Last updated: 4 August 2026
Privacy Policy
Whimble Wood ('we', 'us', 'our') is committed to protecting your personal data. This policy explains what information we collect, how we use it, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
Who we are
Whimble Wood is a sole trader business based in the United Kingdom. We are the data controller for the personal information you provide to us. If you have any questions about this policy or how we handle your data, please contact us at [email protected].
What data we collect
We collect information you provide directly to us when you place an order (name, delivery address, email address, phone number, personalisation details), sign up to our newsletter (name and email address), or contact us via our contact form (name, email address, and the content of your message). We also collect certain technical data automatically when you visit our website, including your IP address, browser type, pages visited, and referring URL. This is collected via cookies and similar technologies — see our Cookie Policy for more detail.
How we use your data
We use your personal data to process and fulfil your orders, communicate with you about your order, respond to your enquiries, send you marketing communications where you have opted in, improve our website and services, and comply with our legal obligations. Our lawful bases for processing are: contract performance (order fulfilment), legitimate interests (website improvement, fraud prevention), consent (marketing emails), and legal obligation.
Who we share your data with
We share your data only where necessary: with our delivery partners (Royal Mail) to fulfil your order, with our payment processor to handle transactions securely, and with our email service provider to send order confirmations and marketing emails. We do not sell your personal data to third parties. All third parties we work with are required to handle your data securely and in accordance with UK data protection law.
How long we keep your data
We retain order data for 7 years to comply with HMRC requirements. Marketing consent records are kept until you withdraw consent. Contact form submissions are retained for 2 years. Technical/analytics data is retained for 26 months.
Your rights
Under UK GDPR, you have the right to access the personal data we hold about you, request correction of inaccurate data, request erasure of your data (in certain circumstances), object to or restrict processing, withdraw consent at any time (where processing is based on consent), and lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk. To exercise any of these rights, please contact us at [email protected].
Changes to this policy
We may update this policy from time to time. The most recent version will always be available on this page, with the date it was last updated shown at the top.