Who I am
I’m Shane Fullwood, and I run Hawksbury Timber — the timber site at hawksburytimber.co.uk — as a sole trader. I’m the data controller for the personal information described on this page, which means I’m the one responsible for it under UK data protection law. You can reach me about anything on this page at hello@hawksburytimber.co.uk.
What I collect, and why
When you get in touch. There’s a contact form on the contact page, and you can also reach me by email, phone or WhatsApp using the details there. The form asks for your name, your email address, an optional phone number, what you’re working on, and which page you came from — and there’s a box you have to tick before it will send, which is you telling me it’s alright to use those details to answer you. What you send is stored privately in my site’s database, which only I can get into, and a copy is emailed to me so I can act on it. I keep what you send me for one reason: to reply to you, and to pick the conversation up again later.
When you use the Marketplace. If you post an advert, I keep what you put in the form: your name, email address, the postcode where the timber is, your business name if you give one, and the advert and its photos. Only the first half of the postcode is shown on the advert, and any location details hidden inside your photos are removed when they’re uploaded. Your email address is never shown. It’s used to send you the links to confirm and manage your advert, and to pass on buyers’ messages.
When you message a seller or report an advert. Your name, email address and message are emailed to the seller so they can reply to you directly. I don’t keep a copy of the message. If you report an advert, the reason and any note you add are kept with the advert so I can check it.
Stopping abuse. To stop the Marketplace forms being misused, the site keeps a scrambled version of your internet address (never the address itself). It’s only used to limit how many adverts and messages can be sent in an hour, and to stop the same person reporting an advert twice.
Two outside services help with adverts. The postcode is looked up with postcodes.io, a free UK postcode service, so the advert can show its area and turn up in searches by distance. The advert’s wording (not your email address or postcode) is checked by an AI service to catch scams and adverts that break the guidelines. Anything it isn’t sure about comes to me to look at by hand.
How long adverts are kept. An advert that’s never confirmed is deleted after 7 days. Once an advert is sold or ends, it and its photos are deleted 90 days later. You can take your advert down yourself at any time with the link in your email, and that deletes it and its photos straight away.
When you contact a business in the directory. The form on a listing asks for your name and email address, and optionally your phone number, postcode and what you’re after. It’s emailed to that business so they can answer you, with your email address as the one they reply to. A copy is kept privately on the site and emailed to me, so I can help if a message goes astray or a business misuses the form.
When you add or claim a business. I keep your name, your role in the business, your email address and phone number, and anything you send to show the business is yours. They’re used to check the claim, to send you the link that signs you in to manage your listing, and for the odd email about the listing, such as a monthly note of how it’s doing. Every one of those emails has a link to stop them. What you put on the listing itself, such as the business phone number, its public email address, its stock list and photos, is shown publicly, because that’s what a listing is for. Your own name, your phone number and the email address you claimed with aren’t shown.
Where listing details come from. Some businesses were listed before they got in touch. Their details, such as name, address, phone number, website and general email address, come from the business’s own website and public records such as Companies House. To find independent yards, I use an AI service that searches the web, and the site reads the business’s own website to check what it found. I only email limited companies about their listing this way, never sole traders, and every email has a link to stop them for good. Any business can ask me to change or remove its listing at any time.
When you ask for a quote. The quote form asks for your name, email address, phone number, business, postcode, details of the job, budget and any files you attach. The form is kept privately on the site and a copy is emailed to me so I can answer you. Files you attach are saved on the site at a web address that isn’t linked from anywhere, but isn’t password protected either, so please don’t attach anything confidential. If you need to send something private, ask me first.
Cookies and things saved in your browser. The site doesn’t use cookies for tracking or advertising. If you sign in to manage a listing, a cookie keeps you signed in for up to 14 days. The calculators remember which units you prefer, saved in your own browser. Neither is shared with anyone.
Maps on listings. Some listing pages show a map from OpenStreetMap. When it loads, your browser fetches the map from OpenStreetMap’s servers, which see your internet address the way any website you visit does. They don’t get anything else from this site.
Posts on Instagram and Facebook. I post about the site’s guides on the Hawksbury Instagram account and Facebook Page. When a business joins the directory, I may also welcome it in a public post there. A welcome uses only the business’s name, its town, a line about what it does from its listing, a link to the listing and, on Instagram, its public account name. It never uses photos of their work (it uses a Hawksbury name card instead), and I never send direct messages. If a business would rather not be posted about, or wants a post taken down, tell me and I’ll remove it the same day. Instagram and Facebook are run by Meta, and its own privacy policy covers what happens on its apps.
When you ask me to work on your job. Most of what I do here is free. Where I give paid help — my time on your job — I keep what you tell me about the job so I can do the work and answer you properly. That might include drawings, specifications, quotes you’ve had from elsewhere, and the sizes and quantities involved.
When you sign up for emails. The “Stay in the Loop” box on guides and pages asks for your email address, and optionally your first name. If you sign up, you get a welcome email with the free guide, and then a monthly round-up of new guides and timber-directory news. A round-up can include up to three paid merchant listings, and they are always labelled as paid. The list is kept on this website, on my hosting with Hostinger, together with the date you signed up, the page you signed up on and the wording you agreed to. Your email address and first name are also copied to Resend, the email service that sends the round-ups, so it knows who to send them to and who has unsubscribed.
You can unsubscribe any time. Every round-up has an unsubscribe link at the bottom: click it and you’re off the list. Or reply to any email I send, or email hello@hawksburytimber.co.uk, and I’ll take you off. You don’t have to give a reason.
When you pay me. Paid help and Workshop Finds purchases are both taken by Stripe — see below. I get your name, your email address and, where it’s needed for the job or for delivery, an address and a phone number. Your card details go to Stripe and never to me — I don’t see them and I don’t store them.
There’s no basket and no account here. There’s nothing to sign into, and no order history on the site. Paying is a single payment on Stripe’s own page, not a checkout on this one.
What I don’t do
I don’t sell your information. I don’t pass it to anyone else so they can market to you. I don’t run analytics on this site, I don’t run advertising, and I don’t have social media trackers keeping an eye on you while you read. The only thing that loads from another site is the map on some directory listings, explained below.
Who else sees your information
These, and all of them are about running the site, taking a payment or handling a form, rather than using your details:
- Hostinger — my hosting company. The site and its database are kept on Hostinger’s servers in the UK.
- Stripe — the payment provider, for paid help, Workshop Finds and paid directory listings when they open. You pay on Stripe’s own page and your card details go to Stripe, never to me — I don’t see them and I don’t store them. Stripe is a data controller in its own right for the payment; its privacy policy is at stripe.com/privacy.
- Resend — the email service that sends the round-ups and the site’s other emails, such as the welcome email and replies to forms. It holds the email list described above.
- postcodes.io: a free UK postcode service. Postcodes typed into the Marketplace and directory forms are looked up there to find the area.
- An AI service: used to check the wording of Marketplace adverts (never your name, email address or postcode), to search the web for independent yards to list, and to draft social media posts from the site’s own guides.
- OpenStreetMap: the map on some listing pages, as described above.
- Meta (Instagram and Facebook): where I post about the site and welcome new businesses in the directory, as described above. Nothing about visitors to this site is sent to Meta.
Nothing else. And none of them gets your details for their own marketing.
How long I keep it
Messages you send me: kept for up to 24 months from your last contact — long enough to help with any follow-up work, then they’re gone.
Job details, where I’ve worked on something for you: kept for up to 24 months from the last contact about that job, so I can answer a question about it later, then deleted.
Messages to businesses in the directory, quote requests and listing claims: kept no longer than 24 months from the last contact. I clear them out by hand, so if you want yours gone sooner, just ask.
Marketplace adverts: as set out above. Unconfirmed adverts go after 7 days, and ended ones 90 days after they end.
If you’ve asked me to stop emailing your business: the address is kept on a do-not-email list for good, so it’s never emailed again.
Email list: until you unsubscribe. If you unsubscribe, your address comes off the list and I won’t email you again.
Payment records: kept as long as I have to keep them for tax and accounting, then deleted. The card details aren’t mine to keep — Stripe holds those.
Your rights
Under UK data protection law you can:
- Ask what I hold about you, and get a copy (access)
- Have it corrected if it’s wrong (rectification)
- Have it deleted (erasure)
- Object to me using it
- Ask me to restrict what I’m doing with it
- Ask for it in a portable form so you can take it elsewhere
Just email hello@hawksburytimber.co.uk and ask. I’ll answer within a month, and I won’t charge you for it. I may need to check it’s really you before acting on a request — that’s to protect your information, not to slow you down. If you’re on the email list and just want off it, use the unsubscribe link in any round-up, or a one-line reply to any email I send is enough.
If you’re unhappy with how I’ve handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. I’d rather you told me first, because I can usually fix it faster.
Changes to this page
If I change how I handle your information, I’ll change this page. It was last updated on 21 October 2026.