Privacy & Data Protection Policy

1. Identification of the Data Controller

This Privacy Policy sets out the basis on which personal data collected from you, or provided by you, will be processed by Cotswold Woodcraft & Joinery Ltd ("we", "us", "our"), a private limited company registered in England and Wales under Company Registration Number 12894532, having our registered office and trading workshop at Unit 4, Mill Valley Estate, Burford Road, Minster Lovell, Witney, Oxfordshire, OX29 0RJ, United Kingdom.

We are committed to preserving the confidentiality and integrity of all personal information entrusted to us in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. For all data protection enquiries, you may contact our appointed Data Protection Officer via email at [email protected] or by post to our registered address.

2. Information We Collect from You

We may collect and process the following categories of personal information:

• Identity & Contact Information: Full name, title, physical residential or commercial delivery address, postcode, email address, and telephone numbers provided via consultation forms or telephone correspondence.
• Architectural & Property Information: Architectural elevations, site survey laser measurements, room photographs, property listing status (e.g. Grade II listed building consent documents), and design specifications.
• Financial & Transactional Information: Bank transfer records, transaction receipts, invoice history, and billing records required to process stage payments. We do not store raw debit or credit card credentials.
• Technical Website Data: Internet protocol (IP) address, browser version, operating system, and anonymous analytical interaction records gathered to maintain site security and usability.

3. Lawful Bases for Processing Personal Data

Under Article 6 of the UK GDPR, we process your personal data under the following recognized legal grounds:

• Performance of a Contract: Processing necessary to fulfill quotation requests, conduct measured architectural surveys, procure certified hardwood flitches, fabricate joinery, and perform on-site installation.
• Compliance with Legal Obligations: Retention of VAT invoices, commercial contracts, and accounting records to comply with HM Revenue & Customs (HMRC) and the Companies Act 2006.
• Legitimate Interests: Processing necessary for responding to prospective client enquiries, project management, and communicating essential warranty or joinery maintenance updates.

4. Disclosure of Your Personal Data

We respect your privacy and will never sell, rent, or trade your personal information to marketing third parties. We share information only with trusted third parties strictly necessary to deliver your commission:

• Dedicated specialist logistics and courier couriers dispatched to deliver timber sample boxes.
• Specialist heritage glazing manufacturers or structural engineering consultants assisting with listed building approvals where explicitly agreed.
• Professional advisors including our accountants, insurers, and legal counsel for statutory compliance.

5. Data Retention Periods

We retain personal data relating to completed joinery contracts for seven (7) years following completion to satisfy statutory HMRC taxation and company audit obligations, and to support our 12-month craftsmanship warranty. Uncontracted initial enquiry records are purged securely after twenty-four (24) months.

6. Cookies and Analytic Tracking

Our website uses minimal, essential functional cookies to ensure page responsiveness, secure navigation, and session continuity. We do not deploy invasive third-party behavioural advertising cookies. You can manage or disable cookies at any time via your browser settings.

7. Your Statutory Rights Under UK GDPR

As a data subject resident in the United Kingdom, you possess enforceable legal rights, including:

• Right of Access: Request a copy of the personal information we hold concerning you (Subject Access Request).
• Right to Rectification: Request correction of inaccurate or incomplete records.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data where retention is no longer legally justified.
• Right to Restriction & Objection: Request that we restrict processing or object to processing based on legitimate interests.

To exercise any of these rights, please submit a written request to [email protected]. We respond within one calendar month without charge.

8. Supervisory Authority & Complaints

If you believe that our processing of your personal information breaches data protection law, you have the right to lodge a formal complaint with the UK supervisory authority: The Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF (www.ico.org.uk).