1. Who we are
William Alexander Group Limited, trading as William Alexander Logs ("we", "us", "our"), of The Barn, Bagwell Lane, Winchfield, Hook, Hampshire RG27 8DB, is the data controller for the personal data described in this policy.
Contact us about privacy at info@williamalexanderlogs.com or 01252 416123.
TODO (owner to confirm/complete): ICO registration reference number; a named privacy contact or Data Protection Officer, if appointed.
2. What personal data we collect
Depending on how you use the site, we collect:
- Order & delivery details - name, email, phone number, delivery/collection address and postcode, delivery notes, safe-place instructions, and your order history and its value.
- Account details - your email and a password (stored hashed by our authentication provider, never in plain text or visible to us), and your marketing preference.
- Payment status - we record that an order was paid and its amount; we never see, receive or store your card number, expiry date or CVV. Card payments are handled entirely by Stripe.
- Wholesale/trade account details - for approved trade customers, your account's agreed pricing and invoice history.
- Contact form & waitlist - name, email, phone (optional) and message if you contact us; email only if you join a product waitlist.
- Technical & usage data - IP address and basic request metadata used for fraud/abuse prevention (rate-limiting) and, only with your analytics consent, cookie-based usage analytics via Google Tag Manager (see Cookies, below).
3. Our lawful basis for using it
- Performance of a contract - taking, fulfilling, delivering and invoicing your order; running your account; responding to a message you send us.
- Legitimate interests - preventing fraud and abuse (e.g. rate-limiting repeated checkout attempts), keeping our systems secure, and improving the site.
- Consent - analytics cookies (Google Tag Manager) and marketing emails. Both are opt-in: analytics only load after you accept them in the cookie banner, and marketing emails only go to customers who have ticked "Keep me updated" in their account. You can withdraw either consent at any time.
- Legal obligation - keeping financial/order records for the periods HMRC and UK company law require.
4. Who we share it with
We do not sell your personal data. We share the minimum necessary with the processors who run the site and fulfil your order:
- Supabase (database, authentication and file storage - hosted in the EU) - stores your order, account and profile data behind access controls.
- Netlify (website hosting/CDN) - serves the website itself.
- Stripe (payment processor) - handles card payments. Card details go directly to Stripe; we never see them. Live payments are processed through Stripe.
- Onfleet (delivery routing/driver app) - your name, delivery address, phone and delivery notes are sent to Onfleet so our driver can find you and be tracked, only once a delivery is booked.
- TPN (The Pallet Network) - for nationwide pallet deliveries only, your delivery address is passed to arrange the pallet courier.
- Resend (transactional email) and Twilio (SMS) - used to send order/delivery confirmation messages once enabled; not yet switched on at the time of writing.
- postcodes.io - your delivery postcode is checked against this free UK postcode-lookup service to confirm we deliver to you; no account or personal data is created with them.
- Google Tag Manager / Google Analytics - only if you accept analytics cookies (see below).
Each processor only receives the data it needs to perform its function for us, under a data processing agreement or standard terms that require them to protect it.
5. International transfers
Some of our processors (for example Google, Stripe, Twilio) may process data outside the UK/EEA, including in the United States. Where that happens, we rely on the provider's UK/EU-approved safeguards (such as the UK International Data Transfer Addendum or the EU Standard Contractual Clauses, and/or the EU-US/UK-US Data Privacy Framework where the recipient is certified) to keep your data protected to UK standards.
6. How long we keep it
We keep order and invoice records for 6 years after the tax year they relate to, as UK tax law requires, then delete or anonymise them. Account and profile data is kept for as long as your account is active, plus a reasonable period afterwards in case you return; you can ask us to delete it sooner (see your rights, below), subject to the tax-record retention above for the order history itself. Contact-form messages are kept for up to 24 months for customer-service reference, then deleted. Waitlist entries are kept until the product is back in stock and you've been notified, or you unsubscribe, whichever is sooner. Rate-limit/abuse-prevention logs (IP-based) are kept briefly (a matter of days) and then purged automatically.
7. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data - you can edit most of it yourself from your account, or ask us.
- Erase your data ("right to be forgotten"), balanced against our legal duty to keep order/invoice records for tax purposes for 6 years - where that applies we will anonymise what we can (removing your name/contact details from the record) rather than deleting the transaction entirely.
- Restrict or object to certain processing, including objecting to direct marketing at any time.
- Port your data to another provider in a common electronic format.
- Withdraw consent for analytics cookies or marketing emails at any time, without affecting the lawfulness of processing before you withdrew it.
To exercise any of these, email info@williamalexanderlogs.com or call 01252 416123. We will respond within one month. If you're unhappy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113.
8. Keeping your data secure
The site is served entirely over HTTPS. Our database uses row-level access controls so that, for example, a customer can only ever read their own orders and a member of staff's access is limited to what their role needs (order/finance data is not visible to a website-image editor, for instance, and our most sensitive financial settings are restricted to the two most senior admin accounts). Passwords are hashed by our authentication provider; we never see them in plain text.
9. Cookies
We use two kinds of cookies/local storage:
- Strictly necessary (always on, no consent required) - keeping your basket contents between pages, keeping you signed in, remembering the postcode you last checked, and the cookie-consent choice itself. These don't require consent under the rules on cookies (PECR) because the site cannot function without them.
- Analytics (only with your consent) - Google Tag Manager, which we use to understand how the site is used and to measure the effectiveness of our marketing. This is not loaded until you click "Accept analytics cookies" in the banner shown on your first visit. You can change your choice at any time via "Cookie preferences" in the footer of every page, or reject it in the banner.
We do not currently run advertising/retargeting cookies. If that changes, this policy and the consent banner will be updated to match before any such cookie is set.
Registered company: William Alexander Group Limited, The Barn, Bagwell Lane, Winchfield, Hook RG27 8DB.