Data Protection Notice

Last updated: August 2026

This notice explains how we process personal data in compliance with applicable data protection regulations, including the General Data Protection Regulation.

Data Controller

The data controller responsible for your personal information is:

Willow Craft
42 Meadowbank Lane
Cheltenham, Gloucestershire
GL50 3RB
United Kingdom

Email: [email protected]

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you submit an enquiry form, you provide explicit consent for us to process your information to respond to your request
• Legitimate interests: To operate our business and respond to customer enquiries

Data We Collect

We collect only the information necessary to fulfill your enquiry:

• Name
• Email address
• Service selection
• Message content

How Long We Keep Your Data

Personal data collected through enquiry forms is retained only as long as necessary to respond to your request. If you proceed with a commission, we retain your information for the duration of the business relationship and for a reasonable period afterward to address any follow-up questions.

If you do not proceed with a commission, your enquiry data is typically deleted within six months of initial contact.

Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access: Request confirmation of whether we process your data and obtain a copy
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure: Request deletion of your data under certain circumstances
• Right to restriction of processing: Request limitation on how we use your data
• Right to data portability: Request transfer of your data to another controller
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent

Exercising Your Rights

To exercise any of these rights, contact us at [email protected]. We will respond to your request within one month. If your request is complex or we receive multiple requests, we may extend this period by two months and will inform you of the extension.

Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. However, no electronic transmission or storage method is completely secure, and we cannot guarantee absolute security.

Third-Party Sharing

We do not share, sell, or transfer your personal data to third parties except as required by law or with your explicit consent.

Automated Decision-Making

We do not use automated decision-making or profiling systems that produce legal effects or significantly affect you.

International Data Transfers

Your data is processed and stored within the United Kingdom. We do not transfer personal data outside the UK or European Economic Area.

Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Information Commissioner's Office, the UK supervisory authority for data protection.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: ico.org.uk

Changes to This Notice

We may update this data protection notice to reflect changes in our practices or legal requirements. Updates will be posted on this page with a revised date.