Privacy.

Who we are

WDT Werks, Cynghordy, Llandovery SA20 0LP, United Kingdom. We decide how the information described here is used, which makes us its controller under UK data protection law. For anything on this page, email haith@wdtwerks.co.uk.

What we collect, and why

When you order

Your name, email address, phone number, delivery and billing address, what you bought and any choices you made, such as a size. We need these to take your payment, make up and send your order, and tell you when it has gone. The legal basis is our contract with you.

Your card details go straight to our payment provider, Stripe, in a secure form on our checkout page. They never reach us and we never see them.

Your orders page

Signing in to see your orders needs only your email address: we send a one-time link that lasts fifteen minutes. There is no password and no separate account; your orders are looked up from our payment records.

Reviews

Seven days after your order is sent, we email you once to ask for a review. That is a service message about something you bought; if you would rather not get it, tell us and we will not send one. If you leave a review, we publish your rating, what you wrote, any photograph you add, and your name as a first name and an initial. Your email address and order reference are kept with it privately, never published. You choose to leave a review, so the basis is your consent, and you can ask us to take it down at any time.

A review earns a discount code for your next order. The fact that a code was given is recorded against your order so it is only given once.

Google Customer Reviews

After you order, you may be offered Google's customer survey. It is optional. If you opt in, we share your email address, an order identifier, your delivery country and the estimated delivery date with Google, and Google sends you a survey after that date. Google handles the survey under its own privacy policy. The basis is your consent.

The newsletter

If you sign up, we keep your email address to tell you about new formulations and the occasional offer. You can sign up with the form at the foot of any page. We record when and where you agreed and the words you agreed to, so we can show we had your consent. The basis is your consent.

If you buy from us, we may also send you the newsletter, about products like the ones you bought, using the email address from your order. The box at checkout is ticked for this: untick it if you would rather not. You can also say no at any time.

Once you are on the list, we may also send a few emails prompted by an order: a reminder that the shop can go on your phone's home screen, suggestions of products that go with what you bought, or a thank-you discount. Only people on the list get these.

Every newsletter has an unsubscribe link at the foot, which works in one click and takes effect straight away. You can also reply to any newsletter or email us, and we will take you off.

The support assistant

If you use Ask support, what you type is sent to an AI model to write the answer. It reaches the model through Vercel's AI Gateway, and the model is currently one of OpenAI's. If you ask about an order, the assistant needs your order reference and the email address it was placed with to look it up. We do not keep the conversation: it stays in your browser until you close the tab. Please do not type card details, or anything the question does not need.

Trade, press and partners

If you send a trade or press enquiry, we keep what you sent (your name, company or publication, email address, phone number if you give one, and your message) so we can reply and refer back to it.

If you have a trade account, we keep your email address and whether the account is active, so trade pricing applies when you sign in.

If you join our partner programme, we keep your name, email address, where you promote us, your discount codes and the orders placed with them, so we can work out and pay your commission. How you would like to be paid (bank details or a PayPal address) is stored encrypted. The basis is our agreement with you, and payment records are kept as long as the law requires business records to be.

Emails you send us

If you email us, we keep the conversation so we can help and refer back to it.

Who else handles it

We do not sell your information or share it for anyone else's marketing. A few companies handle it on our behalf, under contract, and only to do their part:

• Stripe takes payments and holds the order and payment records. It also runs fraud checks. If you pay with a wallet or another method offered at checkout, that provider handles its part under its own terms.
• Vercel hosts this website and stores reviews, review photographs, the newsletter list, trade and partner records and our catalogue. It also connects the support assistant to its AI model.
• OpenAI, through Vercel's AI Gateway, writes the support assistant's answers from what you type.
• Resend sends our emails: order confirmations, review requests, sign-in links, trade and partner emails and, if you are on the list, the newsletter.
• Google runs the optional Customer Reviews survey if you opt in. The site's typefaces are also served by Google Fonts, so your browser asks Google's servers for them, which shares your internet address with Google.
• The courier that delivers your parcel (Royal Mail, Evri, DPD or Parcelforce) gets your name, address and sometimes your phone number to deliver it.

Some of these companies are based in, or store data in, the United States. Where that happens, the transfer is protected by the safeguards UK law requires, such as the UK–US data bridge or the standard contract clauses approved for UK data.

Cookies and storage

We use no advertising or tracking cookies, so there is no cookie banner to click through. What this site does keep in your browser is only what it needs to work:

• Your bag, kept on your device so it is still there when you come back.
• A sign-in cookie, if you sign in to see your orders. It lasts thirty days or until you sign out.
• A few small notes: whether you have seen the current banner, whether the support panel is open and what was said in it this visit, whether the card about our app has been shown, and, for trade customers, a reminder to check the account's pricing.
• Stripe's cookies on the checkout page, which it needs to prevent fraud.

We count visits with Vercel's analytics, which uses no cookies and does not identify you: it tells us how many people looked at a page, not who they were.

How long we keep it

Order and partner payment records are kept for six years after the end of the tax year they fall in, because the law requires business records to be kept that long. Reviews stay up until you ask us to remove them, or we take them down. Newsletter addresses are kept until you unsubscribe; after that we keep a note that you asked not to be emailed, so we never add you again by mistake. Enquiries and emails are kept for as long as they are useful for helping you, and no longer.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, to delete it, to stop using it for a particular purpose, or to hand it to you in a form you can take elsewhere. Some of it, such as order records we must keep for tax, we cannot delete before the law allows; we will tell you if that applies. Email us and we will reply within a month.

If you are unhappy with how we have handled your information, please tell us first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Changes

If we change how we use your information, we will update this page and the date at the top. If a change matters to you, for example a new company handling your data, we will say so plainly here.