, Crawley, West Sussex, RH10 9QU, UK
Tel: 01293 243980
Email: sales.uk@cornilleau.com
Core Leisure Ltd is the controller responsible for your personal data.
We do not currently require a Data Protection Officer. For any questions regarding this notice, please contact sales.uk@cornilleau.com.
Our website uses SSL/TLS encryption to protect data transmitted to us. Look for “https://” and the padlock icon in your browser.
2. Personal Data We Collect and Why
We collect and process personal data for the purposes explained below.
Website Access (Server Logs)
When you visit our site, we automatically collect:
– IP address (anonymised where possible)
– Browser type and version
– Operating system
– Pages viewed
– Date and time of access
– Referrer URL
– Amount of data transferred
Legal basis: Our legitimate interest in operating, securing and maintaining our website.
Retention: Approximately 30 days unless needed for security investigations.
Essential Website Functions
We use essential cookies and technical data necessary to operate the website, manage sessions and ensure proper functionality.
Legal basis: Legitimate interest or performance of a contract.
Retention: According to the cookie’s duration.
Analytics (Consent Required)
Analytics tools (such as Google Analytics and Hotjar) only run after you give consent. They collect information about how you use our site to help us improve performance and usability.
Legal basis: Consent.
Retention: As configured by each tool.
Marketing & Advertising (Consent Required)
We use marketing cookies and technologies (e.g., Google Ads, Microsoft Ads, Meta/Facebook Pixel, Pinterest) to measure advertising performance and show relevant ads. These run only after you accept marketing cookies.
Legal basis: Consent.
Social Media Plugins & Embedded Content (Consent Required)
Plugins and embedded media from platforms such as YouTube, Pinterest or Facebook only load when you give consent through the cookie banner.
Legal basis: Consent.
Contact Enquiries
If you contact us by form, email or phone, we collect the data you provide to respond to your enquiry.
Legal basis: Legitimate interest or contract, depending on the context.
Retention: 12 months after we close your enquiry unless legal obligations require longer storage.
Customer Accounts
When you create an account, we process your name, email address, password (hashed) and any optional information you provide.
Legal basis: Performance of a contract.
Retention: For the lifetime of your account. You may request deletion.
Orders and Fulfilment
If you place an order, we collect and process identity details, contact information, delivery details, payment status and order information.
Legal basis: Contract and legal obligation (tax and accounting).
Retention: 6 years from the end of the financial year.
Newsletter
You may subscribe to our newsletter via double opt‑in.
Legal basis: Consent.
You may unsubscribe at any time.
Abandoned Basket Emails
We may send abandoned basket reminders only when legally permitted.
For existing customers, this may be done under the “soft opt‑in” rule where applicable.
For new users, this is only done with explicit consent.
All emails contain an unsubscribe link.
Fraud Prevention and Disputes
Data may be processed to prevent fraud or defend legal claims.
Legal basis: Legitimate interest and legal obligation.
Retention: As needed for legal purposes (typically up to 6 years).
3. Where We Obtain Personal Data
We receive data from:
– you directly (forms, checkout, account creation, contact messages)
– your device (cookies/SDKs, subject to consent where required)
– payment processors (payment status and fraud checks)
We do not buy data from third parties.
4. Cookies and Tracking Technologies
We use:
– Essential cookies (no consent required)
– Analytics cookies (consent required)
– Marketing/retargeting cookies (consent required)
– Social media and embedded content cookies (consent required)
You control your preferences via our cookie banner or settings link.
Blocking certain cookies may limit website functionality.
A detailed list of cookies is available in the cookie settings panel.
5. Third‑Party Service Providers
We share personal data with trusted service providers who process data on our behalf:
Shipping Providers
Right Road Logistics Ltd
AIT Home Delivery UK Ltd
Royal Mail Group Ltd
Payment Providers (Independent Controllers)
Adyen
Sage Pay (Opayo by Elavon)
PayPal
Email & Marketing Tools
Sendinblue/Brevo (processor)
Advertising platforms (independent controllers): Google, Microsoft/Bing Ads, Meta, Pinterest
Manufacturer (Fulfilment Support)
Cornilleau SAS, France
We maintain Data Processing Agreements with all processors.
6. International Data Transfers
Some partners operate outside the UK or EEA. When transferring your data internationally, we use one or more of the following safeguards:
– UK‑US Data Bridge (where applicable)
– Standard Contractual Clauses with the UK Addendum
– International Data Transfer Agreement (IDTA)
– Transfer Risk Assessments
– Additional security measures where required
You can request more information about these safeguards.
7. Children’s Privacy
Our services are not directed to children. We do not knowingly collect personal data from children.
If you believe a child has provided information, please contact us so we can delete it.
8. Automated Decision‑Making
We do not use automated decision‑making or profiling that produces legal or similarly significant effects on you.
Payment providers may conduct fraud checks independently.
9. How We Protect Your Data
We use appropriate technical and organisational measures to secure your data, including encrypted transmission, access controls, role-based permissions and secure infrastructure.
All processors are contractually required to protect your data.
10. Your Rights
Under UK GDPR you have the right to:
– access your data
– correct inaccurate data
– request erasure
– restrict processing
– data portability
– object to processing based on legitimate interest
– object to direct marketing at any time
– withdraw consent at any time
To exercise your rights, contact sales.uk@cornilleau.com.
11. Complaints
You may lodge a complaint with:
Information Commissioner’s Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
www.ico.org.uk
We encourage you to contact us first so we can resolve your concerns.
12. How Long We Keep Personal Data
We retain personal data only as long as necessary for the purposes described or to comply with legal obligations.
Examples include:
– Server logs: around 30 days
– Contact enquiries: 12 months
– Newsletter: until you unsubscribe or after 24 months of inactivity
– Orders and tax records: 6 years
– Accounts: for the life of the account
– Cookies: according to each cookie’s duration
– Legal or fraud records: as needed for legal claims
13. Changes to This Notice
We may update this notice occasionally. Significant changes will be communicated on our website or by email where appropriate.
The effective date appears at the top.