Privacy Policy

Last updated: 2 November 2026

This policy explains what personal information Woodcraft Shutters Limited collects through this website, why we collect it, who we share it with and the rights you have over it. It describes what this site actually does, so if anything is unclear, please ask us using the contact details below.

1. Who we are

The data controller is Woodcraft Shutters Limited ("we", "us", "our"), registered office Belfry House, Bell Lane, Hertford, SG14 1BP. We supply and fit made-to-measure shutters across Essex, Hertfordshire and London.

If you have a question about this policy or your information, contact us at sales@woodcraftshutters.co.uk or on 020 7101 4698.

2. What we collect

Enquiry form

The form asks which shutter styles you are interested in, which rooms they are for, and your timing. It then asks for your name, email address and mobile number (all required). You can also add your postcode or area, any notes, and how you heard about us (all optional). Please do not put health, passport, payment or ID details in the notes box, because we do not need them. We use this information only to reply to you, arrange a free home visit and prepare a quotation. We email you a confirmation, and our team gets a notification email with the same details.

Contact by phone, email or WhatsApp

If you call, email or message us instead, we keep the details you give us for the same purpose. If you tap the WhatsApp link on our website, the chat is handled by WhatsApp (part of Meta) under its own privacy policy. Nothing is loaded from WhatsApp until you tap that link.

Reviews

If you send a review we collect your star rating, your written review, your name and, if you wish, your role. You must tick a box to confirm you are happy for your name and review to appear before you can send it. We check every review before it is published, and we only show the name you gave us.

Technical information

When you send a form, we record your IP address and the time for a short while, to stop spam and repeat submissions. We also keep a scrambled (hashed) copy of your email address, not the address itself, to limit repeat confirmation emails. Our hosting provider also records standard technical information about each page request, such as your IP address, browser type, the page requested and the time, to keep the website working and secure.

Analytics and advert measurement

If you accept Analytics, Google Analytics records which pages you visit, roughly where you are, and what device and browser you use. If you accept Marketing, or choose Accept (which turns Analytics and Marketing on together), our Google Ads tag tells Google Ads when you visit and when you send an enquiry, so we can see which of our Google adverts lead to enquiries. Google can then store a cookie that remembers the advert click. When you send an enquiry, the website tells Google that an enquiry was sent and which shutter styles you chose. It does not send your name, email address, phone number or notes. If you accept Analytics, Microsoft Clarity also records how our pages are used, such as clicks, scrolling and mouse movement, and builds session recordings and heatmaps from this so we can see where the website is hard to use. Clarity stores a pseudonymous ID in a cookie so it can link the pages you view. What you type into our enquiry, contact and review forms is masked, so it does not appear in recordings.

If you decline, or you have not chosen yet, none of this is collected and nothing is loaded from Google or Microsoft Clarity.

Our team

People who manage this website sign in to a private area. For security we record each sign-in attempt: the email address, time, IP address, device and browser type, and an approximate location. We email the person a sign-in alert containing those details. This does not apply to visitors.

What we do not collect

We do not take payments on this website and there are no visitor accounts, so we never collect card details or passwords from visitors. This website is not aimed at children and we do not knowingly collect information from anyone under 18.

3. Why we use it, and our lawful basis

Under UK data protection law we must have a lawful reason (a "lawful basis") for using your information. Ours are:

• To reply to your enquiry, arrange a home visit and prepare a quotation: we do this to take steps at your request before a contract (UK GDPR Article 6(1)(b)), and it is in our legitimate interests to respond to enquiries (Article 6(1)(f)).
• To supply and fit your shutters, keep records of your order and give after-sales support: to perform our contract with you (Article 6(1)(b)).
• To keep accounts and meet tax and legal obligations: we are legally required to (Article 6(1)(c)).
• To publish a review you have sent us: with your consent (Article 6(1)(a)), which you can withdraw at any time.
• To protect this website from spam and abuse, including the Cloudflare Turnstile check on our forms, the records of IP addresses and the sign-in records for our team: this is our legitimate interest in keeping the website and your information secure (Article 6(1)(f)).
• To measure how the website is used with Google Analytics and Microsoft Clarity: only if you accept Analytics. To measure whether our Google adverts lead to enquiries with Google Ads, including storing the advert click: only if you accept Marketing. Accept on the cookie banner turns both on. The lawful basis is your consent (Article 6(1)(a)).

The confirmation email we send after an enquiry is a service message about your request. It is not marketing. We do not send marketing emails or texts. If that ever changes we will ask for your consent first and include an easy way to unsubscribe in every message.

We do not sell your information. We do not make decisions about you solely by automated means. If you accept Marketing, Google may use the advert click to measure our adverts and to personalise advertising under Google's own privacy policy.

4. Who we share it with

These companies process information for us, only to provide their service:

• Vercel: hosts and delivers this website. Its servers process technical request data such as IP addresses.
• Supabase: provides our database and file storage, where enquiries, reviews, images and our team's sign-in details are held.
• Resend: sends the emails the website generates, which are your enquiry confirmation, the notification we receive, review notifications and our team's sign-in alerts. It sees the email address and the content of those emails.
• Cloudflare (Turnstile): checks that a form is being completed by a person and not a bot. It runs on the last step of the enquiry form and on the review form, and receives your IP address and some browser signals.
• Google (Analytics): counts visits to the website, only if you accept Analytics.
• Google (Ads): measures whether visits that start from our Google adverts lead to enquiries, and can store the advert click cookie, only if you accept Marketing. Google may receive your IP address and information about your device and the pages you view, and handles it under its own privacy policy.
• Microsoft (Clarity): records how pages on the website are used, including session recordings and heatmaps, only if you accept Analytics. Microsoft may receive your IP address and information about your device and the pages you view, and handles it under its own privacy policy.
• ipapi.co: looks up the approximate location of our team's sign-in IP addresses for security alerts. It does not receive visitor information.
• WhatsApp (Meta): only if you choose to message us on WhatsApp.
• Microsoft 365 and an email security filtering service: host and scan our business mailboxes, so emails you send to sales@woodcraftshutters.co.uk and our replies are stored there.

We may also share information with our accountants and professional advisers, and with public authorities where the law requires it.

Links from this website to Facebook, Instagram and WhatsApp take you to services with their own privacy policies.

5. Transfers outside the UK

Some of these companies are based in the United States or process information there, including Vercel, Supabase, Resend, Cloudflare, Google, Microsoft, ipapi.co and Meta. When information leaves the UK we make sure it is protected by an approved safeguard: the UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework for certified US companies), or the UK International Data Transfer Agreement or UK Addendum to standard contractual clauses.

6. How long we keep it

• Enquiries and contact details from people who do not become customers: 12 months after our last contact with you, then deleted automatically.
• Customer records held on this website: while you are a customer and for 6 years after our last contact with you. Accounting and tax law requires us to keep financial records for at least this long, and it is also the period in which a claim can be brought, so we keep a record of what was agreed and fitted.
• Records we hold outside this website, such as invoices and order and fitting records: for as long as the law, our insurers and professional guidance require.
• Enquiries marked as spam: 30 days.
• IP addresses and hashed email checks used to limit repeat form submissions: 30 days.
• Copies of the emails the website sends, such as your enquiry confirmation: 12 months.
• Team sign-in records: 90 days.
• Published reviews: for as long as they appear on the site. You can ask us to remove yours at any time.
• Server logs held by Vercel: for the period Vercel's service sets for this website.
• Google Analytics data: no longer than 14 months. Information received by Google Ads is kept by Google under its own privacy policy.
• Microsoft Clarity recordings and data: for the period Microsoft's Clarity service sets.

Our automatic clean-up runs once a month, so deletion happens at the next run after a period ends. If you ask us to delete your information sooner, we will, unless the law requires us to keep it. When a period ends we delete the information or anonymise it so it can no longer identify you.

How we keep your information secure

The website is served over HTTPS. Personal information is held in access-controlled systems, and the administration area is protected by multi-factor authentication so only authorised people can see enquiries. No system is perfectly secure, but we take reasonable steps to protect your information. If a breach puts your rights at risk we will tell you and the Information Commissioner's Office as the law requires.

7. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you
• ask us to correct anything that is wrong
• ask us to delete your information
• ask us to restrict how we use it, or object to how we use it, including where we rely on legitimate interests
• ask for it in a portable format
• withdraw any consent you have given us, at any time, using the "Cookie preferences" link at the bottom of every page or by emailing us, which does not affect anything done before you withdrew it

We do not make decisions about you solely by automated means.

To use any of these rights, email sales@woodcraftshutters.co.uk, call 020 7101 4698, or write to us at the address above. We reply within one month and do not charge unless a request is clearly unfounded or excessive. We may ask you to confirm who you are first.

If you are not happy with how we have handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

8. Cookies and similar technologies

Cookies are small files a website stores on your device. We use as few as possible.

When you first visit, a banner lets you decline or accept, or open Customise and choose Analytics and Marketing separately. Until you choose, nothing is loaded from Google or Microsoft Clarity and no analytics or advertising cookies are set. Declining is as easy as accepting, and the website works exactly the same either way. Analytics and Marketing are separate choices. Accept turns on both. Analytics is Google Analytics and Microsoft Clarity. Marketing is our Google Ads tag, which can store a cookie so an enquiry can be matched to the advert that was clicked. If you chose before Marketing was a separate option, we ask you again, and nothing is loaded until you do.

Use "Cookie preferences" at the bottom of every page to change your choice at any time. If you decline, or later turn a choice off, that measurement stops straight away and we delete its cookies from your browser. Turning Analytics off deletes the Google Analytics cookies and the Clarity cookies set on this website (_clck and _clsk). Cookies Microsoft sets on clarity.ms and bing.com cannot be deleted by this website, but you can delete them in your browser settings. Turning Marketing off deletes the Google Ads click cookies (names starting with "_gcl_"). You can also block or delete cookies in your browser settings without affecting how the site works.

We do not use social media tracking pixels. If you turn on Marketing, we allow Google to store advertising cookies, to receive information about your visit for advert measurement, and to use it to personalise the adverts you see. If Marketing is off, none of this happens. The website's fonts are hosted on our own servers, so your browser does not contact Google Fonts.

• cookie-consent. Set by: This website (your browser's local storage). What it does: Remembers your cookie choice so we do not keep asking. How long: Until you clear your browser data or change it. Needs consent: No, strictly necessary.
• cookie-consent-categories. Set by: This website (your browser's local storage). What it does: Remembers which cookie choices you made. How long: Until you clear your browser data or change it. Needs consent: No, strictly necessary.
• _ga. Set by: Google Analytics. What it does: Tells visitors apart so we can count them. How long: Up to 2 years. Needs consent: Yes, Analytics.
• _ga_ followed by the ID of each Google tag we use. Set by: Google Analytics. What it does: Keeps track of a visit. How long: Up to 2 years. Needs consent: Yes, Analytics.
• _gcl_aw. Set by: Google Ads. What it does: Records the advert click that brought you to the site, so an enquiry can be linked to it. How long: 90 days. Needs consent: Yes, Marketing.
• _gcl_au. Set by: Google Ads. What it does: Measures how adverts lead to enquiries. How long: 90 days. Needs consent: Yes, Marketing.
• _clck. Set by: Microsoft Clarity. What it does: Remembers a pseudonymous ID so visits can be counted and linked. How long: 1 year. Needs consent: Yes, Analytics.
• _clsk. Set by: Microsoft Clarity. What it does: Links the pages you view in one visit into a single recording. How long: 1 day. Needs consent: Yes, Analytics.
• CLID. Set by: Microsoft (www.clarity.ms). What it does: Recognises the same browser across websites that use Clarity. This website cannot delete it. How long: 1 year. Needs consent: Yes, Analytics.
• MUID. Set by: Microsoft (clarity.ms and bing.com). What it does: Identifies your browser across Microsoft sites, which Microsoft says it uses for advertising, site analytics and other purposes. This website cannot delete it. How long: 390 days. Needs consent: Yes, Analytics.
• MR. Set by: Microsoft (c.clarity.ms and c.bing.com). What it does: Tells Microsoft whether to refresh MUID. This website cannot delete it. How long: 7 days. Needs consent: Yes, Analytics.
• ANONCHK. Set by: Microsoft (c.clarity.ms). What it does: A check Microsoft sets alongside MUID. Clarity always sets it to 0. This website cannot delete it. How long: 10 minutes. Needs consent: Yes, Analytics.
• SM. Set by: Microsoft (c.clarity.ms). What it does: Keeps MUID in step across Microsoft domains. This website cannot delete it. How long: Until you close the browser. Needs consent: Yes, Analytics.
• SRM_B. Set by: Microsoft (c.bing.com). What it does: Set while Clarity records a visit. This website cannot delete it. How long: 390 days. Needs consent: Yes, Analytics.

Cloudflare Turnstile, which protects our forms, uses technical checks from your browser to tell people from bots. It does not set advertising or tracking cookies for us. Our own team's sign-in to the private administration area sets a sign-in cookie for those staff only; visitors never receive it.

9. Changes to this policy

We may update this policy from time to time, for example if we add a new service. The current version is always on this page, with the date it was last updated at the top. We will highlight significant changes here.