AC Timber Solutions Ltd takes the privacy and security of your information seriously. This notice explains what we collect when you contact us, request a quote or place an order, and what we do with it. It applies to this website and to dealing with us by phone, email and in person.
Who is responsible for your information
AC Timber Solutions Ltd, 54 Lancaster Way Business Park, Witchford, Ely, Cambridgeshire CB6 3NW, is the data controller. We are registered in England and Wales, company number 06830247, VAT number 970085026.
Questions about your information, or any of the requests set out below, should go to Sean Marriott on 01353 666843 or info@actimber.co.uk. We are not required to appoint a Data Protection Officer and have not appointed one.
What we collect
Most of what we hold is information you have given us so that we can quote for or supply timber.
- Your name, company name, email address, phone number and delivery or collection address.
- The content of your enquiry — species, sizes, cutting lists, drawings or photographs you send us.
- Your postcode, so we can confirm whether a delivery is inside our free delivery area.
- Records of quotes, orders, deliveries and correspondence.
If you apply for a trade or credit account
An account application asks for more than an enquiry does, because we have to know who we are trading with and, where credit is involved, whether to extend it. On top of the above we collect:
- Your business details — registered, trading and delivery addresses, company registration number and VAT number.
- Named trade and accounts contacts, so we know who to send orders and invoices to.
- For sole traders and partnerships, a home address and proof of it. A sole trader is personally liable for the account, which is why we ask.
- Two trade references, and the credit limit you have asked for.
- A record of your acceptance of our terms: the name and position you signed in, the date and time, the version of the terms you agreed to, and the internet address the acceptance came from. That record is what makes the agreement stand up later.
Where you apply for a credit account we check your financial standing with Experian. If that check is satisfactory we take it no further. If it comes back marginal or adverse, we then follow up the two trade references you gave us.
For a limited company that check looks at the company’s own credit file and does not touch anyone’s personal credit record. For a sole trader or partnership the business and the person are the same in law, so the check may involve your personal credit file.
Where you give us a trade reference you are giving us someone else’s contact details. If we need to take the reference up we will contact that person, which tells them you have applied to open an account with us. Please make sure they are expecting to hear from us.
We do not store card details. Card payments are handled by our payment provider and the card number never reaches our systems.
Our hosting provider keeps standard server logs, which include IP addresses, for security and troubleshooting. We do not currently run any analytics, advertising or tracking on this website. If that changes we will update this notice and ask for your consent first where the law requires it.
Why we are allowed to hold it
- To perform a contract
- Quoting, machining, supplying and delivering timber, and dealing with anything that goes wrong afterwards.
- Our legitimate interests
- Responding to business enquiries, keeping records of what we have supplied to whom, credit checking trade account applicants, and protecting the business against fraud and non-payment.
- Your consent
- Marketing by email or SMS where you have asked for it. You can withdraw consent at any time and we will stop.
- Legal obligation
- Tax, accounting, timber due diligence under the UK Timber Regulation, and anti-money-laundering requirements.
Who else handles your information
We use a small number of suppliers to run the business. They act on our instructions, only for the purposes we set, and may not use your information for their own.
- Supabase — our database
- Our records are held in Supabase’s London region (eu-west-2), in the United Kingdom.
- Vercel — website hosting
- Runs this website. Requests and form submissions are processed in Vercel’s London region, in the United Kingdom.
- Smarthub — our customer relationship system
- Holds contact records, enquiries, quotes and delivery jobs. Provided by LeadConnector LLC and hosted in the United States.
- Resend — email
- Sends quote confirmations and enquiry notifications. Message content and delivery logs are held in the United States.
- Google Maps Platform
- We check delivery addresses and plan delivery routes using Google Maps, which means a delivery address is sent to Google to be located on a map.
- TYL by NatWest — card payments
- Will process card payments when online payment goes live. Card details go to them directly and are never held by us.
- Experian — credit checking
- Checks the financial standing of credit account applicants. We send them enough to identify the business, or the person where that business is a sole trader.
- Trade referees
- Contacted only where the Experian check comes back marginal or adverse, which tells them you have applied.
- Professional and delivery services
- Our accountants, and delivery contractors where a delivery is not on our own vehicles.
We will also share information where we are legally required to, and if the business or its assets were ever sold, customer records would transfer with it.
We do not sell your information to anyone.
Sending information outside the UK
Our database and this website are both hosted in the United Kingdom, so the records we hold about you stay here. Three of the suppliers above are based in the United States, and information reaches them in the course of doing their job: our customer relationship system, our email provider and Google Maps.
Where that happens we rely on the safeguards UK data protection law provides — either the UK Extension to the EU–U.S. Data Privacy Framework, which the UK government has approved as giving equivalent protection, or the international data transfer clauses approved by the Information Commissioner’s Office. We check that a supplier has one of these in place before we use them.
The previous version of this policy said we never sent information outside the EU. That was no longer accurate, so it has been corrected rather than repeated.
Cookies and local storage
This website sets no cookies of its own, and there are no advertising or analytics cookies. That is why you are not being asked to accept any.
The one thing we do store on your device is your quote list, kept in your browser’s local storage so that a list you start today is still there tomorrow. It never leaves your browser until you choose to send it to us, and clearing your browser data removes it. Because it exists only to provide something you asked for, it does not require consent.
Your browser also contacts a small number of third parties to load this site — a font service and an icon library — which means those services can see your IP address. We are moving these onto our own hosting to remove that.
How long we keep it
We keep enquiry, quote, order and delivery records for six years, which is the period tax and accounting law requires us to keep records of what we have supplied. Marketing consents are kept until you withdraw them, and we delete anything we no longer have a reason to hold.
Account applications are kept for as long as the account is open and for six years after it closes, for the same reason. An application we turned down is deleted six months after the decision — long enough to answer any question about it, and no longer. An application somebody started and never finished is deleted after ninety days. Both happen automatically.
Keeping it safe
Information is held on access-controlled systems, and only staff who need it to do their job can see it. No system is perfectly secure, but we take reasonable steps to protect what we hold and to detect and deal with problems.
Your rights
Under UK data protection law you have the right to:
- be told what we hold about you, and to get a copy of it;
- have anything inaccurate corrected;
- have information erased, or ask us to stop using it, in some circumstances;
- object to us using it for our legitimate interests or for marketing;
- ask us to pass what you have given us to another provider;
- withdraw any consent you have given; and
- not be subject to a decision made purely by automatic means.
To exercise any of these, contact Sean Marriott using the details above. We will respond within one month. If you are unhappy with how we have handled it you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather have the chance to put it right first.
Changes to this notice
If we change how we use your information we will update this page and change the date at the top. If a change is significant we will tell customers directly.