1. Who we are

For data-protection purposes, Ravensby Firewood is the controller of the personal information described in this policy.

Ravensby Firewood
Mains of Ravensby Farm
Carnoustie
Angus
DD7 7RJ

Email: info@ravensbyfirewood.com
Telephone: 01241 570 169

This policy explains how we collect, use, store and share personal information when you:

• visit our website;
• place or discuss an order;
• contact us by telephone, email, text, social media or another method;
• sign up for marketing;
• request a quotation;
• receive a delivery;
• leave a review; or
• otherwise interact with Ravensby Firewood.

2. The personal information we collect

Depending on how you interact with us, we may collect:

Identity and contact information

• name;
• billing and delivery address;
• postcode;
• email address;
• telephone number;
• company or organisation name, where relevant.

Order and transaction information

• products ordered;
• quantities, prices and discounts;
• delivery dates and delivery instructions;
• order history;
• payment status;
• refunds, credits and disputes;
• invoice and VAT information.

We do not normally receive or retain your complete payment-card details. Card payments are processed by Shopify Payments or another payment provider.

Delivery information

We may collect:

• details of your requested drop-off location;
• access restrictions;
• gate, driveway and road information;
• information about ground conditions;
• delivery notes;
• photographs relating to access, placement, damage or delivery;
• correspondence relating to failed or disputed deliveries;
• driver and route information.

Please avoid including unnecessary sensitive personal information in your delivery instructions.

Communications

We may retain:

• emails, messages and letters;
• telephone-call notes;
• enquiries and complaints;
• reviews and feedback;
• social-media messages;
• records of consent and marketing preferences.

Website and device information

Depending on your cookie choices, we may collect:

• IP address;
• browser and device type;
• operating system;
• pages viewed;
• time spent on the website;
• referring website;
• products viewed;
• basket and checkout activity;
• approximate location;
• advertising identifiers;
• cookie and consent preferences.

Security and incident information

Where necessary, we may process:

• fraud-prevention information;
• website security logs;
• delivery photographs;
• CCTV or vehicle-camera footage;
• information relating to accidents, damage, complaints or legal claims.

3. How we obtain your information

We normally obtain personal information directly from you when you:

• place an order;
• create or use an account;
• contact us;
• complete a form;
• subscribe to marketing;
• give delivery instructions;
• leave a review;
• communicate through social media.

We may also receive information from:

• Shopify;
• payment providers;
• delivery companies and pallet networks;
• delivery-booking or route-planning services;
• advertising and analytics providers;
• review platforms;
• fraud-prevention or security providers;
• another person placing an order for you;
• publicly available sources, where appropriate.

4. How and why we use your information

We use personal information only where we have a lawful reason to do so.

To process and fulfil orders

We use your information to:

• accept and process orders;
• take and confirm payment;
• arrange delivery or collection;
• provide delivery updates;
• respond to order enquiries;
• manage refunds and returns;
• provide customer support.

Our lawful basis is that this processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.

To manage delivery

We use delivery addresses, instructions, access information and contact details to:

• plan delivery routes;
• allocate drivers;
• assess access;
• place goods safely;
• contact you about delivery;
• investigate failed or disputed deliveries.

Our lawful bases are performance of our contract and our legitimate interests in providing an efficient and safe delivery service.

To meet legal and regulatory obligations

We may use and retain information for:

• tax and accounting;
• VAT records;
• fraud prevention;
• consumer-law compliance;
• product-safety obligations;
• responding to regulators, police, courts or other authorities;
• handling data-protection requests.

Our lawful basis is compliance with a legal obligation.

To protect our business and resolve disputes

We may use order information, correspondence, photographs, delivery records, CCTV or vehicle-camera footage to:

• prevent and investigate fraud;
• protect customers, staff, property and vehicles;
• investigate accidents or alleged damage;
• establish, exercise or defend legal claims;
• enforce our terms and conditions.

Our lawful basis is our legitimate interests in protecting the business, our staff, customers and property, and resolving disputes fairly.

To improve our services and website

We may analyse orders, enquiries, reviews and website use to:

• improve our products and delivery service;
• understand customer demand;
• identify website faults;
• measure advertising performance;
• improve website design and content.

Where cookies or similar technologies are involved, we obtain consent where required.

To send marketing

Where permitted, we may send information about:

• firewood products;
• seasonal availability;
• delivery areas;
• offers and promotions;
• Log Club benefits;
• relevant service updates.

We rely on consent or, where the legal requirements are met, the existing-customer “soft opt-in.”

The soft opt-in may allow us to email an existing customer about our own similar products where we gave them a clear opportunity to opt out when we collected their information and in every subsequent message.

You can unsubscribe at any time using the link in a marketing email or by contacting us.

Service messages relating to an existing order are not marketing and may still be sent after you unsubscribe from promotional emails.

5. Our legitimate interests

Where we rely on legitimate interests, those interests may include:

• operating and improving our business;
• providing safe and efficient deliveries;
• preventing fraud and misuse;
• protecting customers, staff and property;
• maintaining accurate business records;
• responding to enquiries and complaints;
• understanding product demand;
• promoting similar products to existing customers where permitted;
• establishing or defending legal claims.

We consider whether our interests are balanced against your rights and reasonable expectations.

6. Who we share personal information with

We may share relevant information with organisations that help us operate our business, including:

Ecommerce and website providers

Our online store is hosted using Shopify. Shopify processes customer information to provide the store, checkout, fraud-prevention and associated services.

Depending on Shopify settings and services enabled, Shopify may act as a processor and, for some activities, as an independent controller.

A link to the Shopify Consumer Privacy Policy should be placed here:

[Insert Shopify Consumer Privacy Policy link]

Shopify advises UK merchants to configure customer privacy settings, maintain a cookie banner and ensure their privacy policy reflects the relevant Shopify processing.

Payment providers

We share payment and transaction information with payment processors, banks and fraud-prevention providers where necessary to take payment, issue refunds and prevent fraud.

Delivery providers

We may share names, addresses, telephone numbers, delivery instructions and order information with:

• our drivers;
• pallet networks;
• haulage companies;
• island carriers;
• courier companies;
• route-planning and delivery-management providers.

This may include Palletways, Streamline, Freightroute or other carriers used for a particular delivery.

Business systems and professional advisers

We may use:

• accounting and bookkeeping providers;
• Xero or similar accounting software;
• email and newsletter providers;
• delivery-booking systems;
• customer-service systems;
• cloud-storage and IT providers;
• insurers;
• accountants;
• solicitors and other professional advisers.

Advertising and analytics providers

Where you have consented, we may share or allow the collection of information by services such as:

• Google Analytics;
• Google Ads;
• Meta advertising services;
• Shopify analytics;
• other advertising or website-measurement providers.

Authorities and legal recipients

We may disclose information where reasonably necessary to:

• comply with law;
• respond to a court order or lawful request;
• prevent crime or fraud;
• protect legal rights;
• deal with an insurance claim;
• establish or defend legal proceedings.

We do not sell customer contact lists to third parties.

7. International transfers

Some service providers may process personal information outside the United Kingdom.

Where a restricted international transfer takes place, we expect the relevant provider to use a recognised transfer mechanism, such as:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved contractual clauses;
• another lawful safeguard or exception.

UK data-protection law requires appropriate safeguards where personal information is transferred to a country without applicable adequacy regulations.

Shopify states that its transfer arrangements include appropriate protections for processing within its group and by subprocessors.

8. How long we keep information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax and dispute-resolution requirements.

Our usual retention periods are:

Orders, invoices and accounting records

Normally retained for at least six years where required for VAT, accounting or tax purposes.

VAT-registered businesses are generally required to retain VAT records for at least six years.

Customer-service correspondence

Normally retained for up to six years after the matter or transaction ends where it may be relevant to a complaint, guarantee, dispute or legal claim.

Marketing records

Kept until you unsubscribe, withdraw consent or object.

We may retain limited suppression information after an opt-out so that we can ensure you are not accidentally added back to marketing.

Delivery photographs and incident records

Routine delivery information is retained only for as long as needed.

Photographs, footage or records connected with an accident, complaint, property damage, insurance matter or legal claim may be retained for longer while the matter remains relevant.

Cookie and analytics information

Retained according to the duration shown within our cookie-management tool or the relevant provider’s settings.

Retention periods may be extended where required by law, a regulator, an insurer or an unresolved dispute.

9. How we protect your information

We use reasonable organisational and technical measures intended to protect personal information, including where appropriate:

• restricted account access;
• password controls;
• staff access limited according to role;
• secure payment processing;
• software updates;
• access logging;
• secure backups;
• contractual requirements for service providers;
• secure deletion or disposal.

No internet transmission or storage system can be guaranteed to be completely secure.

10. Your data-protection rights

Depending on the circumstances, you may have the right to:

• be informed about how your information is used;
• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• request deletion of information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• request data portability where applicable;
• withdraw consent at any time where we rely on consent;
• complain about how your information is used;
• challenge certain decisions made solely by automated means where they have a legal or similarly significant effect.

These rights are not absolute and exemptions may apply. The ICO recognises rights including access, rectification, erasure, restriction, portability and objection.

To exercise a right, contact:

Email: info@ravensbyfirewood.com
Telephone: 01241 570 169
Post: Ravensby Firewood, Mains of Ravensby Farm, Barry, Carnoustie, DD7 7RJ

We may need to request information to confirm your identity.

11. Complaints

Please contact us first if you have concerns about how we use your personal information.

You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

A link to the ICO complaints page should be placed here:

[Insert ICO complaints link]

12. Children’s information

Our website and products are not directed at children, and we do not knowingly collect personal information directly from children for marketing purposes.

Orders should be placed by someone aged 18 or over.

13. Third-party websites

Our website may contain links to third-party websites.

We do not control those websites and are not responsible for their privacy practices. Customers should review the privacy information on any external website they visit.

14. Changes to this policy

We may update this policy to reflect:

• changes to our services;
• changes to the providers we use;
• changes in law or regulatory guidance;
• changes to cookies or advertising tools.

The current version will be published on our website with the updated date.

Cookie Policy

15. What cookies are

Cookies are small text files stored on a computer, telephone, tablet or other device when a website is visited.

Cookies and similar technologies can:

• remember basket contents;
• maintain a secure session;
• remember preferences;
• measure website use;
• identify technical problems;
• measure advertising;
• personalise advertising or content.

The cookie rules also apply to similar technologies that store information on, or access information from, a user’s device.

16. The cookies we use

We may use the following categories.

Strictly necessary cookies

These cookies are required for the website to operate or to provide a service requested by the visitor.

They may be used to:

• remember basket contents;
• process checkout;
• maintain website security;
• prevent fraud;
• balance website traffic;
• remember cookie choices;
• keep a user signed in.

Strictly necessary cookies do not normally require consent, although we still provide information about them. Cookies used for a shopping basket and essential security are examples recognised by the ICO.

Functionality cookies

These cookies remember optional settings and preferences, such as:

• location or delivery preferences;
• display choices;
• previous selections;
• whether particular messages have already been shown.

Where these cookies are not strictly necessary, we ask for consent before setting them.

Analytics and performance cookies

These cookies help us understand:

• how many people visit;
• which pages are viewed;
• how visitors move through the website;
• whether errors occur;
• whether advertising results in visits or orders;
• how the website can be improved.

Analytics information may include IP addresses, device identifiers and browsing activity and should not automatically be assumed to be anonymous.

Where consent is required, analytics cookies will not be placed until consent has been given.

Advertising and targeting cookies

These cookies and similar technologies may be used to:

• measure advertising campaigns;
• limit how often an advert is displayed;
• create advertising audiences;
• show adverts based on previous website activity;
• link website activity with Google, Meta, Shopify or other advertising services.

Advertising and targeting cookies are optional and require consent before they are set.

17. Cookie consent

When you first visit our website, our cookie banner should allow you to:

• accept optional cookies;
• reject optional cookies;
• manage individual categories;
• continue using essential cookies only.

Continuing to browse the website is not treated as consent.

Non-essential cookies must not be set before the visitor has actively agreed to them. Visitors should also be able to disable optional cookies as easily as they enable them.

You may change your choice at any time by selecting:

Cookie Settings

A permanent Cookie Settings link should appear in the website footer.

With Shopify, the cookie banner should either be Shopify’s own banner or a third-party banner correctly integrated with Shopify’s Customer Privacy API.

18. Current cookie list

The exact cookies used may change as Shopify, apps and advertising services are updated.

Your cookie-management system should display an up-to-date list showing:

• cookie name;
• provider;
• purpose;
• category;
• whether it is first-party or third-party;
• duration;
• whether consent is required.

Before publishing this policy, complete a cookie scan and ensure the list shown in your cookie banner matches the cookies actually placed by:

• Shopify;
• Google Analytics;
• Google Ads;
• Meta Pixel;
• Seguno;
• review applications;
• delivery-booking applications;
• embedded maps, videos or social-media content;
• any other installed Shopify application.

19. Managing cookies through a browser

Most browsers allow users to:

• view cookies;
• delete cookies;
• block all or selected cookies;
• block third-party cookies;
• delete cookies when the browser closes.

Blocking strictly necessary cookies may prevent parts of the website, basket or checkout from operating properly.

Browser deletion does not necessarily withdraw consent held by the website. Visitors should also update their preference using the website’s Cookie Settings control.

20. Contact us about privacy or cookies

Questions about this policy or our use of personal information can be sent to:

Ravensby Firewood
Mains of Ravensby Farm
Barry
Carnoustie
Angus
DD7 7RJ

Email: info@ravensbyfirewood.com
Telephone: 01241 570 169