Privacy Policy

Introduction: 4 Woods Carpentry and Construction Limited ("the Company", "we", "us") is committed to protecting the privacy of our customers, website users, and business partners. This Privacy Policy explains how we collect, use, store, and share personal information, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It also outlines your rights regarding your personal data. By using our services or website, you agree to the terms of this Privacy Policy.

Information We Collect: We may collect and process various types of personal data, including:

Contact Information: Name, address, telephone number, email address, and other contact details.
Identification Details: Company name (for commercial clients), job title, or other identifiers relevant to our business relationship.
Project Details: Information related to the services you request from us, such as property address, project specifications, plans, and any other details you provide.
Financial Information: Payment details such as bank account or credit card information (processed securely via our payment providers, not stored by us).
Website Usage Data: When you visit our website, we may collect technical data like IP address, browser type, and cookies (see our Cookies Policy), as well as any information you submit via online forms.

We collect personal data directly from you (for example, when you fill out a contact form, request a quote, or correspond with us by phone or email). We may also obtain information from third parties with your consent or as permitted by law (for instance, if a partner or subcontractor shares project-related information with us).

Legal Basis for Processing: We only process personal data when we have a lawful basis to do so:

Contractual Necessity: Most information we collect is needed to provide you with our carpentry and construction services or to take steps at your request prior to entering into a contract (e.g., preparing a quotation). Without this data, we may not be able to perform our contract with you.
Legal Obligation: We may process data to comply with legal requirements, such as maintaining records for tax purposes, health and safety compliance, or responding to lawful requests by authorities.
Legitimate Interests: We may use your contact information to follow up on inquiries, manage our relationship with you, improve our services, or send you information about our services that we believe is of interest. We will only do so where our legitimate interests are not overridden by your rights and interests. You have the right to object to processing based on legitimate interests at any time.
Consent: If we rely on your consent (for example, for optional email marketing communications), we will expressly ask for it. You can withdraw your consent at any time, which will not affect the lawfulness of processing prior to withdrawal.

How We Use Personal Data: We use your personal information for the following purposes:

Providing and Managing Services: To schedule and carry out carpentry and construction projects, communicate with you about the work, handle orders for materials, and generally perform our contract with you.
Customer Service and Communication: To respond to your inquiries, provide quotes, address any requests or concerns, and keep you updated on project progress.
Business Administration: To manage billing and payments, maintain our accounts and records, and otherwise operate and protect our business (including record-keeping and audits).
Legal Compliance: To fulfil our legal obligations (e.g. verifying identities for fraud prevention, health & safety record-keeping, or providing information to regulators or law enforcement when legally required).
Marketing (Optional): With your permission or as otherwise permitted, we may send occasional marketing communications about new services, promotions, or industry updates. Any electronic marketing communications will include an easy way for you to opt out or unsubscribe. We will never sell your personal data to third parties for marketing.

Data Sharing and Disclosure: We treat your personal data with care and confidentiality. We do not sell your information. However, in certain circumstances we may share data with third parties, as necessary for the purposes described:

Subcontractors and Partners: We may share relevant personal information with trusted partners or subcontractors who assist in delivering our services (for example, electricians, plumbers, architects or other specialists working on a project). This is done on a need-to-know basis and under obligations of confidentiality. We ensure any partner handling personal data agrees to comply with data protection law and to use the information strictly for the purposes of the project.
Service Providers: We use third-party service providers for certain business functions (e.g. payment processing, IT support, cloud data storage, email newsletter platforms). These providers process data on our behalf and are bound by contracts (Data Processing Agreements) to safeguard your information and only use it under our instructions in compliance with GDPR.
Legal or Regulatory Disclosure: We may disclose personal data if required by law or by lawful request of authorities, or to enforce our contractual terms or protect our rights (for example, providing information to HM Revenue & Customs or the Information Commissioner’s Office if required).
Business Transfers: In the unlikely event that we undergo a significant business transaction (such as a merger, acquisition, or sale of assets), personal data may be transferred to the new owner as part of due diligence or completion of that transaction, under confidentiality and provided the recipient uses the data in line with this Privacy Policy.

Who We Share Your Data With

Your data may be shared with the following trusted partner companies, depending on your enquiry:

Rain Maker Network (operated by Ryan [Last Name])
Welsh Property Solutions Ltd (Company No: [INSERT])
Other recommended service providers, such as architects, surveyors, or specialist trades

Where you have asked to be referred or introduced, this may be actioned in one of the following ways:

Through a form you submit on this or a related website
Through written request (such as email or message)
During a conversation or verbal request

In some cases, Rain Maker Network may receive a referral or introduction fee for connecting you to a trusted provider.

Each listed company is an independent data controller and responsible for its own data handling.

We do not sell or pass your data to unrelated third parties. It is only shared where necessary to fulfil your enquiry.

When we share data with any third party, we only provide the minimum information necessary and ensure that appropriate safeguards are in place. For example, where a third party is a "processor" under GDPR, we will have a written agreement in place to protect your data. If any data sharing involves transferring your personal data outside of the UK (or European Economic Area), we will ensure a valid transfer mechanism is used (such as adequacy regulations or standard contractual clauses) to maintain protection of your information.

Data Retention: We keep personal data only for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. In general:

For clients, we retain personal and project information for the duration of the project and a period afterward (typically up to 6 years) to address any post-completion queries, meet our legal obligations (e.g. tax record retention), and handle any potential disputes.
Contact information used for marketing will be retained until you opt out or withdraw consent, or the information becomes outdated.
Website usage records (like logs) are kept for a short period for security and analysis, unless we need to retain them longer for legal reasons.

Once the applicable retention period expires or the data is no longer needed, we will securely delete or anonymise your personal data.

Your Rights: As an individual, you have several rights under the GDPR and Data Protection Act regarding your personal data that we hold:

Access: You can request a copy of the personal data we hold about you (commonly known as a "Subject Access Request").
Rectification: You have the right to have inaccurate personal data corrected or updated.
Erasure: You can ask us to delete your personal data in certain circumstances ("right to be forgotten"), for example if the data is no longer necessary or if you withdraw consent and no other legal basis exists.
Restriction: You can ask us to restrict the processing of your data in certain situations, e.g. while a complaint about data accuracy or processing is being resolved.
Objection: You have the right to object to certain processing of your data, such as processing based on legitimate interests or for direct marketing purposes. If you object to direct marketing, we will stop using your data for that purpose.
Data Portability: In situations where processing is based on your consent or necessary for a contract, and carried out by automated means, you can request the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where feasible.
Withdraw Consent: If we rely on your consent for any processing, you can withdraw that consent at any time. Once withdrawn, we will stop the specific processing that was based on consent.
Automated Decision-Making: We do not use personal data for purely automated decisions that have legal or similarly significant effects on you. In the event this changes, we will inform you and ensure your rights (including the right to human review of any automated decision) are protected.

To exercise any of these rights, please contact us using the contact details provided below. We will respond to your request within the statutory time frame (normally one month) and in accordance with applicable law. Please note some rights may be subject to legal exemptions; if we cannot fulfil a request, we will explain the reasons.

Data Security: We take the security of your personal data seriously. We have implemented appropriate technical and organisational measures to prevent unauthorised access, loss, alteration, or disclosure of your information. These include measures such as access controls, encryption and secure storage of electronic records, firewall and antivirus protection on our systems, and physical security measures for any paper records. We also ensure that any employees or contractors handling personal data are trained in data protection and are bound to confidentiality. Despite our efforts, no method of transmission over the internet or storage is completely secure; therefore, we cannot guarantee absolute security. However, we continually review and enhance our security measures to protect your information.

Cookies and Online Tracking: Our website uses cookies and similar technologies to provide and improve your browsing experience. Cookies are small text files placed on your device that allow the website to remember your preferences, login status, or track usage for analytics. For detailed information on what cookies we use and how you can manage your cookie preferences, please see our separate Cookies Policy. In summary, we use:

Necessary cookies for core functionality of the website (these do not require consent).
Analytics cookies (from third parties like Google Analytics) to collect anonymous statistics on website usage, which we only use if you have given consent via our cookie banner.

You can control cookies through your browser settings or our website's cookie consent tool. Refer to our Cookies Policy for more details and for instructions on opting out.

Third-Party Websites: Our website or communications may occasionally include links to websites operated by partners or other third-party organisations. Please note that this Privacy Policy applies only to personal data handled by the Company. If you follow links to any third-party websites, those sites will have their own privacy policies which we advise you to review. We have no control over, and are not responsible for, the content or data practices of external sites.

Updates to This Policy: We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When we make significant changes, we will notify you by posting a prominent notice on our website or by other appropriate means. The "last updated" date at the bottom of this policy indicates when the latest changes were made. We encourage you to review this Policy periodically to remain informed about how we protect your privacy.

Contact Us: If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: Via Form here

By Email: [privacy@4woods.co.uk]
By Form: [Contact Form].

We will be happy to assist and will do our best to address any issue promptly and transparently.

Complaints: If you believe your data has been handled improperly or your requests have not been addressed, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO), which is the supervisory authority for data protection issues. You can contact the ICO via their website or telephone helpline. However, we welcome the opportunity to resolve your concerns directly, so please consider reaching out to us first.