Privacy policy - MnM Beds and Mattresses

1. Who we are

MnM Beds is the trading name of MnM Digital Limited, a company registered in England and Wales. We manufacture beds, headboards and blanket boxes in Dewsbury, West Yorkshire and sell them online at mnmbeds.co.uk. In this notice, “we”, “us” and “our” mean MnM Digital Limited.

MnM Digital Limited is the data controller for the personal data described here. That means we decide why and how your personal data is used, and we are responsible for looking after it.

If you have a question about privacy, or you want to exercise any of the rights in section 6, email hello@mnmbeds.co.uk with “Privacy” in the subject line and include enough detail for us to find your order or enquiry.

2. The personal data we collect

We only collect what we need in order to sell you a bed, deliver it, support you afterwards and run the website. Depending on how you use the site, that can include:

Order and contact details: Your name, email address, phone number, billing address and delivery address, together with the products, sizes and options you chose and the price you paid. You can check out as a guest — we never require you to create an account.
Delivery information: Your delivery postcode (which we check against the public Postcodes.io lookup service so a mistyped postcode does not derail your delivery), the room you would like the bed taken to, and any access notes you give us.
Payment information: Card details are entered directly into Stripe's hosted payment fields and are never seen by, sent to, or stored on our servers. We keep a record of the payment: its amount, status, method and Stripe reference, so we can match a payment to an order and issue refunds.
Account details: If you choose to create an account, the email address and password credentials held against it, plus your order history and any saved addresses.
Enquiries and support messages: Anything you send us by email, phone or WhatsApp, and the details you give when you request free fabric samples (your name, email, phone, address and the swatches you picked).
Marketing sign-ups: Your email address, the date and time you subscribed, the page or pop-up you subscribed from, the exact consent wording shown to you at the time, and the IP address and browser user agent recorded alongside it. We keep that evidence because UK marketing law requires us to be able to show how and when you opted in.
Incomplete baskets: If you enter your email address during checkout but do not finish, we keep that address, your name and a snapshot of the basket so we can send you a single reminder that your order was not completed.
Reviews and feedback: Any rating, review or photograph you choose to submit about a product, and the name displayed alongside it.
Technical and usage data: Your IP address, device and browser type, the pages and products you viewed, how you arrived at the site, and identifiers set by cookies and similar technologies in your browser.

We do not ask for, and do not want, special category data such as health information. Please do not include it in support messages.

3. How we use your data, and our lawful bases

UK GDPR requires us to have a lawful basis for every use of your personal data. Ours are:

Taking, making and delivering your order — performance of a contract: Processing your order and payment, manufacturing your bed, arranging delivery to your room of choice, sending order and delivery confirmations, handling returns, refunds, exchanges and warranty claims, and answering questions about an order you have placed.
Marketing emails — your consent: We only send marketing emails to people who have opted in. Every one of them carries an unsubscribe link, and you can withdraw your consent at any time without giving a reason. Withdrawing consent does not affect emails we send about an order you have already placed.
Reminding you about an incomplete basket — our legitimate interests: We have a legitimate interest in recovering orders that were not completed, balanced against the fact that this is a single reminder to an address you entered yourself while ordering. You can object to it at any time by emailing us, and we will stop.
Understanding how the site is used and measuring our advertising — your consent: Analytics and advertising cookies and pixels are only lawful with your consent.
Keeping accounting and tax records — legal obligation: We are required to keep records of sales, VAT and refunds for HMRC and company law purposes.
Protecting the site and preventing fraud — our legitimate interests: Checking payments and orders for fraud, keeping the site secure and available, and defending legal claims. We have a legitimate interest in not being defrauded and in keeping the service running.

Where we rely on legitimate interests we have considered the effect on you, and you can object at any time using the contact route in section 6.

4. Who we share your data with

We do not sell your personal data, and we do not share it with anyone for their own marketing. We do use a small number of specialist suppliers to run the shop. These are the ones that actually handle personal data:

Stripe — payments: All card payments are processed by Stripe. Your card details go straight to Stripe and never reach us. Stripe receives your name, email, billing address and order amount so it can take the payment and screen it for fraud.
Klarna, Amazon Pay and Revolut Pay — alternative payment methods: If you choose one of these at checkout, you are taken to that provider to authorise the payment. They handle your data as their own controller under their own privacy notice, including any credit or eligibility checks they carry out.
Our delivery and installation teams: The people who bring your bed to your room of choice are given your name, delivery address, phone number and the items on your order so they can complete the delivery and contact you about it.
Professional advisers and authorities: Our accountants, insurers and legal advisers where they need it, and the police, HMRC, courts or regulators where we are legally required to disclose information.

Several of these suppliers are headquartered outside the UK, so some data is transferred abroad. Where that happens, we rely on UK adequacy regulations for the destination country, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so that your data keeps essentially the same protection it has in the UK.

5. How long we keep your data

We keep personal data only for as long as we have a reason to, then delete it or reduce it to anonymous statistics.

Orders, invoices, payments and refunds: at least six years after the end of the accounting period they fall in, because HMRC and company law require it.
Warranty and aftercare records: for the length of the applicable warranty — three years for mattresses, two years for beds, headboards and blanket boxes — plus a reasonable period afterwards in case a claim is made near the end of the term.
Marketing subscribers: until you unsubscribe. After that we keep a minimal suppression record of your address so that we do not email you again by mistake.
Incomplete basket records: kept briefly so a single reminder can be sent, then removed once the basket is recovered or the reminder has run its course.
Enquiries and support messages: for as long as we need to deal with the matter, and then for a reasonable period afterwards in case you come back to us about it.
Analytics data: retained for the period set in our Google Analytics configuration, after which Google deletes the underlying event data.

6. Your rights under UK GDPR

You have the following rights over the personal data we hold about you. They are free to use, and using them will never affect the service you get from us.

Access: Ask for a copy of the personal data we hold about you, and for an explanation of how we use it.
Rectification: Have inaccurate data corrected and incomplete data completed — for example a mistyped delivery address.
Erasure: Ask us to delete your data where we no longer need it. We may have to keep order and tax records for the periods in section 5 even after you ask, but we will tell you if that applies.
Restriction: Ask us to pause our use of your data — for instance while a dispute about its accuracy is resolved.
Portability: Receive the data you gave us, for data we process by automated means on the basis of consent or a contract, in a common machine-readable format, or ask us to send it to another provider.
Objection: Object to processing we carry out on the basis of legitimate interests. If you object to direct marketing we must stop immediately, with no exceptions.
Withdrawing consent: Withdraw consent at any time where we relied on it — by using the unsubscribe link in any marketing email, or by emailing us. This does not affect anything we did lawfully before you withdrew it.

To use any of these rights, email hello@mnmbeds.co.uk. We will respond within one month. If your request is unusually complex we may extend that by up to two further months, and we will tell you if we do. We may ask you for information that lets us confirm who you are, so that we do not hand your data to somebody else.

We do not make decisions about you by purely automated means that produce legal effects or otherwise significantly affect you.

7. Complaints

If you are unhappy with how we have handled your personal data, please tell us first at hello@mnmbeds.co.uk so we have the chance to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at any time. You can reach the ICO at ico.org.uk/make-a-complaint or on 0303 123 1113. Its postal address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

8. Children

We sell children's beds, but the shop is intended for adults and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us their details, email us and we will delete them.

9. Changes to this notice

We review this notice as the shop changes and will update it here when we do. The version shown on this page is always the current one, and the date it was last updated is 28 August 2026.