iWood's Privacy Policy

Current Consent Settings

Last updated: 22/09/2026. This notice replaces the version dated 15 February 2022.

iWood Timber Ltd ("iWood", "we", "us") is the data controller for the personal data described in this notice. Our industry is a traditional one, but we use modern tools to quote, take orders, deliver timber and advertise our products. This page explains, in plain English, what information we collect, why, who we share it with, how long we keep it, and the choices and rights you have.

In a nutshell

• You can price up timber on our website without giving us any personal details at all.
• We only ask for personal details when you need something from us: a written quote, an order, an iWood account, a chat, or a copy of our free buying guide.
• We never sell your data, and we do not upload your email address or customer list to advertising platforms to target you.
• We use Google and Meta (Facebook) tools to measure our advertising and to show our adverts to people who have visited our site. These only run if you allow them using the cookie banner or the settings at the top of this page, and you can change your mind at any time.
• If you give us your email address to send you a quote, we use it to send you that quote. We do not add you to a marketing list unless you explicitly opt in.

Who we are

iWood Timber Ltd, registered in England and Wales, company number 7060853.
Registered office: New Barn, Knightley Park Farm, Lodge Lane, Woodseaves, Staffordshire, ST20 0NZ.
Email: enquiries@iwood.co.uk  |  Telephone: 01889 597 281.

We do not have a statutory Data Protection Officer. Please direct any privacy question to the email address above with "Privacy" in the subject line.

The information we collect and why

Working out prices

You can use every price calculator on the site anonymously. To remember which items you have priced and what is in your shopping basket, we store a random guest number in a cookie on your device (see Cookies). This number is not linked to your name unless you later place an order or open an account.

Written quotes and enquiries

When you ask for a written quotation through the website, the contact form, our online chat, or the Timber Companion App, we ask for your name and email address so we can send it, your telephone number in case we have questions or the email bounces, and your postcode so we can work out delivery. We use these details to answer your enquiry and for nothing else.
Lawful basis: taking steps at your request before entering a contract.

Placing an order

In addition to the above we need your billing address and, if different, your delivery address, so that we can invoice you and know where to deliver. Your order details are entered into our Sage accounting software and our in-house order and delivery management systems.
Lawful basis: performing our contract with you, and our legal duty to keep accounting records.

Paying online

When you pay by card on the website, the card entry form is served directly by our payment processor, Opayo (part of Elavon), inside our page. Your card details go straight to Opayo and never touch our servers. We pass Opayo your name, contact details and billing and delivery addresses so that it can process the payment and run fraud checks, such as confirming the card is registered to the billing address. Opayo is certified to PCI DSS Level 1. iWood does not store payment card numbers in any form.

Paying by card over the phone or in person

Your card details are entered into our card terminal and are not written down. The terminal prints a merchant copy receipt, which shows only the last four digits of your card, and we keep it in a locked area for up to three months before destroying it. Your customer copy is handed to you or attached to your invoice.

Delivery

Your name, delivery address and telephone number are printed on two delivery notes and, where a haulier or courier is used, passed to that company so that they can deliver and contact you about timing. You keep one delivery note; the signed copy comes back to us as proof of delivery and is destroyed within three months.

iWood website account

You can open an account at www.iwood.co.uk/newaccount/ to get discounted prices when logged in. We ask for your name, business name if any, telephone number, email address and postal address, and you confirm by ticking a box that you have read this notice. The account is protected by a password, which is stored in hashed form, and the form is protected by Google reCAPTCHA (see below).
Lawful basis: performing our contract with you.

Offer and news emails

When you open an account, or download our free guide, you can choose to receive iWood offers and news by email. The boxes are not ticked by default, and choosing them is optional. If you tick any, we send you a separate email with a link to confirm, so we know the request really came from you (double opt-in). Every offer email has an unsubscribe link, and you can also email us to be removed at any time.
Lawful basis: your consent.

Free buying guide

To send you our free guide, 7 Essential Must-Knows Before You Buy Wood, we ask for your name and email address. We use them to deliver the guide and, only if you also tick the offers box, to send you offers as described above.

Online chat

Our live chat is provided by tawk.to. If you start a chat, whatever you type, together with the pages you were viewing and your anonymous guest number, is sent to tawk.to and shown to our staff. You choose what to share; we usually ask for a name, email or telephone number only if you want a quote or a call back. Chat transcripts are kept for up to three months and then deleted. Details of tawk.to's own handling are at tawk.to/privacy-policy.
Lawful basis: our legitimate interest in answering your questions.

Email correspondence

Emails you exchange with iWood staff stay in the relevant mailbox so that we can refer back to your quote or order. If you write your details on paper, for example when phoning an order through, the paper is destroyed once its purpose is served. You can ask us to delete correspondence at any time (see Your rights).

Website analytics and advertising

This is the part of the notice that has changed the most since 2022, so it is worth reading if you care about tracking.

We advertise iWood on Google and on Meta platforms (Facebook and Instagram). To know whether that advertising works, and to show our adverts to people who have already shown an interest in our timber, we use the tools below. None of the advertising tools run unless you allow them. When you first visit we ask you through the cookie banner. Until you answer, and if you decline, they are switched off. You can switch each one on or off at any time using the four settings at the top of this page.

Google Analytics 4

Google Analytics tells us how many people visit, which pages they read, how they found us, and where in the ordering process people give up. It also records the products, values and order numbers of completed orders so that we can see which products sell. It uses cookies to recognise a returning browser. It does not receive your name, email address or postal address. Google may use this data to improve its own services; see how Google uses information from sites that use its services.
Controlled by: the Analytics storage setting.

Google Ads conversion tracking and remarketing

Google Ads tags on our pages record when a visitor who clicked one of our adverts goes on to price a product, send us a message or place an order, including the order value and order number, so that we can measure what our advertising costs against what it brings in. The same tags let Google add your browser to audiences such as "visited iWood" or "priced oak beams", so that we can show you a relevant iWood advert on Google and its partner sites over the following weeks. These audiences are based only on what you did on our website. We do not upload customer lists, email addresses or telephone numbers to Google to target adverts.
Controlled by: the Advertising storage, Advertising audience and Remarketing settings.

Enhanced conversions

Browsers increasingly block advertising cookies, which makes the measurement above less accurate. To fill the gap, when you complete an order and have allowed advertising, your email address is converted into an irreversible code (a SHA-256 hash) in your browser and sent to Google, which matches it against signed-in Google accounts to confirm that the order came from someone who saw our advert. Google cannot read the email address from the hash, does not share the match with us, and uses it only for this measurement.
Controlled by: the Advertising audience setting.

Meta (Facebook) Pixel and Conversions API

If you have allowed advertising, the Meta Pixel records that your browser visited our site, and when you complete an order our server tells Meta the order value together with a hashed (irreversible) version of your email address, your IP address and your browser type. Meta uses this to report which of our Facebook and Instagram adverts led to orders, and to let us show iWood adverts to people who have visited our site or who resemble our customers. Meta cannot read your email address from the hash. Meta may also use the data for its own purposes as described in its privacy policy. We do not upload customer lists to Meta.
Controlled by: the Advertising storage and Advertising audience settings. If either is off, the Pixel does not load and the server does not send the order to Meta.

Google reCAPTCHA

Our contact, enquiry and account registration forms use Google reCAPTCHA Enterprise to tell people from spam robots. reCAPTCHA looks at signals such as your IP address, browser and how you interact with the form and sends them to Google for scoring. It is essential to keeping the forms working and is not used for advertising. Google's privacy policy and terms apply.
Lawful basis: our legitimate interest in preventing spam and abuse.

If you decline

If you decline advertising and analytics, no Google or Meta cookies are set and you are not added to any audience. Google may still receive limited, cookieless signals that a page was viewed or an order was placed, which it uses only to estimate totals and cannot link to you. Everything else on the site, including pricing, basket, ordering and your account, works exactly the same.

Cookies and similar storage

A cookie is a small text file your browser stores for a website. We also use your browser's "local storage" for one setting. A cookie cannot read anything else on your device.

Essential (always on)

Analytics (only with your consent)

Advertising (only with your consent)

Third-party cookie names and lifetimes are set by those companies and change from time to time; the tables show what we know at the date of this notice. You can also block or delete cookies in your browser settings, though the site will not remember your basket if you block ours.

Who we share your data with

We do not sell personal data. We share it only with the companies that help us run iWood, and only as much as each one needs:

• Opayo (Elavon): online card payments and fraud checks.
• Delivery companies: name, address and telephone number for deliveries we do not make with our own vehicles.
• Sage: our accounting software, which holds invoice details.
• Google: Analytics, Ads and reCAPTCHA as described above.
• Meta Platforms: Pixel and Conversions API as described above.
• tawk.to: online chat.
• Our email and web hosting providers, which store our mail and this website. Microsoft 365 / Our web hosting provider, which runs the server this website and its database live on, in a UK data centre.
• Professional advisers, insurers, HMRC, the courts or the police where the law requires it or to defend a legal claim.

Transfers outside the UK

Google, Meta and tawk.to process data in the United States and other countries. Where personal data leaves the UK, it is protected by the UK Extension to the EU-US Data Privacy Framework or by the UK International Data Transfer Addendum to the standard contractual clauses, as applicable to each provider. Everything else we hold stays in the UK.

How long we keep your data

How we keep it safe

Our databases sit behind a firewall with encrypted connections, access limited to the staff who need it, and up-to-date antivirus. Passwords are stored hashed, never in plain text. Paper records are kept in locked storage and shredded when their retention period ends. No card numbers are stored by iWood.

Your rights

Under the UK GDPR and the Data Protection Act 2018 you have the right to:

• Access the personal data we hold about you (a subject access request).
• Correct anything that is wrong or out of date, for example a new address or phone number.
• Erase your data ("the right to be forgotten"), where we no longer need it. We cannot erase records we must keep by law, such as invoices, or data we still need to complete an outstanding order.
• Restrict or object to processing based on legitimate interests.
• Withdraw consent at any time for marketing emails (unsubscribe link or email us) and for analytics and advertising (settings at the top of this page).
• Portability: receive the data you gave us in a machine-readable format.

To exercise any of these, use our request form at www.iwood.co.uk/gdpr or email enquiries@iwood.co.uk, telling us who you are and how we can find you in our records. We may ask for proof of identity. We will respond within one month.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this notice

We will update this page whenever our tools or practices change and show the date at the top. Significant changes, such as a new advertising partner, will also be flagged on the cookie banner for returning visitors.