Privacy Policy - Timbershedco

Last updated: 30 August 2026

This policy explains what personal data Timbershedco collects when you visit or order from timbershedco.com, why we collect it, how long we keep it and what rights you have. It is written to meet the UK GDPR and the Data Protection Act 2018.

1. Who is the data controller

The controller of your personal data is ETRAPSHORTS LLC, trading as Timbershedco, 1305 Mcdonald Dr Reno, NV 89503, United States, with a United Kingdom trading and correspondence address at 3 Stanway Street, Manchester, M9 4JQ, United Kingdom. For any data protection question, write to contact@timbershedco.com or call +447446395342.

2. What data we collect

Order data: your name, delivery address, billing address, e-mail address, telephone number, the items ordered and the order total.
Payment data: we do not see or store your full card number. Card details are entered directly into a form hosted by our payment processor, Stripe. We receive only the payment status, the card brand, the last four digits and an authorisation reference.
Account data: if you create an account, your e-mail address, a hashed password and your saved addresses and order history.
Correspondence: the content of e-mails and messages you send us, kept so we can follow up on an enquiry or a return.
Technical data: IP address, browser type and version, device type, pages viewed and referring page, collected through cookies and server logs.

We do not knowingly collect data from children under 16 and we do not sell personal data to anyone.

3. Why we use it and on what legal basis

To fulfil your order – process payment, dispatch goods, provide tracking and handle returns. Legal basis: performance of a contract (Article 6(1)(b) UK GDPR).
To meet legal obligations – keep tax and accounting records, and comply with consumer law. Legal basis: legal obligation (Article 6(1)(c)).
To keep the shop working and secure – fraud prevention, error logging, essential cookies. Legal basis: legitimate interests (Article 6(1)(f)).
Analytics and marketing cookies – only where you have given consent through our cookie banner. Legal basis: consent (Article 6(1)(a)). You may withdraw it at any time.

4. Who we share it with

We share only what is necessary, and only with processors bound by a data processing agreement:

Stripe – payment processing and fraud checks.
DPD and Parcelforce – your name, delivery address, phone number and e-mail address, so they can deliver your order and send you delivery notifications.
Our hosting provider – stores the website and its database.
Our e-mail provider – sends order confirmations, dispatch notices and replies to your enquiries.

We may also disclose data where the law requires it, for example to a tax authority or in response to a valid court order. We never sell, rent or trade your personal data.

5. International transfers

ETRAPSHORTS LLC is registered in the United States, and some of our processors operate outside the United Kingdom. Where personal data is transferred outside the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the additional safeguards our processors publish. You can ask us for details of the safeguards used for any specific transfer.

6. Cookies and consent

We use a consent management platform to ask for your permission before any non-essential cookie is set. Essential cookies (session, cart, security, consent record) run without consent because the shop cannot function without them. Statistics and marketing cookies only run if you accept them. You can change or withdraw your choice at any time through the cookie settings link in our footer. The categories, names and lifetimes are listed in full in our cookie policy.

7. How long we keep it

Order and invoice records: 6 years from the end of the relevant accounting period, as required for tax and accounting purposes by HM Revenue and Customs.
Account data: until you ask us to delete the account.
Correspondence: 24 months after the enquiry is closed.
Consent records: 12 months, then you are asked again.
Server logs: 30 days.

8. Your rights under UK GDPR

You have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights in relation to automated decision making. You may also withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, e-mail contact@timbershedco.com. We respond within one month, free of charge. We may ask you to confirm your identity before we act on a request.

If you are not satisfied with how we have handled your data, you have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom, or online at ico.org.uk. We would appreciate the chance to put things right first.

9. Automated decision making

We do not carry out automated decision making or profiling that produces legal effects for you. Stripe runs automated fraud scoring on card payments; if a payment is declined by that check you can contact us and we will look at the order manually.

10. Security

The whole site runs over HTTPS with a valid TLS certificate. Passwords are stored hashed and salted, administrative access requires a unique account, and card data never reaches our servers. No system is perfect, but we notify the ICO and, where the risk to you is high, you directly, within 72 hours of becoming aware of a personal data breach.

11. Changes to this policy

If we change this policy we update the date at the top of the page. Material changes affecting how we use your data will be announced on this page before they take effect.