Privacy Policy

Who we are

Timbermere Studio is a trading name of Fast Forex(“we”, “us”), a sole trader and the data controller for the personal information described here. We're a single-maker workshop based in Selby, North Yorkshire, United Kingdom.

• Postal address: available on request — email us and we'll provide it.
• Email: studio@timbermere.com

What we collect

We collect only what we need to take and fulfil your order, and to answer you when you get in touch:

• Order details — your name, delivery address, email address, and what you bought. Checkout is handled by our payment provider, Snipcart; your card payment is processed by their payment partner. We never see or store your full card details.
• Correspondence — if you email us, we keep your message and address so we can reply and resolve your query.
• Newsletter — if you subscribe to our workshop letter, your email address, so we can send it. You confirm your subscription by email (double opt-in) and can unsubscribe from any letter.
• Service enquiries — if you ask us to quote for the Refresh Service, your name, email address, what you tell us about the board, and photographs of your property. Two things are worth knowing about the photographs. Your browser resizes and re-saves each one before it is sent, which removes the location data a phone normally embeds — so we never receive the coordinates of where the picture was taken. And they are only ever attached to the email that reaches the workshop: they are not uploaded to our website or stored in our content system.

Site analytics (with your consent) — if you accept analytics in our cookie notice, we use Microsoft Clarityfor anonymous session insights (heatmaps and recordings, with form fields and the checkout masked) to improve the site. It doesn't collect your name or email and isn't used for advertising — see our Cookie Policy.

Visitor statistics (no cookies) — we count page views using Umami and Cloudflare Web Analytics: which pages get read, which site or search engine sent you, roughly which country you're in, and how quickly pages render. This sets no cookie, stores nothing on your device, doesn't identify you, and doesn't follow you to other sites. It runs unless you choose Reject in the cookie notice — see our Cookie Policy.

Why we use it, and our lawful basis

• To process and deliver your order and provide customer service — performance of our contract with you.
• To keep business and tax records — compliance with a legal obligation.
• To keep the website secure and working — our legitimate interests in running the shop safely.
• To assess your board and quote for restoring it — steps taken at your request before entering into a contract, and then performance of that contract if you accept the quote.
• To show a before-and-after photograph of your board publicly — your consent, asked for separately and only after the work is done. We never assume it, saying no changes nothing about your restoration, and you can change your mind later.
• To send our workshop letter, if you've subscribed — your consent, which you can withdraw at any time by unsubscribing.
• To understand and improve how the site is used, if you accept analytics — your consent, which you can withdraw any time via Cookie settings.
• To count page views, see which pages are worth keeping, and check the site is fast enough — our legitimate interestsin knowing what it's actually doing. This sets no cookies and identifies nobody. You can object at any time by choosing Reject in the cookie notice, and we stop.

Who we share it with

We only share your information with the providers that help us run the shop:

• Snipcart — checkout and payment processing.
• PayPal — product pages load PayPal’s own instalment message, so PayPal sees that a page was opened (including your IP address) even if you never use it. It has to come from PayPal because PayPal is the lender and the wording is theirs by law. It sets no cookie on our site, and it is the only outside script here that isn’t held back until you choose — payment information at the till, rather than measurement. PayPal is a separate controller for it, under its own privacy statement.
• Delivery couriers — to ship your order to you.
• EmailOctopus — our newsletter provider (EU-hosted), which stores subscriber details (your email, and your first name if you share it) and sends the letter. Only if you subscribe.
• Reviews — if you leave one, the display name you choose and your words are published on the product’s page (that’s their purpose). The link to your order is kept privately for verification. See the review policy.
• Microsoft Clarity — anonymous session analytics (heatmaps and recordings), processed by Microsoft as our processor. Only if you accept analytics cookies; Microsoft may process data outside the UK under standard contractual clauses.
• Umami and Cloudflare Web Analytics — cookieless visitor statistics, processed as our processors. No cookies, nothing stored on your device, and nothing that identifies you.
• Service enquiries — an enquiry and its photographs travel through Resend, our transactional email provider, into the workshop’s Google Workspace mailbox, where the maker reads them. Nobody else receives them. They are not sold, not shared with anyone else, not used for advertising, and not used to train any AI system.
• Our hosting and infrastructure — Railway (hosting), Cloudflare (security/delivery), and Sanity (content). These handle the running of the site, not marketing.

We never sell your personal data or use it for third-party advertising.

We do allow AI systems to read the writing we publish on this site — that is what it is for. That permission has nothing to do with anything you send us: your photographs, messages and details are never part of it.

Where your data is processed

Some of these providers may process data outside the UK. Where they do, appropriate safeguards (such as UK ‘adequacy’ decisions or standard contractual clauses / the UK addendum) are in place to protect it.

To be specific about the one that involves photographs: a Refresh Service enquiry is handled by Resend and by Google Workspace, both US companies, so your message and its photographs are processed outside the UK under those safeguards. If you would rather they weren't, email us instead of using the form and we'll work out another way.

How long we keep it

We keep order and transaction records for around six years, to meet UK accounting and tax rules. Enquiry emails are kept only as long as needed to deal with your query.

A Refresh Service enquiry — your name, email, what you told us and the details of the job— is kept for 1 year after the job is closed, then deleted. Your photographs are not kept separately at all: they exist only as attachments on the email, and go when that correspondence goes. If we've asked and you've agreed to us publishing a before-and-after picture, that one photograph is kept for as long as it's published — tell us at any time and we'll take it down.

Your rights

Under UK data-protection law you have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete data, or restrict or object to how we use it;
• ask for your data in a portable format, where applicable.

To exercise any of these, email studio@timbermere.com. If you're unhappy with how we handle your data, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last reviewed.