1. Who we are

Grizzly’s Craft (“we”, “our”, “us”) is the trading name of Grizzly's Craft Limited, registered in England & Wales under company number 16192031. Registered office: 5 Barn Owl Way, Didcot, United Kingdom, OX11 6EG. Email: [email protected] and Telephone: 07809 727674. We act as a retail agent for independent wood-carvers and sell their reclaimed-timber products online and at UK country shows.

2. Personal data we collect

Identity data – name, billing/delivery addresses, email, telephone.

Transaction data – products purchased, payment method, order notes.

Technical data – IP address, browser type, device, referral source.

Usage data – pages visited, time on site, clicks (via cookies/analytics).

Marketing data – email preferences, competition entries, survey responses.

3. How we use your data & lawful bases

Purpose and Lawful basis as per (UK GDPR Art. 6)

Process and deliver orders: Contract (b)

Email order updates & service notices: Contract (b)

Fraud screening & charge-back prevention: Legitimate interests (f)

Marketing email newsletters: Consent (a)

Remarketing adverts (cookies): Consent (a)

After-sales reviews & surveys: Legitimate interests (f)

Where we rely on legitimate interests we balance our interests against your rights and will always honour opt-out requests.

4. Marketing

We send marketing emails only if you have opted-in (e.g. newsletter sign-up or checked box at checkout). You may unsubscribe at any time via the link in every email or by contacting us.

5. Sharing your data

We never sell personal data. We share it only with:

Payment processors: Stripe and PayPal – secure card handling.

Delivery couriers: DPD, Royal Mail – shipping labels & tracking updates.

IT & cloud service providers: website hosting, email, analytics.

Law-enforcement or regulators where required by law.

All suppliers are bound by contracts that protect your data and comply with UK GDPR.

6. International transfers

Some providers (e.g. US-based cloud hosts) store data outside the UK. Where this occurs we use approved safeguards such as UK Addendum SCCs.

7. Retention

Order records: 7 years (accounting requirements).
Marketing data: until you withdraw consent or after 24 months inactivity.
Cookies: see Cookie Policy for specific lifespans.

8. Your rights

You can: access; correct; erase; restrict; object; port data; withdraw consent.

To exercise any right, email [email protected].

If unsatisfied, complain to the ICO (ico.org.uk) but please contact us first.

9. Security

We use SSL encryption, access controls, and regular penetration testing to protect data.

10. Changes

We may update this notice; significant changes will be notified via email or site banner.