Privacy Policy

Last updated · 1 May 2026

This policy explains what personal information we collect from you, how we use it, who we share it with, and your rights under UK GDPR. We are Timber Row, a trading division of Sorrell & Smith Ltd (registered in England, no. 14373414), Sorrell Farm, Meadow Lane, Wickford, Essex SS11 7DY. We are the data controller for the information you provide.

1. What we collect

• Order information: name, billing & delivery address, phone, email, what you ordered, what you paid.
• Account information (if you create one): email and password (hashed), saved addresses, order history.
• Usage data: pages you view, basket activity, IP address, device, browser.
• Marketing preferences: whether you've opted in to our newsletter.

We do not store full card details. Card payments are processed by Stripe or PayPal, they handle the card data, we never see it.

2. Why we collect it

• To fulfil your order, make the table, ship it, and answer your questions about it.
• To run a 10-year warranty (we need to know who bought what, and when).
• To send order updates and delivery booking calls.
• To send marketing emails, only if you've opted in. You can opt out any time.
• To improve the website and prevent fraud.

3. Who we share it with

Only the following processors, and only what they need:

• Our delivery partners (so they can deliver your table).
• Our payment processors (Stripe, PayPal).
• Our email service provider (Klaviyo) for transactional and (if opted-in) marketing emails.
• Our cloud hosting provider (AWS, EU-West region).
• Our sister brand's review platform (Trustpilot, under Sorrell & Smith Ltd) only if you choose to leave a review there.

We never sell your data. We never share it with our sister brand Sorrell & Smith for marketing without your separate, explicit consent.

4. How long we keep it

• Order data: 10 years (to honour the structural guarantee).
• Account data: until you ask us to delete it.
• Marketing preferences: until you change them.
• Anonymous analytics: 26 months.

5. Your rights

Under UK GDPR, you have the right to:

• Ask for a copy of the data we hold on you.
• Ask us to correct anything that's wrong.
• Ask us to delete your data (subject to our warranty obligations).
• Ask us to stop processing it for marketing.
• Complain to the ICO at ico.org.uk.

To exercise any of these, email [email protected]. We respond within 14 days.

6. Cookies

See our Cookie Policy for the full list of cookies we set, why, and how to opt out.

Separately from cookies, we count visits to our own pages using a cookieless, first-party method: our server briefly derives an anonymous daily code from your IP address and browser type, which cannot identify you, is never shared, and changes every day so your visits cannot be linked together over time. Per-visit records are deleted within 90 days; only aggregate statistics (such as "how many people viewed this page") are kept. We honour the Do Not Track and Global Privacy Control browser signals — if either is enabled, your visit isn't counted at all.

7. Changes to this policy

We'll update this page if anything material changes, and email account holders if there's a substantive change to how we use your data.