Privacy Policy
Timbershacks Privacy Policy
1. Who we are
Timbershacks handcrafts rustic furniture and garden planters from reclaimed timber in our workshop in Surbiton, Surrey. This policy explains what personal data we collect when you visit www.timbershacks.com, buy from us, request a custom quote or contact us, and how we look after it.
Timbershacks is the data controller for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
- Business name: [Owner’s full name] trading as Timbershacks (or the registered company name and number, if incorporated)
- Address: Hook Road, Surbiton, KT6 5BL
- Email: info@timbershacks.com
- Phone: 07599 136408
By using our website you acknowledge the practices described in this policy.
2. Information we collect
We collect only what we need to make, sell and deliver your furniture and to run the website.
Information you give us
- Orders: name, billing and delivery address, email, phone number and order details (items, finish, quantities).
- Custom quotes and enquiries: the sizes, styles, finishes and any photos or notes you send by email, phone, our contact form or social media.
- Customer account (if you create one): login details, saved addresses and order history.
- Reviews and messages: anything you choose to share in feedback or correspondence.
Payment information
Card payments are processed securely by our payment providers. We never see or store your full card number; we receive only confirmation of payment and limited details such as the card type and last four digits.
Information collected automatically
- IP address, browser and device type, pages visited and how you arrived on the site.
- Basket and session information so the shop works properly.
- Cookie data, described in section 4.
We do not knowingly collect data from children under 13, and we do not collect special category data.
3. How we use your information
UK GDPR requires a lawful basis for each use of your data. Ours are set out below.
| What we do | Lawful basis |
|---|---|
| Process orders, take payment through Stripe or PayPal, build your furniture and arrange courier delivery | Contract |
| Prepare custom quotes and answer enquiries | Contract (steps before entering a contract) |
| Send order confirmations, build updates and dispatch notices | Contract |
| Handle damaged or incorrect items, returns and refunds | Contract and legal obligation |
| Keep financial and tax records | Legal obligation |
| Keep the website secure and prevent payment fraud | Legitimate interests |
We do not sell your data, and we do not use automated decision-making or profiling that has legal or similarly significant effects on you.
4. Cookies
Cookies are small text files stored on your device. We use only cookies that are strictly necessary for the shop, checkout and payments to work, so we do not need to ask for your consent. We do not use analytics, advertising or tracking cookies; if that changes, we will update this policy and ask for your consent first.
| Type | Example | Purpose |
|---|---|---|
| Shop and basket | woocommerce_cart_hash, wp_woocommerce_session_*, woocommerce_items_in_cart | Keep your basket and checkout working |
| Security | wordpress_logged_in_, wordpress_sec_ | Keep accounts and logins secure |
| Payment | Stripe (__stripe_mid, __stripe_sid) and PayPal cookies | Process payments securely and prevent fraud |
You can also block or delete cookies in your browser settings, though the shop may not work properly without the essential ones.
5. Who we share your information with
We share personal data only with trusted providers who help us run the business, and only what each one needs.
- Couriers: your name, delivery address and phone number so they can deliver your furniture to any mainland UK postcode.
- Payment providers: Stripe and PayPal, to take payments securely and prevent fraud. If you pay with PayPal, PayPal also acts as a separate controller under its own privacy policy.
- Website hosting and maintenance: [hosting company] and our web developer, who may access data only to keep the site running.
- Marketplaces: if you buy through our Etsy or Folksy shops, those platforms are separate controllers and their own privacy policies apply.
- Professional advisers and authorities: our accountant, HMRC or other authorities where the law requires it.
Each provider must protect your data and use it only on our instructions or as their own policy permits.
6. Transfers, retention and security
International transfers. Stripe and PayPal may process payment data outside the UK, including in the US. Where they do, they rely on UK adequacy regulations (including the UK–US data bridge) or approved safeguards such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep your data
| Data | Kept for |
|---|---|
| Order, invoice and payment records | 6 years from the end of the financial year (HMRC requirement) |
| Custom quote requests that don’t lead to an order | 12 months |
| General enquiries and emails | 2 years |
| Customer account | Until you close it, then order records as above |
Security. The site runs over HTTPS, payments are handled by PCI-compliant providers, and access to customer data is limited to those who need it. No website is completely secure, so please contact us straight away if you suspect your data has been misused.
7. Your rights
Under UK GDPR you have the right to:
- Access a copy of the personal data we hold about you.
- Rectification of anything inaccurate or incomplete.
- Erasure of your data where we no longer need it (we may still have to keep order records for tax purposes).
- Restrict or object to how we use your data.
- Data portability, receiving your data in a common machine-readable format.
To use any of these rights, email info@timbershacks.com. We will respond within one month and there is normally no charge.
Complaints. If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
8. Changes and contact
We may update this policy when our services, suppliers or the law change. The latest version will always be on this page with its “last updated” date, and we will tell customers directly about any significant change.
Questions about this policy or your data:
- Email: info@timbershacks.com
- Phone: 07599 136408 (Monday to Friday 9am–6pm, Saturday 10am–4pm)
- Post: Timbershacks, Hook Road, Surbiton, KT6 5BL
Last updated: 06/10/2026