Privacy Policy
Last updated: 20 September 2026
The Whybrow Workshop respects your privacy and is committed to protecting your personal information.
This Privacy Policy explains what information we collect, why we use it, who we may share it with, how long we keep it, and the rights you have in relation to your personal information.
This policy applies when you:
visit thewwshop.co.uk;
create or use a customer account;
place an order;
request a quotation;
enquire about or order a bespoke commission;
contact us;
subscribe to marketing communications;
enter a promotion or use a gift voucher; or
otherwise provide personal information to The Whybrow Workshop.
A separate Cookie Policy explains how cookies and similar technologies are used on our website.
1. Who we are
The Whybrow Workshop is operated by Tracy Whybrow, a sole trader trading as The Whybrow Workshop.
For the purposes of UK data-protection law, Tracy Whybrow trading as The Whybrow Workshop is the data controller responsible for the personal information described in this policy.
Correspondence address:
The Whybrow Workshop
Unit 172911
PO Box 7169
Poole
BH15 9EL
United Kingdom
Email: [email protected]
Contact form:
https://thewwshop.co.uk/contactus
Please do not send physical product returns to the correspondence address unless we specifically tell you to do so. Product return instructions are provided separately when required.
2. The information we may collect
The personal information we collect depends on how you interact with us.
Information you provide when placing an order
This may include:
your name;
email address;
telephone number, where provided or required;
billing address;
delivery address;
account information;
products ordered;
order history;
delivery preferences;
payment status;
transaction references;
information supplied by our payment providers; and
correspondence relating to your order.
We do not normally receive or store your complete debit or credit card details. Payment details are processed by the relevant payment provider.
Customer account information
If you create an account on our website, we may process information including:
your name;
email address;
saved addresses;
account credentials or authentication information;
previous orders; and
account preferences.
Guest checkout is also available and you do not need to create an account simply to place a standard website order.
Enquiries and quotation requests
When you contact us or request a quotation, we may collect:
your name;
email address;
address, where required for a quotation;
information contained in your enquiry;
files or attachments you send to us;
photographs;
drawings;
designs;
reference material; and
records of our correspondence with you.
Bespoke commissions
Commission enquiries may involve additional information depending on the project.
This may include:
photographs;
sketches and drawings;
reference images;
names;
dates;
text to be incorporated into a piece;
information about an intended recipient;
personal photographs or likenesses; and
other information relevant to producing the requested artwork.
Please avoid providing personal information that is not reasonably necessary for your commission.
If you provide personal information about another person, you should make sure you have an appropriate basis for providing it to us.
Payment information
Payments may be made through providers and payment methods including:
Stripe;
PayPal;
Klarna;
Clearpay;
Google Pay;
debit or credit card;
bank transfer; and
other payment methods that may become available.
Payment providers process payment information according to their own systems and privacy policies.
The information we receive following a payment may include details such as:
your name;
payment status;
payment method;
transaction reference;
amount paid;
limited payment information such as card type or the last few digits of a card number; and
fraud or verification information supplied by the payment provider.
We do not intend to store your full payment-card number or card security code on our own systems.
Technical and website information
When you use our website, technical information may be generated automatically.
Depending on our website configuration, this may include:
IP address;
date and time of access;
browser type;
device information;
pages requested;
server logs;
security logs; and
information required to operate a shopping basket, login session or other website functionality.
Further information about cookies and similar technologies will be provided in our separate Cookie Policy.
3. Where we obtain your information
Most of the personal information we process is provided directly by you.
We may also receive information from:
our website and e-commerce system;
payment providers;
delivery and postal providers;
someone placing an order on your behalf;
someone purchasing a gift for you;
fraud-prevention or security services; or
other service providers involved in fulfilling your order.
Where another person provides us with your delivery details so that we can send you a gift or order, we will use that information for the purpose of fulfilling that delivery and related obligations.
4. Why we use your information
We may use personal information to:
process and fulfil orders;
take and reconcile payments;
create and manage customer accounts;
provide quotations;
discuss and create bespoke commissions;
communicate with you about an order or enquiry;
arrange delivery or collection;
process returns, refunds and complaints;
provide customer service;
maintain accounting and tax records;
prevent fraud and misuse;
protect our website and systems;
establish, exercise or defend legal rights;
comply with legal and regulatory obligations;
improve the operation of our business;
maintain records of previous work and customer communications;
send marketing where permitted; and
photograph or display commissioned work where permitted and appropriate.
We will not use personal information for a purpose that is incompatible with the reason it was originally collected unless we have a lawful basis for doing so.
5. Our lawful bases for using personal information
UK data-protection law requires us to have a lawful basis for processing personal information.
Different lawful bases apply to different activities.
Contract
We use personal information where it is necessary to enter into or perform a contract with you.
Examples include:
processing your order;
delivering an item;
providing a quotation you have requested;
creating a commission;
taking payment;
dealing with an agreed return; and
communicating with you about your purchase.
Some information is necessary for us to fulfil an order. If you do not provide it, we may be unable to sell or deliver the relevant product to you.
Legal obligation
We process certain information where necessary to comply with legal obligations.
This may include:
tax and accounting records;
transaction records;
responding to lawful requests from authorities;
complying with consumer-protection obligations; and
maintaining records required by law.
Legitimate interests
We may process information where this is necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights and interests.
Our legitimate interests may include:
operating and improving our business;
preventing and investigating fraud;
maintaining website and information security;
keeping appropriate business records;
dealing with disputes and complaints;
protecting and enforcing our legal rights;
understanding previous customer relationships;
preventing misuse of our services; and
promoting our products to existing customers where the law permits us to do so.
Where we rely on legitimate interests, we consider whether the processing is reasonably necessary and its potential effect on your privacy.
Consent
We may rely on your consent where appropriate.
This may include certain forms of:
email marketing;
use of optional cookies;
publication of personal information contained in a commission; or
other optional processing where consent is the appropriate lawful basis.
Where processing is based on consent, you can withdraw your consent at any time.
Withdrawing consent does not make processing that took place before withdrawal unlawful.
6. Orders and contractual communications
If you place an order with us, we will contact you where necessary to administer that order.
These communications are not marketing messages.
They may include:
order confirmations;
payment information;
quotation communications;
commission updates;
delivery information;
questions necessary to complete your order;
notices of delays or material changes;
return or refund information; and
other communications necessary to perform our contract with you.
You cannot opt out of essential transactional communications while we are fulfilling an active order.
7. Marketing communications
We may offer an email newsletter or other marketing communications in the future.
Marketing you specifically request
If you subscribe to a newsletter or otherwise ask to receive marketing, we may use your details to send you information about:
new products;
new designs;
commissions;
promotions;
special offers;
events; and
other news from The Whybrow Workshop.
Where consent is required, we will ask for it appropriately.
Existing customers
Where permitted by applicable electronic-marketing law, we may send existing customers marketing about our own products or services that are similar to those they previously purchased or enquired about.
Where we rely on this type of existing-customer marketing, customers will be provided with an appropriate opportunity to opt out when their details are collected and in subsequent marketing communications.
We will not sell your email address to third parties for their marketing.
Opting out
You can ask us to stop sending direct marketing at any time by:
using the unsubscribe option contained in a marketing message, where provided; or
contacting us at [email protected].
Opting out of marketing will not prevent us from sending service messages that are necessary in relation to an order, account or legal obligation.
We may retain a minimal record that you have opted out so that we can respect your preference in the future.
8. Photographs and commissioned work
We may photograph products and commissions that we create for use in:
our website;
portfolio;
social-media accounts;
marketing;
examples of previous work; and
other promotional material relating to The Whybrow Workshop.
A photograph of an ordinary product will not necessarily contain personal information.
However, a bespoke commission may itself contain personal information, such as:
a person's name;
an identifiable photograph or likeness;
a wedding or anniversary date;
memorial information;
personalised text; or
another identifying feature.
Where publication of a commission would involve personal information, we will consider the appropriate lawful basis before publishing it.
We will not intentionally publish a customer's address, email address, payment information or other unrelated private information as part of displaying our work.
If you require a commission to remain private, you should tell us before accepting the quotation so that this can be agreed as part of the commission.
9. Who we share information with
We only share personal information where there is a legitimate reason to do so.
Depending on the circumstances, information may be shared with the following categories of recipient.
Payment providers
Payment information may be processed by providers such as:
Stripe;
PayPal;
Klarna;
Clearpay;
Google Pay; and
relevant banks or financial institutions.
These organisations may process information under their own privacy policies and may carry out their own fraud-prevention, verification and regulatory checks.
Delivery providers
We may provide a postal service or courier with information required to deliver your order.
This will normally include information such as:
recipient name;
delivery address;
telephone number, where required;
email address, where required for delivery notifications; and
relevant delivery instructions.
The particular carrier used may vary according to the order, destination, value, size and available service.
We only intend to provide delivery companies with information reasonably necessary to perform the delivery.
Technology and hosting providers
Our website uses Odoo software and is hosted on infrastructure operated by The Whybrow Workshop.
We may also use technology providers that assist in securely operating, protecting and backing up the website and its data.
These currently include services provided by:
Cloudflare, including network, DNS and secure connectivity services; and
Proton, including external backup or cloud-storage services.
These providers may process limited personal information where necessary to supply their services.
Professional and legal recipients
Where necessary, we may disclose information to:
accountants;
professional advisers;
legal advisers;
insurers;
law-enforcement authorities;
courts;
regulators;
HM Revenue & Customs; or
other public authorities where required or permitted by law.
We do not sell customer personal information.
10. Where your information is stored
Our primary Odoo website and business system is hosted by The Whybrow Workshop on privately operated server infrastructure located in the United Kingdom.
Appropriate measures are used to restrict administrative access to that infrastructure.
We also use third-party services to provide functions such as:
network connectivity and website protection;
payment processing;
external backups;
communications; and
delivery.
As a result, some personal information may be processed by third-party providers on infrastructure outside the United Kingdom.
11. International transfers of personal information
Some of the service providers involved in operating our business may process information outside the United Kingdom.
International processing may arise, for example, through:
payment providers;
technology providers;
cloud or backup providers; or
international delivery companies.
Where UK data-protection law treats this as a restricted international transfer, we will take steps required by applicable law to ensure an appropriate level of protection.
Depending on the country and provider, this may include relying on:
UK adequacy regulations;
approved contractual safeguards;
another legally recognised transfer mechanism; or
an applicable legal exception.
For international orders, personal information necessary to deliver the parcel may also need to be provided to postal operators, couriers, customs authorities or their service providers in the destination country.
12. How long we keep information
We do not keep personal information indefinitely merely because we have collected it.
The appropriate retention period depends on why we hold the information, our legal obligations and whether it may reasonably be required in connection with a dispute or claim.
Our normal approach is as follows.
Orders, payments and accounting records
Records relating to completed sales, invoices, payments and information required for tax or accounting purposes will generally be retained for up to seven years following the end of the relevant accounting or tax period.
We may retain particular records for longer where required by law or where they are reasonably required in connection with an active dispute, investigation or legal claim.
Commission records
Records associated with completed commissions may generally be retained for up to seven years where they form part of our contractual, transaction, accounting or legal records.
We may retain a non-personal or appropriately minimised record of designs and completed artwork for longer as part of our artistic and business archive.
Enquiries that do not result in an order
General enquiries that do not result in an order will normally be deleted or anonymised when they are no longer reasonably required.
As a general guide, we expect to review unsuccessful or inactive enquiries after approximately 12 months.
We may keep them longer where there is a reasonable reason to do so, such as an ongoing discussion, dispute or likely future commission.
Unsuccessful quotations
Quotation records that do not result in an order may normally be retained for up to two years, unless there is a reason to keep them for longer.
Customer accounts
Information associated with an active customer account may be retained while the account remains active and afterwards where relevant information must be retained for contractual, tax, fraud-prevention or legal purposes.
You may contact us if you wish to close your account.
Closing an account does not necessarily require us to erase information that we are legally entitled or required to retain.
Marketing information
Marketing information may be retained while you remain subscribed or while we otherwise have a lawful basis to send marketing.
If you unsubscribe, we may retain limited information on a suppression list so that we remember not to send marketing to you again.
Security and server logs
Technical and security logs are retained only for as long as reasonably necessary for security, troubleshooting, fraud prevention and system administration.
Backups
Personal information may remain in secure system backups for a limited period after it has been deleted from the active system.
Backup copies are retained and overwritten according to our backup and disaster-recovery arrangements and are not used for ordinary business purposes unless restoration is necessary.
13. How we protect your information
We use appropriate technical and organisational measures designed to protect personal information against:
unauthorised access;
accidental loss;
destruction;
alteration;
unauthorised disclosure; and
misuse.
Our security measures include controls designed to restrict administrative access to our server and systems, secure methods of remote connectivity, authentication controls, restricted internal administrative access and external backup arrangements.
No internet-connected system can be guaranteed to be completely secure. We therefore keep our security arrangements under review and make improvements where appropriate.
14. Payment security
Payment-card processing is handled through specialist payment providers rather than by The Whybrow Workshop directly.
We receive only the payment and transaction information made available to us by those providers for purposes such as:
confirming payment;
administering the order;
processing refunds;
bookkeeping;
responding to disputes; and
fraud prevention.
Customers should not send complete card details to us by email, contact form or commission attachment.
15. Your data-protection rights
Depending on the circumstances and the lawful basis on which we are using your information, UK data-protection law may give you rights including the right to:
be informed about how your information is used;
request access to personal information we hold about you;
ask us to correct inaccurate or incomplete information;
ask us to erase personal information in certain circumstances;
ask us to restrict the use of information in certain circumstances;
object to certain processing;
object to direct marketing;
receive certain information in a portable format where applicable; and
withdraw consent where we rely on consent.
These rights are not absolute in every situation.
For example, we may need to retain transaction information despite an erasure request where it must be kept for tax, accounting or legal purposes.
There is normally no charge for exercising your data-protection rights.
We may need to ask for information to confirm your identity before disclosing or changing personal information.
To exercise a right, contact:
or use:
https://thewwshop.co.uk/contactus
16. Direct marketing rights
You have the right to object to the use of your personal information for direct marketing at any time.
If you ask us to stop using your information for direct marketing, we will do so.
We may retain limited information necessary to record and honour your request.
17. Children
The Whybrow Workshop is not designed or marketed specifically for children under the age of 13 and we do not knowingly seek to collect personal information from children under 13 through the website.
If you believe a child under 13 has provided personal information to us unnecessarily, please contact us so that we can review the situation.
Where a young person places an order, they must be legally able to enter into the relevant transaction and must not use another person's payment method without permission.
18. Information about other people
Please take care when sending us information about another person.
This is particularly relevant to bespoke commissions involving:
photographs;
portraits;
names;
memorial pieces;
personalised messages; or
other identifying information.
You should only provide another person's information where you have an appropriate reason and permission to do so.
We will use such information only where reasonably necessary for the purpose for which it was provided, unless another lawful basis applies.
19. Fraud prevention and security
We and our payment, technology and service providers may process information where reasonably necessary to:
verify transactions;
identify suspicious activity;
prevent fraud;
protect customer accounts;
prevent unauthorised access;
investigate security incidents; and
protect our legal rights and systems.
Payment providers may independently conduct identity, credit, fraud or regulatory checks according to their own terms and privacy notices.
20. Automated decision-making
The Whybrow Workshop does not currently use its own systems to make solely automated decisions about customers that have legal or similarly significant effects.
However, third-party providers such as payment, fraud-prevention or credit providers may use automated systems when providing their own services.
For example, Klarna, Clearpay, Stripe or another payment provider may undertake automated fraud, eligibility or payment checks.
Where they independently determine how such processing takes place, their own privacy notices explain that processing and the rights available to you.
21. Links and third-party services
Our website may contain links to websites or services operated by other organisations.
If you follow a link to another organisation, its own privacy policy will apply to information it collects.
The Whybrow Workshop is not responsible for the privacy practices of independent third-party websites.
22. Complaints
If you have a concern about how we have handled your personal information, please contact us first so that we have an opportunity to investigate and resolve the issue.
You can contact us at:
or:
https://thewwshop.co.uk/contactus
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.
Information about making a complaint is available from the ICO at:
https://ico.org.uk/make-a-complaint/
23. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
This may happen if:
our website changes;
we introduce new services;
we use new technology or service providers;
our marketing practices change; or
data-protection law or regulatory guidance changes.
The current version will be published on our website with its latest revision date.
Where a change would significantly affect how we use personal information, we will take reasonable steps to bring the change to the attention of affected individuals where appropriate.
24. Contacting us
For questions about this Privacy Policy, requests relating to your personal information, or concerns about our use of personal information, contact:
Tracy Whybrow trading as The Whybrow Workshop
Email: [email protected]
Correspondence address:
The Whybrow Workshop
Unit 172911
PO Box 7169
Poole
BH15 9EL
United Kingdom
Online contact form: