GDPR Privacy Notice
At iWood Timber, while our industry is a traditional one, we use modern methods to store and process your data in order to carry out our services to you, such as quoting, processing and delivering your orders.
We value your business and are deeply committed to looking after your personal and business data. In this privacy notice, we describe where and what types of information we collect, how we keep it safe, how you can request to see the information we hold about you, how you can update this data and how you can make a request to delete this data.
Your personal data includes information such as your name, your email address and postal address. You can use the iWood website to get prices without giving us any of these details. We will only ask for these details when you sign up for an ‘iWood Account’, which gives you discounted pricing when you log in.
In a nutshell, iWood only collects personally identifiable information that you provide to us, give your consent for us to use, and that is only used for the purposes that you provide it to us for. For example, if you give us your email address to send you a quote, we’ll only use it to send you that quote, we won’t then use your email address to send you offers.
All information we hold is kept securely, be it electronically or physically.
In a Nutshell
There are three reasons iWood collects and processes data:
- When you ask for a written quotation: We will ask for your name and email address so we can send you the quotation, your telephone number in case we have any further questions or your email address bounces back and your postcode so we can work out delivery costs.
- When you place an order: in addition to the information above, we also ask for your billing and delivery addresses in order to know where to deliver to. If you place the order online, you will enter your card details directly into our secure online payment partner, SagePay, who meet the highest levels of PCI DSS security and are regularly audited. If you choose to pay over the phone, your details will be entered into our card machine and the resulting reciepts will be kept in a locked environment.
- Newsletters and Offers: When you sign up for an iWood website account, you are asked if you want to be sent any iWood news or offer emails. If you choose to receive any of these, you will receive an email with a link to click to make sure we have your consent. This is called “opting in”.
We cover this in more detail below.
Types of Data We Might Collect and How we Collect It
A cookie is simply a small piece of information that your computer saves when it visits a website.
- To tie your computer to the items you’ve worked out prices for and those you’ve placed into your shopping basket. This is how we know to show everyone only their own items they've priced or added to their shopping basket.
- To remember that you are logged into the iWood website. This saves you having to log into every single page on the website (as you can imagine, this would be a nightmare for you).
PLEASE NOTE: A cookie in no way gives us access to your computer or any personal information about you, other than the data you choose to share with us.
Overall, without cookies many websites, including iWood.co.uk simply wouldn't work properly. They are essential to the modern Internet.
Our website collects anonymised (ie not personally identifiable) usage information to give us insights such as how many visitors our website receives, how long users spend on a page and how they got there.
We only use this information for statistical analysis purposes and there is no tie back to any personally identifiable details.
You can sign up for an iWood Website Account here:https://www.iwood.co.uk/newaccount/ in order to get discounted prices on the website.
When you sign up for an ‘iWood Website Account’ we ask for personal information such as your name, telephone number, email address and postal address.
This information is stored securely in a computer database featuring security such as encryption, a firewall, antivirus software and strict access control.
When you sign up for an iWood account, you are asked whether you would like to receive specific types of timber offer from us. These options are not selected by default. Should you select any, you are sent a separate email asking for you to confirm that you wish to receive the selected types of offer from us. This is called ‘opting in’ and ensures that we explicitly have your consent to send you offers by email.
The iWood website also has a contact form. Any information submitted to this is sent to iWood in the form of an email. Any personally identifiable information you submit in here will only be used to fulfil your request, ie to give you a quote or give you a call.
The iWood website also uses an “online chat” system which you may choose to submit your name, email address or telephone number for us to contact you with price information. Logs of these chats are stored for up to three months before they’re deleted.
iWood will only use your information for the reason we tell you we’re going to use it. For example, if you give us your name and email address for the express purpose of sending you a quote, we will only use it to send you that quote, we will not then start sending you offers to that email address.
If the email address was written down physically on a notepad at iWood or by one of its external salespeople, it will be destroyed once its purpose has been fulfilled.
Your name and email address will stay in the iWood representative’s email ‘sent items’ for future reference unless you contact us with a data removal request (see below). Similarly, your name and email address may be present.
When you place an order on our website and pay securely online, the page where you input your card details, while it looks like it’s within our website, is actually a direct link to our payment processor, Sagepay. (Technically, it uses an i-Frame, with the card input fields served directly from Sagepay over a secure connection.)
Your name, contact details, billing and delivery address (if different) are recorded by Sagepay and are used to carry out fraud checks, such as that the payment card being used is registered to the billing address.
Sage Pay is PCI DSS (Payment Card Industry Data Security Standard) compliant to the highest level and maintains regular security audits. They are also regularly audited by the banks and banking authorities to ensure that their systems are impenetrable.
iWood does not store payment card information in any form or at any time when you place your order online.
When you pay by card over the telephone or in person, the ‘card machine’ prints two receipts, your customer copy and our merchant copy. The merchant copy is kept in a locked area for up to three months before being destroyed.
Your customer copy is either given to you if you pay in person, or attached to your invoice if you pay over the telephone. In this case, your customer receipt is also kept securely until you receive it. Your customer copy does not have your name or other personal details on, and only the last four digits of your payment card number.
When you place an order with iWood on our website, the personal details associated with your order, such as name, email address, telephone number, billing and delivery addresses will be used by us during processing and delivery.
Processing your order sees your data entered into our Sage Accounting software and a couple of secure, in-house order and delivery management systems. At all times, your information is only used for the purpose of processing your order.
When iWood delivers your order, your name, address and contact details are printed onto two delivery notes. You keep one on delivery, and the other is returned to us for confirmation of delivery with your signature, then destroyed within three months.
Aside from delivery companies that require your information to deliver your order and Sagepay if you pay online as described above, iWood does not share or sell your personal information to any other third parties.
Access Your Personal Information
The General Data Protection Regulations allow individuals to perform a Subject Access Request. Should you need to do this, we’ve prepared an official request form that you can find here:
iWood has 30 days to respond to a legitimate Subject Access Request.
Updating Your Personal Information
Should you wish to update any of the information we hold on you, such as if you move house and need to update your billing or delivery address, or change your telephone number, send an email to firstname.lastname@example.org detailing who you are, how we can identify you in the data we hold and which data you would like updating.
Deleting Your Personal Information and the Right to be Forgotten
The General Data Protection Regulations give individuals the right to make a request to have their personal data erased from our systems. Under the GDPR rules, we have 30 days to provide the data to a legitimate erasure request.
Please note we can’t comply if the data is still necessary for the purpose in which you gave consent, such as to process an outstanding order.
We have created a “Right to be Forgotten” form to initiate such a request here:
Changes To This Privacy Notice