Privacy

What we do with your information.

Last updated 18 August 2026

Who we are

40FT Craft Limited manufactures contract furniture for hotels, restaurants and villas, and ships it worldwide. We are the data user under the Hong Kong Personal Data (Privacy) Ordinance, and the data controller under the UK and EU General Data Protection Regulation where that applies to you. Both mean the same thing in practice: we decide why your information is held and what happens to it, and we answer for it.

What we collect

Only what you type into the enquiry form. Nothing on this site asks you for anything until you choose to fill it in.

Name

Step one of the enquiry form.

Company

Step one.

Work email

Step one.

Role

Step two.

Phone number

Step two, marked optional.

Country

Step two.

Timeline

Step two.

Project type

Step two.

Anything you write in the message box

Step two.

Files you attach

Step two. PDF, DWG, XLSX, JPG, PNG and HEIC.

Along with the form itself, the submission carries a little context about how you arrived, so we know which of our own links and campaigns are working:

Campaign tags

The utm_source, utm_medium, utm_campaign, utm_content and utm_term values in the link you arrived on, when there are any.

Referring page

The address of the page that linked you here, when your browser sends one.

Landing path

Which page of this site you were on when you filled the form in.

Our hosting provider keeps server logs that include your IP address, in the ordinary way that every web server does.

When it reaches us

The form has two steps, and it sends after each one. When you press Continue at the end of step one, your name, company and work email are sent to us at that moment, before you have seen or completed step two. We do that on purpose: people are interrupted halfway through forms, and we would rather be able to come back to you than lose the enquiry entirely.

If you would prefer us not to hold a half-finished enquiry, tell us and we will delete it. If you close the tab during step one without pressing Continue, nothing has been sent.

Each submission also runs a short automated check by Cloudflare Turnstile, there to keep automated spam out of our inbox. It looks at technical signals from your browser, not at what you typed, and it is not used to advertise to you or to build a profile of you.

Cookies and advertising

We advertise on Google and on Facebook and Instagram, and we need to know which of those adverts bring people here who go on to enquire. That measurement works by setting cookies in your browser and reporting back to Google and to Meta, who can recognise you across other sites they also measure.

Those cookies are only set if you accept them. Decline and nothing on this site stops working: the pages, the material library, the port finder and the enquiry form all behave exactly the same. You can change your mind at any time, and clearing your browser's cookies for this site removes them.

Cookies that are strictly necessary to serve the site are always on, because without them there is no site to visit. We do not use session recording, heatmaps or scroll tracking, and we do not build audiences out of the files or project details you send us. Advertising data and enquiry data are kept apart.

The drawings and schedules you send us

A bill of quantities, a drawing set or a specification often carries other people's details inside it: the designer who drew it, a consultant's title block, a site contact, sometimes a client's name. We treat those files as confidential project material. We use them to quote and to manufacture, we share them only with the colleagues and the workshops working on that project, and we do not reuse them for anything else. They are never used for advertising.

Please send only what we need to price the work. If a file contains personal information about someone who is not you, you are responsible for having a basis to pass it on.

Why we hold it, and on what basis

To answer your enquiry, prepare a quotation, and if it goes ahead, to manufacture and ship the order and keep the records a business has to keep. Where the UK or EU GDPR applies to you, our lawful bases are:

• Taking steps at your request before entering a contract. Quoting a project you asked us to quote.
• Performing the contract. Once you order, we need your details to build and deliver it.
• Our legitimate interests. Running and defending the business, keeping a record of who asked us for what, and preventing spam and abuse of the form.
• Your consent. Advertising and measurement cookies, and nothing else.
• Legal obligation. Tax, customs and accounting records.

We do not send marketing email off the back of an enquiry. If that ever changes we will ask you first, and asking will mean an unticked box that you choose to tick.

Finding your nearest port

The port finder can use your device location if you press the button and your browser then asks your permission. If you allow it, your coordinates are compared against our list of ports inside your own browser and the nearest one is shown. The position is never transmitted to us, and no third party service is involved. We built it that way instead of using an address lookup service, which would have sent every visitor's location to somebody else on every page view.

Choosing a country from the list involves no location data at all.

Paying for a sample box

The sample box is paid for through a Stripe payment link. Pressing the button takes you to a page hosted by Stripe, which collects the payment details and processes the card. We never see or store your card number. Stripe passes back the fact that the payment succeeded, along with the name, email and delivery address you gave it, so that we can post the box. Stripe handles that information under its own privacy policy at stripe.com/privacy.

Booking a call

When you book a call, we take your name, email, the time you chose, and a phone number if we ask for one, and we create the meeting in our calendar along with an enquiry record, so the person who takes the call knows what it is about. You get a calendar invite with the video link by email, and the confirmation page gives you a link to change or cancel the booking yourself. If you cancel, the slot is simply released; tell us if you also want the enquiry record deleted.

Who else sees your information

A small number of suppliers who work on our instructions, each under a written agreement that limits them to what we have asked them to do. We do not share enquiries with other manufacturers or with agents.

Odoo

Our business system. Enquiries, quotations, orders and project records live here, along with the files you send us.

Stripe

Payment for the sample box. Stripe collects the card details on its own pages and we never see them.

Cloudflare

Serves the site and checks that form submissions come from a person rather than a script. The check runs quietly in the background and sets no advertising cookies.

Google

Advertising and measurement, through Google Ads. Only with your consent.

Meta

Advertising and measurement on Facebook and Instagram. Only with your consent.

We also disclose information where the law requires it, for example to customs authorities on a shipment, or to our accountants, insurers and legal advisers.

Where your information goes

We are based in Hong Kong and we manufacture in Indonesia, China and Vietnam. Project information, including the names and contact details of the people working on a job, is shared with our own workshops and partner factories in those countries so the work can be made and shipped.

None of those countries has an adequacy decision from the UK or the European Commission. Where we move personal data belonging to people in the UK or the EU, we put contractual safeguards in place first, using the standard contractual clauses approved for that purpose, and we send only what the factory actually needs.

How long we keep it

Enquiries that do not turn into projects are kept while there is a realistic prospect of the work, and then deleted. Project records, invoices and shipping documents are kept for as long as tax, customs and company law requires us to keep them. If you want yours removed sooner, ask, and we will unless a law obliges us to hold it.

Your rights

Under the Hong Kong Personal Data (Privacy) Ordinance you can ask us whether we hold personal data about you, ask for a copy of it, and ask us to correct it if it is wrong. We will answer within 40 days, which is the period the Ordinance sets.

Where the UK or EU GDPR applies to you, you can also ask us to delete it, restrict what we do with it, or hand it over in a portable form, and you can object to us holding it on the basis of our legitimate interests. Where we rely on your consent, you can withdraw it at any time, and that does not affect anything done before you withdrew it. We will answer within one month.

There is no charge either way. If you are not satisfied with how we handle it, you can complain to the Office of the Privacy Commissioner for Personal Data in Hong Kong, or to your own national data protection authority if you are in the UK or the EU.

Keeping it safe

The site is served over HTTPS and the enquiry form is submitted over an encrypted connection. Access to enquiries and project files is limited to the people who need it. No system is perfect, and we will tell you and the relevant regulator if something goes wrong in a way that puts you at risk.

Children

This is a business to business site and it is not intended for anyone under 18. We do not knowingly collect information about children.

Changes

If we change what the site does, we change this page at the same time and move the date at the top.

Contact

For anything on this page, including a request about your own information, use the enquiry form on our home page and tell us it is a privacy request, or write to us at the address above.