Last updated: June 2026
This Privacy Policy explains how S&J Wackett Timber Merchants Limited ("we", "us", "our") collects, uses, and protects personal information when you visit our website, contact us, place an order, or otherwise interact with us. We are committed to handling your data responsibly and in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
For the purposes of UK data protection law, we are the data controller of the personal information we hold about you.
S&J Wackett Timber Merchants Limited
5 Shelbourne Road, London, N17 0JX
Company registered in England and Wales, No. 01876965
VAT Registration No. GB 415 081 580
Telephone: 020 8801 9090
Email: info@sjwackett.co.uk
2. What personal information we collect
Depending on how you interact with us, we may collect and process the following categories of personal information:
- Contact details — your name, billing and delivery address, phone number and email address.
- Order information — items you’ve viewed, added to basket or purchased, order history, delivery preferences and any special instructions.
- Payment information — processed by our payment provider (Shopify Payments / Stripe). We do not store full card details on our systems.
- Account credentials — if you create a customer account, your login email and a securely hashed password.
- Communications — any messages or enquiries you send us by phone, email or through our website contact form.
- Technical information — IP address, browser type, device type, and pages visited, collected via cookies and similar technologies.
- Trade account information — if you hold a trade account with us, your company name, VAT number, contact persons and credit terms.
3. How we use your information and our lawful basis
We use your personal information for the following purposes, relying on the lawful bases set out below:
- To fulfil your order (processing the order, taking payment, arranging delivery, sending confirmations and invoices) — lawful basis: performance of a contract.
- To provide customer support (responding to enquiries, handling returns and complaints) — lawful basis: performance of a contract / legitimate interests.
- To manage your account and remember your preferences — lawful basis: performance of a contract.
- To send service messages about your order or account — lawful basis: performance of a contract.
- To send marketing emails about offers and new products (only if you’ve opted in) — lawful basis: consent. You can unsubscribe at any time using the link in any marketing email.
- To comply with legal and tax obligations (e.g. retaining invoice records for HMRC) — lawful basis: legal obligation.
- To prevent fraud and protect our business (security monitoring, account verification) — lawful basis: legitimate interests.
- To improve our website and service using analytics — lawful basis: legitimate interests / consent for non-essential cookies.
4. Who we share your information with
We do not sell your personal information. We share it only with the following categories of recipient, and only as needed:
- Shopify Inc. — our e-commerce platform provider, which hosts our website, processes payments via Shopify Payments, and handles order data on our behalf.
- Payment processors (Stripe and the card networks) — to take payment for your order.
- Delivery partners and couriers — we share delivery name, address and phone number with our delivery drivers or third-party couriers when arranging shipment of larger orders.
- Our accountant and HMRC — for invoicing, VAT and statutory record-keeping.
- Professional advisers (legal, IT support) — only where strictly necessary for the running of our business.
- Law enforcement or regulators — where we are required by law to disclose information.
5. International transfers
Some of our service providers (notably Shopify) are based outside the UK, including in the United States and Canada. Where personal data is transferred outside the UK, we ensure adequate safeguards are in place — either an adequacy decision recognised by the UK Government, or the use of the International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.
6. How long we keep your information
We keep your personal information only for as long as we need it:
- Order and invoice records — retained for 7 years to meet HMRC tax record requirements.
- Account information — retained while your account is active. If you close your account, we anonymise or delete your data within 12 months unless we are required to keep it longer for legal reasons.
- Marketing preferences — retained until you unsubscribe.
- Communications and enquiries — retained for up to 3 years.
7. Your rights under UK GDPR
You have the following rights in respect of your personal information:
- Right of access — ask for a copy of the data we hold about you.
- Right to rectification — ask us to correct any inaccurate or incomplete information.
- Right to erasure ("right to be forgotten") — ask us to delete your data where there is no good reason for us to keep it.
- Right to restrict processing — ask us to pause processing while we resolve a dispute about accuracy or lawful basis.
- Right to data portability — ask us to transfer your data to another organisation in a machine-readable format.
- Right to object — object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
- Right to withdraw consent — where we rely on your consent (e.g. marketing), you can withdraw it at any time.
To exercise any of these rights, contact us at info@sjwackett.co.uk or by post at the address above. We will respond within one month. There is no charge for making a request, although we may charge a reasonable fee or refuse if a request is clearly unfounded or excessive.
8. How to complain
If you’re unhappy with how we’ve handled your personal information, please contact us first so we have an opportunity to put things right. If you remain dissatisfied, you have the right to complain to the UK Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk
9. Cookies
Our website uses cookies and similar technologies. These include strictly necessary cookies that make the site work (for example, remembering items in your basket), analytics cookies to understand how visitors use the site, and marketing cookies if you’ve consented to them. You can manage your cookie preferences via your browser settings or via the cookie banner displayed when you first visit the site.
10. Security
We use appropriate technical and organisational measures to protect your personal information from loss, misuse and unauthorised access. Our website is served over HTTPS, payments are PCI-DSS compliant via Shopify Payments / Stripe, and access to customer data within our business is restricted to staff who need it for their role. No system can guarantee absolute security, so please notify us immediately if you become aware of any unauthorised access to your account.
11. Children
Our website and services are not directed at children under 16. We do not knowingly collect personal information from children. If you become aware that a child has provided us with personal information, please contact us so we can delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons. We will update the "Last updated" date at the top of this page and, for material changes, we will notify you directly where appropriate.
13. Contact
If you have any questions about this Privacy Policy or how we handle your personal information, please contact:
S&J Wackett Timber Merchants Limited
5 Shelbourne Road, London, N17 0JX
Telephone: 020 8801 9090
Email: info@sjwackett.co.uk