Privacy

Tom's Woodshop is the data controller for this site. Any questions, email [email protected].

What I collect, and why

If you order: your name, email, delivery address, phone number if you give one, and what you bought. I need this to make and send you the thing, and to keep the records HMRC requires. Legal basis: performance of a contract, and legal obligation for the records.
If you use the enquiry form: your name, email and whatever you write. Used solely to reply to you. Legal basis: legitimate interest in answering people who contact me.
If you join the mailing list: your email address, and the fact that you ticked the box and when. Kept in my own storage rather than a marketing company's, and used only to tell you when there's new work. Legal basis: your consent, which you can withdraw at any time using the unsubscribe link on every email or by emailing me. Unsubscribing deletes the record outright.
Card details: I never receive them. Payment is handled entirely by Stripe.

The mailing list is the only marketing I do, it is opt-in, and it is no more than a few times a year. If you haven't joined it I won't email you about anything other than your order or your enquiry. I will never sell or share your details with anyone.

Who else is involved

Running a small shop means a few companies process data on my behalf:

Cloudflare: hosts the site, runs the checkout and enquiry code, and stores the mailing list.
Resend: delivers enquiry form messages, order confirmations and mailing list emails.
Stripe: runs the checkout page and takes the payment.
Apple (iCloud+): provides the email service for my address.
Royal Mail or a courier: receives your name and address to deliver.

Some of these are based outside the UK. Where data leaves the UK it's protected by the standard safeguards those providers have in place, such as the UK International Data Transfer Addendum.

The typefaces on this site are served from my own server rather than from Google, so loading a page here does not tell Google anything about you.

Cookies and measurement

This site sets no cookies at all, and there is no advertising or cross-site tracking of any kind. Your basket is kept in your own browser's local storage, which never leaves your device and is not visible to me. If you arrived from a link with a short tag on the end (such as ?src=ig), that tag is kept there too for 30 days and sent with any order or message, so I can see which places people find the shop from. It says nothing about you. Stripe sets cookies on its own checkout page, which are strictly necessary to take a payment safely.

I use Cloudflare Web Analytics to count page views, so I can see which pieces people actually look at. It sets no cookies, uses no device fingerprinting, and collects no data that could identify you. There is nothing to opt out of because nothing about you is stored.

How long I keep things

Order records are kept for six years, because HMRC requires it of a sole trader. Enquiries that don't turn into orders are deleted within two years. Proof artwork for engraved pieces is kept while there's any chance you'll reorder, and deleted on request. Mailing list addresses are kept until you unsubscribe, and deleted when you do.

Your rights

You can ask me for a copy of what I hold about you, ask me to correct it, ask me to delete it (except where I'm legally required to keep order records), or object to how I'm using it. Email me and I'll deal with it within a month, free of charge.

If you're not happy with how I've handled it, you can complain to the Information Commissioner's Office at ico.org.uk, though I'd appreciate the chance to put it right first.