Privacy policy

Last updated: 11 September 2026

This privacy policy explains how Neo Office collects, uses, stores and protects your personal data when you use our website, contact us, sign up to our newsletter or apply for a role with us. We are committed to handling your information responsibly and in line with the Data Protection (Jersey) Law 2018.

Who we are

Neo Office is the trading name of LEPT Ltd (T/A Neo Office), an office furniture and workplace specialist serving Jersey, Guernsey and the Isle of Man.

• Registered office and showroom: La Bantchette, 3-5 Conway Street, St Helier, Jersey, JE2 3NT
• Jersey company registration number: 161915
• Email: [email protected]
• Telephone: +44 1534 517240

For the purposes of the Data Protection (Jersey) Law 2018, LEPT Ltd is the data controller for the personal data described in this notice. We are registered with the Jersey Office of the Information Commissioner, registration number 102929

DATA CONTROLLER/PROCESSOR: LEPT Limited

If you have any questions about this notice or how we handle your data, please contact our data protection contact, Lucy Sinclair, at [email protected].

The personal data we collect

We only collect the information we need to respond to you and run our business. Depending on how you interact with us, this may include:

• When you make an enquiry through our contact form, by email or by phone: your name, email address, telephone number, the type of enquiry and anything you choose to tell us in your message.
• When you sign up to our newsletter: your email address.
• When you apply for a role by emailing [email protected]: your name, contact details, CV and any covering information you send us.
• When you become a client: the details we need to plan, quote, deliver and support your project, including relevant contact and delivery information.
• Automatically, when you use the website: limited technical information such as your IP address and browser type, handled by our hosting and security provider, and usage statistics from Google Analytics, which we load only if you accept analytics cookies. Google Analytics sets cookies and collects information about how you use the site, such as the pages you visit and the device and browser you use. It uses Google Analytics 4, which does not store your full IP address.

We do not collect special category data (such as health or biometric information), and we ask that you do not send it to us.

How we use your data, and our lawful basis

Under the Data Protection (Jersey) Law 2018 we must have a lawful basis for using your personal data. We rely on the following:

• To respond to your enquiry and prepare quotes or proposals. Lawful basis: taking steps at your request before entering into a contract, and our legitimate interest in responding to potential clients.
• To deliver a project and provide aftercare once you are a client. Lawful basis: performance of our contract with you, and our legitimate interest in supporting our work.
• To send you our newsletter and marketing updates. Lawful basis: your consent, given when you sign up. You can withdraw it at any time using the unsubscribe link in any email or by contacting us.
• To consider your job application. Lawful basis: taking steps at your request before a possible contract of employment, and our legitimate interest in recruitment.
• To run, secure and improve our website. Lawful basis: our legitimate interest in keeping the site available, safe and working well.
• To help us draft and summarise using an AI assistant. Where a task involves personal data, such as summarising or drafting from an enquiry, we use Anthropic's Claude through its API, which processes the data under a data processing agreement and does not use it to train its models. Lawful basis: our legitimate interest in running the business efficiently, balanced against your rights.
• To meet our legal, accounting and tax obligations. Lawful basis: compliance with a legal obligation.

Where we rely on legitimate interests, we have considered your rights and interests and will always give them proper weight.

Who we share your data with

We do not sell or rent your personal data to anyone. We share it only where necessary to run our business, and only with providers who are required to protect it:

• Supabase, which hosts the database behind our own customer records system. Our client and enquiry records are stored there, within the European Union (Frankfurt, Germany).
• Cloudflare, which provides hosting, security and content delivery for our website and application.
• Microsoft (Microsoft 365). We use Microsoft Outlook and Exchange for email, and SharePoint, OneDrive and Teams for storing documents and communications. Correspondence with you, job applications sent to us, project documents and any client messages that contain personal data are held here.
• Mailchimp (operated by Intuit), which we use to send our newsletter. Your email address is stored with Mailchimp only if you sign up.
• Our accounting and billing software. We use QuickBooks and Zoho Billing to raise invoices and keep our financial records. These hold client contact and billing details for the purpose of invoicing and accounting.
• Steelcase (EasyCom). As the authorised Steelcase supplier for the Channel Islands and Isle of Man, we use Steelcase's EasyComS system to prepare and place orders. The customer and vendor records we enter, including contact and delivery details, are held in this Steelcase hosted system.
• Google (Google Analytics). We use Google Analytics 4 to understand how our website is used, but only if you accept analytics cookies. Google acts as our data processor for this, and may process the data in the United States.
• Anthropic (Claude API). Where we use AI to help process personal data, such as summarising or drafting from an enquiry, document or application, this is done through Anthropic's Claude API, including within our own customer system. Anthropic processes this data under a data processing agreement and does not use it to train its models.
• Professional advisers such as our accountants, and authorities or regulators where we are legally required to disclose information.

Where your data is held, and transfers outside Jersey

We keep personal data within the European Economic Area wherever we can. The European Economic Area, and the United Kingdom, are treated under the Data Protection (Jersey) Law 2018 as providing an adequate level of protection, so no additional safeguards are needed for data held there. Where a provider is based elsewhere, we rely on appropriate safeguards.

Customer records (Supabase). Your enquiry and client records are held in our database, hosted by Supabase in the European Union, in Frankfurt, Germany. This is within the European Economic Area, so no additional safeguards are needed.

Website delivery and security (Cloudflare). Our website is delivered and protected by Cloudflare, which runs a global network that includes data centres in the European Union. Cloudflare mainly handles limited technical data such as IP addresses, and provides standard contractual clauses for any processing that takes place outside the European Economic Area.

Email, documents and communications (Microsoft 365). Our email, documents and internal communications are held in Microsoft 365 (Outlook, Exchange, SharePoint, OneDrive and Teams). Because our tenant is in Jersey, Microsoft stores this data at rest in its European Union and EFTA data centre region. The countries in that region are within the European Economic Area, or otherwise recognised as providing adequate protection under the Data Protection (Jersey) Law 2018, so no additional safeguards are needed. Microsoft applies standard contractual clauses for any limited processing that takes place outside that region.

Accounting and billing (Zoho Billing and QuickBooks). Zoho Billing holds our data in Zoho's European Union data centre, located in the Netherlands with backup infrastructure in Ireland, which is within the European Economic Area. As Zoho is a global group, some access or support may take place from outside the European Economic Area, and Zoho applies standard contractual clauses to any such transfer. QuickBooks Online, operated by Intuit, is hosted primarily in the United States and does not offer a UK or European hosting option; for this we rely on the standard contractual clauses that Intuit incorporates into its terms.

Newsletter (Mailchimp). Mailchimp stores data on servers in the United States. It is certified under the EU to US and UK Data Privacy Framework and also provides standard contractual clauses, and these are the safeguards we rely on. The only personal data involved is the email address you give us when you sign up.

Ordering with Steelcase (EasyCom). We use Steelcase's EasyComS system to prepare and place orders. The EasyComS database is hosted by Steelcase, so the customer and vendor details we enter, including contact and delivery details, are held by Steelcase on our behalf. Steelcase's data controller for Europe is Steelcase S.A., based in France, within the European Economic Area. Steelcase may process the data at its affiliates or service providers both inside and outside the European Economic Area, and states in its own privacy policy that it protects any such transfer using standard contractual clauses.

Anthropic (Claude API). Anthropic is based in the United States. We use Anthropic's Claude through its API, and on Anthropic's commercial API terms our data is not used to train its models. For this transfer we rely on the appropriate safeguards recognised under the Data Protection (Jersey) Law 2018, namely the standard contractual clauses incorporated into Anthropic's data processing agreement.

Google (Google Analytics). Google LLC is based in the United States and may process analytics data there and in other countries where Google operates. Google processes this data on our behalf under the Google Analytics Data Processing Terms, which incorporate the standard contractual clauses, and Google LLC is also certified under the EU to US and UK Data Privacy Framework. These are the safeguards we rely on. Google Analytics only runs if you accept analytics cookies.

We do not transfer your personal data anywhere else outside Jersey.

How long we keep your data

We keep personal data only for as long as we need it:

• Enquiries that do not become projects: kept for around three years, then deleted.
• Client records: kept for the length of our relationship and for up to ten years afterwards, to meet legal, tax and warranty obligations.
• Newsletter sign ups: kept until you unsubscribe.
• Job applications: kept for up to two years, so we can consider you for future roles, unless you ask us to remove them sooner or you join the team.

Keeping your data safe

We take appropriate technical and organisational measures to protect your personal data against loss, misuse or unauthorised access. These include encrypted connections, access controls, and working with reputable providers who maintain their own security standards. No system can be completely secure, but we take these responsibilities seriously.

Your rights

Under the Data Protection (Jersey) Law 2018 you have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct data that is inaccurate or incomplete;
• ask us to delete your data where there is no good reason for us to keep it;
• ask us to restrict how we use your data;
• object to us using your data where we rely on legitimate interests;
• ask us to transfer your data to another provider, where this applies;
• withdraw your consent at any time where we rely on it, such as for marketing.

To exercise any of these rights, please contact Lucy Sinclair at [email protected]. We will not charge you, and we will respond within one month. We may need to confirm your identity before we act on a request.

Cookies and analytics

When you first visit our website we show a cookie banner so you can choose which non-essential cookies and technologies to allow. Nothing in the categories below is switched on until you accept it, and you can change or withdraw your choice at any time using the Cookie settings link in the footer.

We group them as follows:

• Strictly necessary — always on. The limited cookies the site needs to work and stay secure, set by our hosting and security provider. This includes Cloudflare Turnstile, which protects our contact and newsletter forms from spam and bots without tracking you or setting advertising cookies. These do not require consent.
• Analytics — off until you accept. We use Google Analytics 4 to understand how the site is used. It sets cookies and shares data with Google, which acts as our processor, so we only load it if you accept analytics. Google Analytics 4 does not store your full IP address. If you decline, no analytics cookies are set and Google Analytics does not run.
• Marketing & embeds — off until you accept. Third-party content such as the Google map on our contact page. Google may set its own cookies and receive your data, so the interactive map only loads if you accept this category. If you decline, we show a static illustrated map instead.

If you sign up to our newsletter, our email provider may use limited technology to tell us whether emails are opened.

The principles we follow

The Data Protection (Jersey) Law 2018 sets out principles for handling personal data. We aim to make sure your data is used fairly, lawfully and transparently; collected for specified and legitimate purposes; limited to what we actually need; kept accurate and up to date; held no longer than necessary; and kept secure.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can put it right. You also have the right to complain to the Jersey Office of the Information Commissioner:

• Address: Jersey Office of the Information Commissioner, 2nd Floor, 5 Castle Street, St Helier, Jersey, JE2 3BT
• Telephone: +44 1534 716530
• Email: [email protected]
• Website: jerseyoic.org

Changes to this policy

We may update this policy from time to time. When we do, we will change the date at the top of this page. Please check back occasionally to stay informed.

Contact us

If you have any questions about this privacy policy or your personal data, contact:

Lucy Sinclair, Neo Office (LEPT Ltd)

La Bantchette, 3-5 Conway Street, St Helier, Jersey, JE2 3NT

[email protected] | +44 1534 517240