Privacy

Who's responsible

Mill & Merchant is operated personally. For data-protection questions, email hello@millandmerchant.co.uk.

What I collect — and why

• Directory & marketplace: business and listing details you submit, account-related metadata needed to run the platform, and messages sent through enquiry forms.
• Website contact: name, email, subject choice, and message body — only to reply to you and improve the service where relevant.
• Newsletter: email (and optional name if you gave it), stored with the email provider (Resend) to send the digest and honour unsubscribes.
• Technical logs: hosting and analytics may record IP address, device type, and pages viewed — used for security, debugging, and aggregate traffic understanding.

Lawful bases: contract / legitimate interests for running the site; consent where you opt in (e.g. newsletter); legal obligation where applicable.

Enquiries

When you contact a merchant through the directory or marketplace, your message and contact details are shared with that business so they can respond. I don't sell that data. Retention is kept only as long as needed to handle the thread or meet legal record-keeping.

Find a Timber Specialist

When you submit an enquiry through the Find a Timber Specialist service, I collect your name, email, phone (if provided), postcode, location, and project description. This information is stored securely and used to identify a suitable independent timber specialist.

Who sees your data: your enquiry details are reviewed by me personally. If I identify a suitable specialist, I may share your name, contact details, and project description with that specialist so they can respond to you. I will not share your information with anyone without your explicit consent (given via the consent checkbox on the form).

Retention: enquiries not actioned within 90 days are archived or deleted. Spam or rejected enquiries are purged within 30 days. You can request deletion of your data at any time by emailing hello@millandmerchant.co.uk.

Lawful basis:consent (you tick a box before submitting) and legitimate interests (connecting you with a specialist you've asked to be matched with).

Newsletter

Sign-up is opt-in. Every email includes an unsubscribe link; you can also ask me to remove you manually. If you re-subscribe later, that's a fresh opt-in.

Cookies & analytics

I use cookies or similar technologies only where needed for the site to function and for privacy-respectful analytics (aggregate traffic — not invasive ad tracking). You can control cookies in your browser.

Your rights (UK GDPR)

You can request access, correction, deletion, restriction, or portability of your personal data, and object to certain processing. Contact me at the address above. You can also complain to the ICO — but please try me first; I actually answer.

International transfers

Some processors (e.g. email or hosting) may store data outside the UK. Where that happens, I rely on appropriate safeguards such as UK adequacy decisions or standard contractual clauses.