Scheme Privacy
Notice
United Kingdom · Version 1.2 · 29 September 2026
This notice explains what we do with personal information when someone takes part in the Millboard Refer a Friend Scheme. It sits alongside our main Privacy Policy at www.millboard.com/en-gb/trust-centre/privacy-policy/, which covers how we handle personal information generally. Where the two differ in relation to the Scheme, this notice applies.
It is written for customers who take part as a referrer, and for people who are referred and open a referral link.
1. Who is responsible for your information
The Millboard Company Limited (company number 06061318), 1 Argosy Court, Scimitar Way, Coventry CV3 4GA, is the controller of the personal information described in this notice.
If you have any questions about this notice or how we use your information, contact us at enquiries@millboard.com or write to us at the address above. Questions about a specific referral can go to referrals@millboard.com.
2. What we collect
If you take part as a referrer
- Your name, email address and customer record, which come from our customer relationship system. That is where your eligibility to take part comes from.
- Your referral link, when it was activated and when it expires, how many of your referral slots have been used, and how many referrals have led to a reward.
- A record of the Scheme emails we have sent you, and of any request you make to sign in, including the IP address the request came from.
- Whether you have stopped taking part, and your marketing preferences.
If you have been referred
- When you open a referral link, our site protection provider checks your IP address and browser details to confirm you are not an automated system. We do not keep your IP address. We keep only a one-way scrambled code made from it and your browser details, so that repeat visits are counted once. That code cannot be turned back into your IP address and is deleted after 90 days.
- If you submit the form to claim a code: your full name, email address, the postcode the decking will be delivered to, and your phone number if you choose to give it. We also record when and from what IP address you submitted the form, and which version of the Scheme terms you accepted.
- If you tick the optional box asking us to email you Millboard news, product launches, inspiration and offers, when and from what IP address you did so.
- If you buy online: your order number, the order value and when the order was completed, which our webshop sends us. We then check our finance system for any credit note against that order.
- If you buy through a distributor and make a claim: the invoice you upload, what is read from it (the supplier, invoice number, date and total), a digital fingerprint of the file so that the same invoice cannot be used twice, the distributor matched against our records, and a note of how our team confirmed the purchase.
- If a voucher is issued to you, a record of it.
If you start the form but do not submit it, nothing is saved. If a submission is refused, for example because the bot check fails, the form is filled in incorrectly, or the Scheme is paused, no record of you is created.
We do not collect contact details for anyone else
We do not ask a referrer for a friend's contact details and we do not accept them. We do not send messages to anyone on a referrer's behalf. If you have heard about the Scheme from a friend, that is because they chose to tell you themselves.
3. What we use your information for
Each purpose has a lawful basis under UK data protection law.
| What we do | Information used | Our lawful basis |
|---|---|---|
| Issue your referral link and run your referral page | Your name, email address, customer record, link and slot details | Performance of our agreement with you under the Scheme terms |
| Issue a friend's code, and record the friend in our customer system so we can administer the referral | The friend's name, email, delivery postcode, optional phone, and the code issued | Performance of our agreement with you under the Scheme terms |
| Match an online order to a code and check whether it has been returned or credited | Order number, order value, completion date, credit note check | Performance of our agreement with you under the Scheme terms |
| Process a claim for a purchase made through a distributor, including reading the invoice automatically | The invoice image and what is read from it, the distributor's name, how our team confirmed the purchase | Performance of our agreement with you under the Scheme terms |
| Check that referrals and claims are genuine | Bot check results, postcodes, email addresses, invoice fingerprints, visit counts | Our legitimate interests in protecting the Scheme against fraud and abuse and making sure rewards go to genuine referrals |
| Issue a voucher and keep a record of it | Your name, email address, voucher details | Performance of our agreement with you under the Scheme terms |
| Keep a record of the decisions we make and the actions our staff take, so that we can explain and defend them | Referral, claim and review records, our audit trail | Our legitimate interests in being able to evidence and defend decisions about rewards |
| Keep the records we need for accounting and tax | Voucher and order records | Compliance with our legal obligations |
| Send referrers the invitation to take part, and up to two reminders if the link is not used | Your name, email address | The marketing permission held for you in our customer records. You can unsubscribe at any time. |
| Send you marketing about Millboard products and services | Your name, email address, marketing preferences | Your consent, given by opting in. You can withdraw it at any time. |
Where we rely on legitimate interests, we have weighed our interest against the effect on you. You can ask us for more detail, and you can object to processing carried out on this basis (see section 9).
4. Scheme emails and marketing
Emails confirming a code, a claim, the progress of a referral or the issue of a voucher are part of running the Scheme and are sent to everyone taking part.
The email inviting a referrer to take part, and the reminders sent 14 and 60 days later if their link has not been used, are promotional. We send them only where we hold marketing permission for you, and each one carries an unsubscribe link.
Claiming a code does not sign a referred friend up to marketing. We will only send you wider Millboard news if you ticked the optional box on the form, and if you did, we record that choice in our customer relationship system so that it is honoured. You can withdraw that permission at any time using the unsubscribe link in any marketing email, or by contacting us. Withdrawing it does not affect a reward.
5. What other people can see
If you are a referrer: the page that opens from your link shows your first name and that you are a Millboard customer. Anyone holding the link can open that page, so please only pass it to people you are happy to share that with.
If you have been referred: the referral page shows the referrer's first name. The referrer can see your first name and the initial of your surname, the date you claimed your code, and a general progress status for the referral, which is one of: Code sent, In progress, Reward issued or Closed. It does not show what you ordered, where you ordered it, or whether a claim was refused. They cannot see your email address, phone number, postcode or order value.
6. Who we share your information with
We use the following suppliers to run the Scheme. They act on our instructions under a written contract, and may not use your information for their own purposes.
| Who | What they do for us | Where |
|---|---|---|
| Laravel Cloud, and its database provider Neon | Host the referral site, its database and the systems that run it | Amazon Web Services, London |
| Cloudflare | Protect the site and run the check that you are not an automated system; store invoice images submitted with distributor claims | Invoice images: stored in the EU. Site protection: Cloudflare's global network (see section 7) |
| Microsoft (Azure OpenAI Service) | Read the invoice image submitted with a distributor claim, to extract the supplier, invoice number, date and total | Microsoft's UK South region, London |
| HubSpot | Our customer relationship system. It is where referrers' records come from, and where referred friends are recorded once they claim a code | HubSpot's EU data centre |
| Microsoft | Send Scheme emails from referrals@millboard.com, and carry internal notifications to our team | Millboard's own Microsoft 365 tenant |
We also use our own webshop and finance system. The webshop sends us online order details. Our finance system receives an order number only, so that we can check it for credit notes. We buy Amazon vouchers ourselves and send you the code; we do not send your information to Amazon.
We may share information with our professional advisers, or with the authorities where the law requires it or where it is needed to investigate fraud. We do not sell personal information and we do not share it with anyone for their own marketing.
7. Where your information is held
The referral site and its database are hosted in London.
Invoice images submitted with a distributor claim are stored by Cloudflare in the European Union. The UK recognises the EU as providing an adequate level of protection for personal information.
Invoice images are read by Microsoft's Azure OpenAI Service in its UK South region, in London. Microsoft processes them on our instructions under its data protection terms and does not use them to train its models. Microsoft may keep an invoice for up to 30 days for abuse monitoring.
Your record in our customer relationship system, HubSpot, is held in HubSpot's European Union data centre. Please see our main Privacy Policy for more information on Hubspot.
Cloudflare protects the site through a global network, which means your connection may be handled at a data centre outside the UK. It sees your IP address and connection details in transit only.
8. How long we keep your information
| Information | How long we keep it |
|---|---|
| Visits to a referral link (the scrambled code only) | 90 days |
| One-time sign-in records, including the IP address the request came from | 7 days |
| Distributor invoice images, and what was read from them | 24 months after the referral closes |
| Amazon voucher codes | 90 days after issue. After that we keep only the last four characters, as a record that it was issued |
| Our record of the emails we have sent you (not the content) | 12 months |
| Our audit record of actions taken by staff | 6 years |
| Referrer, referred friend and referral records, including claims that were refused and the reason | 6 years after the referral has finished (rewarded, refused, returned or expired). A referrer's own record is kept until 6 years after their link has expired and their last referral has finished. After that the record is anonymised so it can no longer be linked to you, and only the figures are kept. |
| Your record in our customer system (HubSpot) | As set out in our main Privacy Policy |
| Marketing preferences | For as long as you remain opted in, and afterwards as a record that you asked us to stop |
Deletion is carried out automatically each night. When we no longer need information, we delete it or anonymise it so that it can no longer be linked to you.
9. Your rights
You have the right to ask for a copy of your personal information; to ask us to correct it; to ask us to delete it or restrict how we use it, in some circumstances; to object to processing based on our legitimate interests, including the fraud checks described above; to ask us to transfer information you gave us to another organisation, in some circumstances; and to withdraw consent at any time where we rely on it, which does not affect anything we did before you withdrew it.
To exercise any of these, contact dataprotection@millboard.com. We will acknowledge your enquiry and respond within one month. There is no charge.
Asking us to delete your information while a referral is in progress may mean we can no longer administer it or issue a reward. We will tell you if that is the case.
10. Automated processing
Some checks are carried out by software. Invoices submitted with a distributor claim are read automatically, including by an AI model, and referrals and claims are checked automatically for signs of abuse such as automated traffic, duplicate claims, reused invoices and self-referral.
Where a check raises a concern, a member of our team reviews it. No claim is refused and no reward is withheld without a person deciding, and every distributor claim is confirmed by a member of our team before a reward is issued. If you disagree with a decision you can ask us to look at it again.
11. Complaints
If you are unhappy with how we have handled your information, please tell us first at enquiries@millboard.com so that we can try to put it right.
You also have the right to complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, www.ico.org.uk.
12. Changes to this notice
We may update this notice from time to time. The current version is always linked from the referral page, and the version number and date at the top show when it last changed. If we make a significant change we will tell participants directly.
Our main Privacy Policy: www.millboard.com/en-gb/trust-centre/privacy-policy/