Information collected
We may collect your name, business name, contact details, delivery address, enquiry content, prototype requirements, CAD or mesh models, supplied cabinetry dimensions, cabinetry layout and construction requirements, accessibility feedback, project files and photographs, order and payment records, website attribution data, consent choices and correspondence.
Project enquiries received through this website may also be stored in Wood to Spec’s internal CRM to manage review, qualification, quotation and follow-up. Accessibility and privacy requests are not entered into the sales CRM.
Why it is used
- To assess a project and prepare a quotation.
- To communicate about scope, approval, production and delivery.
- To prepare normal-construction cabinetry files and an approval drawing where quoted.
- To respond to a simplified accessibility request without treating it as an advertising lead.
- To create and fulfil a contract.
- To maintain accounting, tax, quality and revision records.
- To protect the website, prevent spam and investigate misuse.
- With consent, to measure site use and advertising effectiveness.
Lawful bases
Enquiry handling normally relies on steps requested before entering a contract and our legitimate interest in responding to business enquiries. Order fulfilment relies on contract. Accounting and tax records rely on legal obligation. Privacy-limited page-request statistics rely on the legitimate interest in understanding whether the public site is used and keeping it effective, with a visible opt-out. Optional journey analytics and advertising measurement rely on consent.
Website traffic measurement
The privacy-limited page-request record can include the canonical page path and request time, coarse country or network information supplied by the host, and a broad actor classification. A browser signature that claims to be an AI service is recorded only as a claimed, spoofable signal, not as verified identity. The traffic record does not store a raw IP address, full browser user-agent or query string.
After Analytics consent, and only while Global Privacy Control, Do Not Track and the traffic opt-out are absent, browser events can include a random session identifier, the page revision, stable section and target IDs, broad navigation actions, scroll milestones, engagement duration, viewport category and normalised heatmap coordinates. Quote-form diagnostics can include views, starts, submission attempts and outcomes, validation errors and exits. These contain only fixed field identifiers, broad error codes, random attempt identifiers and completed-field counts. Privacy and accessibility request forms are excluded. The collector does not send link text, CSS selectors, contents of form fields, field values, file names, file contents or file metadata. Form subtrees are masked from heatmaps and the project quote page has no heatmap collection. The temporary host-side traffic buffer is configured to expire after 90 days.
Project enquiry submission boundary
The enquiry service does not retain field values, filenames or file contents merely because you type, select a file or leave the page. If you leave without submitting, those details are not sent to the enquiry service. When you press “Request a project quote” after confirming your authority to share and this privacy notice, the submitted field values and any attachment are stored before the business checks run. They remain linked to that submission attempt even when validation or later processing fails, so the request can be investigated and a corrected retry can be distinguished from the earlier attempt.
Consent-control records
We keep an unlinked count when you explicitly select Analytics acceptance or rejection, to check that our consent controls work. This is separate from optional journey analytics and advertising. The record contains the UK date, your selected choice, a one-submission random reference and deployment information; it contains no page, referrer, session identifier, IP address or contact details. It is not joined to website journeys, enquiries or advertising. Ignoring the banner produces no record. These receipts expire after 90 days and are removed by a daily cleanup. See the cookie notice for details.
Project files
Drawings, CAD models, mesh files, images, photographs, measurements, dimensions and designs are stored with the submitted enquiry using the site’s form and hosting providers. They are used to assess, quote and complete the requested work, and are shared only with service providers who need them for hosting, storage, security or the agreed project workflow. Direct attachments remain untrusted until manually reviewed and are not automatically opened in production software. Do not submit material you are not authorised to share.
Retention
Unsuccessful enquiry records and project files are normally retained for up to 24 months after the last substantive contact, unless a shorter period is requested or a longer period is needed to establish, exercise or defend legal claims. Approved production files and revision records may be retained while repeat work remains reasonably expected. Financial records are normally retained for six years after the relevant accounting period. These periods apply where uploaded drawings, models, photographs, dimensions or project files contain personal data.
When both Analytics and Advertising are allowed, we also record the source, medium and campaign labels from a tagged link with the current tab session. These help distinguish paid-campaign visits from referring websites. They exclude advertising click references, full query strings and contact information. Campaign context ends with the tab session or after 30 minutes without measured activity and is cleared when consent is withdrawn. Restricted website and CRM traffic records expire after 90 days.
Meta (Facebook) advertising measurement
With your Advertising measurement consent, Meta Pixel measures visits and accepted project enquiries on Wood to Spec. Meta receives the event type, website address, browser information and advertising identifiers such as the Facebook click reference. First-party cookies such as _fbp and _fbc may be stored for up to 90 days. A Lead event is sent only for an accepted project enquiry, using a random enquiry identifier to prevent duplicates. This integration does not pass your name, email, enquiry text, files or other form answers to Meta. Automatic Advanced Matching and automatic event detection are disabled. Rejecting or withdrawing Advertising measurement consent stops this optional tracking and clears its first-party cookies. You can change your choice using Cookie settings. Our duplicate-prevention record expires after 90 days. Browser privacy signals override optional tracking. Existing visitors must make a fresh advertising choice before Meta loads.
Google Ads measurement
With your Advertising consent, we load the Google tag to measure advertising visits and accepted project enquiries. Google may store advertising click information in first-party cookies such as _gcl_aw for up to 90 days. A conversion is sent only after the enquiry service accepts a submission, with a random enquiry identifier to prevent duplicate counting. We do not send your name, email, enquiry text or files to Google through this integration. Enhanced conversions and advertising personalisation are disabled. Rejecting or withdrawing Advertising consent stops this optional measurement; you can change your choice using Cookie settings. Our duplicate-prevention record expires after 90 days.
Advertising measurement
With your Advertising consent, we use the OpenAI Pixel and server-side conversion delivery to understand whether advertising led to an accepted project enquiry. The Pixel may hash supported contact details in your browser for automatic advanced matching. The server event contains a pseudonymous enquiry identifier, time, page address and available click reference, not your enquiry text or files. See the cookie and measurement notice for details and controls.
Service providers and transfers
Hosting, email, file storage, security, payment, accounting, courier and measurement providers may process information on our behalf. Where information is transferred outside the UK, an appropriate legal transfer mechanism is used where required.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, and to receive certain information in a portable form. You may withdraw consent at any time without affecting earlier lawful processing.
Complaints
Please use the structured privacy-request route so the concern can be addressed. You may also complain to the UK Information Commissioner’s Office.
Changes
This notice may be updated when the service, providers or legal requirements change. The effective date above identifies the current version.