Privacy Policy

Effective date: 18 September 2026

Mirrorwright is a mirror manufacturing and export business. Almost everyone who contacts us does so on behalf of a company — a hotel group, a contractor, a distributor, an online seller or a brand owner. This policy is written for that relationship. It explains what we collect when you ask us for a quotation, what happens to the drawings and specifications you send us, who we pass information to in order to actually make and ship your order, and what you can ask us to do with your data.

This policy covers www.mirrorwright.com and the email, messaging and quotation correspondence that follows from it. Mirrorwright is the data controller for that information. You can reach us at sales@mirrorwright.com for anything in this policy.

1. What we collect

Where it comes from	What it contains
Quotation / enquiry form	Full name, company, work email, country or region, and your requirements. Phone or messaging number if you choose to give one. We also record which page and which product model the enquiry came from, and the language version of the site you used.
Email, WhatsApp and other correspondence	Everything you send us in the course of a project: contact details of the people involved, purchase and shipping information, and the content of the messages themselves.
Project and order documents	Drawings, spec sheets, tender documents, bills of materials, packing and labelling artwork, delivery addresses, consignee and customs contact details, and the commercial documents required to ship and clear goods.
Anti-spam verification	The enquiry form is protected by Cloudflare Turnstile. When you submit it, a verification token and your IP address are sent to Cloudflare so it can confirm the submission is not automated.
Server and network logs	Standard technical records kept by our hosting and CDN providers: IP address, request time, page requested, browser and device type. These are used for security, abuse prevention and fault diagnosis.
Your browser's local storage	If you arrive through a search advertisement or a campaign link, the campaign identifiers in that link (such as gclid or utm_* parameters), the page you landed on and the referring website are stored in your browser so that we can tell which channel an enquiry came from. This is stored on your device, not in a cookie, and it is not linked to you until and unless you send us an enquiry.
Anonymous performance measurements	The site reports page-loading performance metrics (Core Web Vitals) so we can keep the site fast. These records contain a page path and timing numbers only.

We do not ask for and do not want payment card numbers, bank credentials, passport or identity document numbers through this website. Payment instructions are handled through your own bank against a proforma invoice.

2. Drawings, specifications and other project material

This is the part that matters most to a B2B buyer, so it is stated plainly.

• We treat your drawings and specifications as confidential. They are used to quote, to make samples, to tool and to produce your order. They are not published, not shown to other customers, and not used as reference material for anyone else's project.
• To quote or to produce, we must share the technical content internally and with the manufacturing partners working on your item — the glass plant, the LED and driver supplier, the frame or backing supplier, the packaging printer, and where you require it the third-party inspection body. We share the technical content needed to do the job; we do not need to pass on your company's commercial terms or pricing to do that.
• If a project needs a written confidentiality undertaking before drawings change hands, tell us before you send them. We can sign an NDA, and we can require the relevant manufacturing partner to sign one first. Say so up front rather than after the fact — once material has been circulated to quote, it cannot be un-circulated.
• If your drawing carries a confidentiality marking or your own customer's identity, tell us what must be removed before it is passed to a manufacturing partner, and we will remove it.

3. How we use the information, and on what basis

Purpose	Basis under the GDPR / UK GDPR, where it applies
Answering an enquiry, preparing a quotation, arranging samples	Steps taken at your request before entering into a contract
Producing, inspecting, packing, shipping and invoicing an order; after-sales and warranty handling	Performance of a contract
Keeping export, customs, tax and accounting records	Legal obligation
Site security, spam and abuse prevention, fault diagnosis	Our legitimate interest in keeping the site and our correspondence usable
Understanding which channel an enquiry came from, and improving the site and our product range	Our legitimate interest in running the business efficiently
Sending product or programme updates to a business contact we already deal with, where the law allows it	Our legitimate interest, or your consent where consent is required — you can stop these at any time

We do not sell personal information, we do not rent or trade contact lists, and we do not make automated decisions that produce legal or similarly significant effects about you.

4. Who we share information with

• Manufacturing and supply partners — as described in section 2, limited to what is needed to quote and produce.
• Freight forwarders, carriers, customs brokers and, where you appoint one, your own nominated forwarder — consignee name, address, contact person and phone number, and the shipping documents. Export and import clearance cannot be completed without this.
• Third-party inspection and testing bodies, where you or your programme require an inspection or a test report.
• Banks, for the payment leg of a transaction.
• Service providers who operate our systems on our behalf — website hosting (Amazon Web Services, in the United States), content delivery and bot protection (Cloudflare), and email delivery. They process the data on our instructions and are not permitted to use it for their own purposes.
• Professional advisers and authorities, where we are required to disclose information by law, or where disclosure is necessary to establish or defend a legal claim.

5. International transfers

Mirrorwright's commercial and engineering teams are in China, our manufacturing partners are in China, and the website is hosted in the United States and delivered through a global content delivery network. If you are in the European Economic Area, the United Kingdom or another jurisdiction with transfer restrictions, sending us an enquiry or an order necessarily involves transferring your information to those countries.

Where the law requires a transfer safeguard, we rely on Standard Contractual Clauses or an equivalent mechanism with the recipient, together with the confidentiality obligations described above. Ask us at sales@mirrorwright.com if your compliance team needs the details in writing for a particular project.

6. Cookies, local storage and analytics

If you are in the European Economic Area or the United Kingdom, we show a banner on your first visit asking whether you accept analytics and advertising-measurement cookies. Until you choose, no cookies are set: Google's measurement code runs in cookieless mode and sends Google only anonymous, aggregated signals — for example that a page was viewed or an enquiry form was submitted — which cannot identify you and which Google uses to estimate overall traffic and conversions. If you select "Essential only", it stays that way.

Outside those regions, where prior consent is not required, analytics and Google Ads conversion measurement are enabled by default. Conversion measurement means that if you reached us by clicking one of our Google ads, a Google cookie (_gcl_*) records that click so we can see which ads lead to enquiries. You can turn both off at any time by blocking cookies for this site in your browser.

We do not run Facebook, TikTok or similar advertising pixels, and we do not use your data for personalised advertising or remarketing, in any region.

• Strictly necessary cookies set by Cloudflare to route requests, protect the site against automated abuse and operate the Turnstile verification on the enquiry form. These are required for the site to work and are not covered by the banner.
• Your browser's local storage, for your cookie choice, your language preference and the campaign attribution record described in section 1. This is data held on your own device — clearing your browser storage removes it.
• Anonymous performance measurement as described in section 1.
• Analytics, only if you accept — Google Analytics 4 sets _ga and _ga_<id> cookies to count visits and show us which pages and product ranges are used. We do not use them to identify you personally, and the data is kept for the period set in Google Analytics, currently fourteen months.
• Google Ads conversion measurement — where enabled (see above), Google sets _gcl_* cookies to link an enquiry to the ad click that brought you here, kept for 90 days.

Changing your mind. If you were shown the banner and want to withdraw the consent you gave, clear this site's cookies and site data in your browser; the banner will appear again on your next visit and you can choose "Essential only". If no banner was shown to you, analytics can be turned off by blocking cookies for this site. You can also block cookies in your browser settings, though some site functions may stop working.

7. How long we keep information

Record	Retention
Enquiries that do not lead to an order	Kept while the business relationship is active; three years after the last contact we remove the personal details (name, email address, phone number) and keep only the company name and the requirement itself
Customer and project records, correspondence, drawings and specifications	For the life of the business relationship and for the warranty and claims period that follows it
Contracts, invoices, export and customs documents, accounting records	For the period required by the applicable tax, accounting and customs rules
Server and security logs, including IP addresses	Twelve months
Analytics data	As configured in Google Analytics, currently fourteen months

8. How we protect information

The site is served over HTTPS and sits behind a content delivery network with bot and rate-limit protection. Access to enquiry and customer records is restricted to the staff who need it, over authenticated accounts. Project files shared with manufacturing partners are sent on a need-to-know basis. No system is perfect; if a breach affecting your information occurs and the law requires it, we will notify you and the relevant authority within the required time.

9. Your rights

Depending on where you are, you may have the right to ask us for a copy of the personal information we hold about you, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable form, and to withdraw a consent you previously gave. If you are in California, you also have the right to know what we collect and to ask us to delete it; we do not sell or share personal information as those terms are defined there.

Write to sales@mirrorwright.com with "Privacy request" in the subject line. We will reply within 30 days. We may need to confirm that you are who you say you are, or that you are authorised to act for the company concerned, before we act on a request. Note that we cannot delete records we are legally required to retain, such as export and accounting documents for a completed shipment.

If you are in the EEA or the UK and you are not satisfied with how we have handled a request, you may complain to your national data protection authority.

10. Marketing

We send product and programme updates only to business contacts we are already dealing with, and only where the law allows. Every message has an unsubscribe link, and replying with "unsubscribe" works just as well. Unsubscribing stops the updates; it does not stop the correspondence about an order you have placed.

11. Children

This is a business-to-business site. It is not directed at children and we do not knowingly collect information from anyone under 16.

12. Changes to this policy

When we change this policy we update the effective date at the top of the page. Material changes will be described on this page. Please check the date before relying on the text for a compliance file.

13. Contact

Questions about this policy, requests about your data, or a confidentiality requirement for a specific project: sales@mirrorwright.com. We answer enquiries within 24 hours on working days.