Privacy policy

Joe Gregson trading as Woodson & Son Oak is the controller responsible for the personal information described in this policy. Our address is 26 Hamps Valley Road, Waterhouses, Staffordshire, ST10 3LJ, United Kingdom. Contact info@woodsonandson.com or 01538 224229 about your information or this policy.

This policy covers woodsonoak.com, enquiries about our oak products and related customer administration. Our separate Woodson & Son website at woodsonandson.com has its own privacy and cookie information for the services provided there.

Enquiries and quotations: your name, email address, any telephone number and postcode supplied, messages, project requirements, dimensions, how you heard about us and correspondence about your enquiry.

Project material: photographs, sketches, drawings and site information you send, which may reveal your address, property layout, people or location information embedded in a file.

Orders and aftercare: billing and delivery details, agreed specifications, installation arrangements, order and payment references, invoices, communications, complaints and warranty records. Payment information available to us depends on the payment method; do not send full card numbers or security codes through the enquiry form or by email.

Website use: technical information such as IP address, device and browser information and request/security logs may be processed by services that deliver and protect the website. The postcode checker uses the postcode you enter to calculate delivery eligibility.

Most information comes directly from you. We may also receive relevant information from someone arranging a project on your behalf, a delivery or installation contractor, or the services used to administer your purchase. We only need information relevant to the enquiry or work. Please avoid sending unnecessary information about children, neighbours, health or other sensitive matters.

To discuss your requirements, prepare a requested quotation and arrange or fulfil an order, we rely on steps you request before entering a contract or performance of our contract with you.

To issue invoices and retain records required by tax or other applicable law, we rely on legal obligation.

To administer general enquiries, communicate with a representative or business contact, organise our work, keep evidence of what was agreed, handle disputes and protect against misuse, we rely where appropriate on legitimate interests in operating and protecting a small joinery business. We consider your interests and rights when relying on this basis.

Marketing messages are separate from order and enquiry communications. Where we seek consent for marketing or identifiable project photographs, consent is the basis for that use. Any lawful use of the existing-customer marketing exception requires the appropriate opt-out opportunities as well as a suitable data-protection basis.

Fields marked as required on our enquiry form are needed to understand and answer your request. Other fields are optional. You can email photographs and drawings separately if they help explain your project. We will explain if particular site or order information is needed to quote accurately, deliver or perform the work.

We use enquiry photographs and drawings to assess your project, discuss practical requirements, prepare a quotation and, if you order, carry out and document the agreed work. Where needed, we may share relevant material with people helping us price, design, deliver or install that project.

Submitting images does not subscribe you to marketing or give us unrestricted permission to publish them. We will ask separately before using identifiable project photographs in advertising, on the website or on social media. We will agree the intended use and avoid publishing a precise home address or identifiable people without suitable permission.

If publication relies on your consent, you may withdraw it by contacting us. Withdrawal does not make earlier use unlawful. We will stop future use within our control and explain any practical limits affecting already distributed printed material.

The oak-site enquiry form uses Shopify to process your enquiry and send it to our business email. Photographs and drawings are sent separately by email rather than uploaded through the form. Krystal hosts our business email and processes these messages and attachments as part of that service.

The delivery checker sends the postcode you enter to postcodes.io to obtain geographical coordinates used to calculate delivery eligibility. It does not send your enquiry photographs or message as part of that lookup.

This oak store is hosted by Shopify, which processes website, enquiry and order information to provide and protect the store. Cloudflare manages the domain's DNS records. Our email and payment providers also process information when you contact us or place an order.

Orders on this oak website are processed through Shopify and the payment service selected at checkout. Our separate woodsonandson.com website has its own checkout arrangements.

We may share the details needed for the job with delivery companies, installers, designers or engineers involved in your order, and with accountants, insurers, legal advisers and authorities where necessary and lawful. We aim to restrict the information to what each recipient needs. A provider acting only on our instructions must be subject to appropriate processing terms; some recipients act as controllers for their own purposes.

[Before publication: verify the processing terms and roles of Shopify, Krystal and the payment and anti-spam services used by the store. Confirm whether any additional analytics, advertising, reviews or marketing services operate.]

Some online service providers may process information outside the United Kingdom. A provider’s location, transfer arrangements and safeguards must be assessed before we use it to handle personal information.

[Complete before publication: name or categorise the relevant overseas recipients, identify the destination countries or regions and state the verified UK transfer mechanism for each restricted transfer—for example, an applicable UK adequacy regulation or a UK International Data Transfer Agreement/Addendum with the required assessment. Explain how customers can obtain information about the safeguards. Do not assume that all providers are UK-based or that use of the contact form amounts to transfer consent.]

Different services on the oak website and the separate checkout may use cookies or similar device storage. We will explain their purposes, providers and durations in the applicable cookie information. Where prior consent is required, those technologies must not operate until you choose to allow them.

Essential shopping or security functions may qualify for an exception. Any other exception must meet its specific legal conditions. Advertising or tracking permission is not obtained merely by visiting the site or accepting sales terms.

[Before publication: complete a live cookie/storage inventory for both sites and the form/checkout journey; record which technologies need consent or qualify for an exception, and provide working preference controls where needed. This policy does not certify the present site’s cookie compliance.]

The retention arrangements below are a draft for review before publication. They must reflect how we actually keep, review and delete personal information.

Enquiries and quotations that do not become orders: we review enquiry emails and attachments at least once a year. We retain personal information where it is still needed for an ongoing enquiry, quotation or project, or another justified business or legal purpose. When it is no longer needed, we delete it or anonymise it. Retention is assessed according to that continuing need, rather than an automatic 12-month deletion rule.

Order specifications, drawings, completion records and relevant correspondence: normally six years after delivery or completion, and longer where an applicable guarantee, ongoing complaint, legal claim or legal obligation requires it. Review any longer retention and limit it to the records needed.

Tax and accounting records: for the statutory retention period applying to that record, using the relevant tax-year or accounting-period end where required. For records subject to a six-year VAT retention requirement, do not delete them before that period expires.

Marketing consent and project-publication permissions: while the permission is relied on and for a reasonable period needed to evidence it or handle a complaint. After an opt-out, retain only a minimal suppression record for as long as needed to prevent further unwanted marketing.

Operational and security logs, third-party submission copies and backups: [Before publication: verify the provider retention periods, including Krystal mailbox and backup arrangements; put the agreed annual review of enquiry emails and attachments into operation; and confirm that the proposed six-year order-record schedule is appropriate and implemented.]

A request for deletion will be considered against any legal duty or other lawful reason to retain particular records. We will explain any information that cannot yet be deleted.

An enquiry or purchase does not automatically mean you have consented to receive newsletters. Where we offer marketing subscriptions, the choice will be separate and optional.

We send marketing to individual subscribers only with the permission or applicable existing-customer exception required by law. Where that exception is used, messages must concern our own similar products or services and you must have been offered a simple opt-out when details were collected and in every message.

You can object to direct marketing at any time, without giving a reason, by using the unsubscribe route in the message or contacting info@woodsonandson.com. We will stop using your details for that marketing. Essential communications about an existing order may still be sent.

Depending on the circumstances, you may request access, correction, erasure, restriction or a portable copy of your information. You may object to processing based on legitimate interests because of your particular situation. Your right to object to direct marketing is unconditional.

Where processing relies on consent, you may withdraw it at any time as easily as you gave it. This does not affect the lawfulness of processing before withdrawal. Some rights have legal exceptions; we will explain any refusal or restriction.

Contact us using the details above. We may request proportionate information to verify identity and locate the record. We normally respond within one month, subject to lawful extensions or other adjustments to the time limit, and will explain any such adjustment. We normally do not charge for a rights request.

If you are unhappy with how we handle your information, please contact us so we can investigate. You may also complain directly to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. You do not have to complete our complaints process before contacting the ICO.

We aim to use proportionate access controls and secure services for enquiry and order records. No online transmission can be guaranteed completely secure. Please tell us promptly if you suspect information sent to us has been compromised.

The postcode tool automatically estimates delivery eligibility. You can contact us for a person to review the delivery position; it does not itself accept or reject an order. [Before publication: confirm whether any payment or fraud service makes other significant automated decisions and add the required explanation if applicable.]

We may update this policy when our practices or legal obligations change. The date of the published version will appear below. Material changes will be brought to your attention where appropriate. Changes to our website, hosting or service providers require a review of the information we collect and how it is used.