Plain-English summary of what I collect, why, and how to exercise your rights under UK GDPR.
Last updated: August 2026
Mill & Merchant is operated personally. For data-protection questions, email hello@millandmerchant.co.uk.
Lawful bases: contract / legitimate interests for running the site; consent where you opt in (for example the newsletter); legal obligation where applicable.
When you contact a merchant through the directory or marketplace, your message and contact details are shared with that business so they can respond. I don't sell that data. Retention is only as long as needed to handle the thread or meet legal record-keeping.
When you submit an enquiry through Find a Timber Specialist, I collect your name, email, phone (if provided), postcode, location, and project description. This is stored securely and used to identify a suitable independent timber specialist.
Who sees your data: I review the enquiry. If I identify a suitable specialist, I may share your name, contact details, and project description with that specialist so they can respond. I will not share your information with anyone without your explicit consent (the checkbox on the form).
Retention: enquiries not actioned within 90 days are archived or deleted. Spam or rejected enquiries are purged within 30 days. You can request deletion at any time by emailing hello@millandmerchant.co.uk.
Lawful basis: consent (you tick a box) and legitimate interests (connecting you with a specialist you asked to be matched with).
Sign-up is opt-in. Every email includes an unsubscribe link; you can also ask me to remove you manually. If you re-subscribe later, that's a fresh opt-in.
I use cookies only where needed for the site to function and for privacy-respectful analytics (aggregate traffic, not ad tracking). You can control cookies in . The cookie policy has the list.
The directory includes independent timber merchants and sawmills. Listing details are researched from public business sources — company websites, trade listings, and Companies House. We keep a note of where each contact detail came from and when.
Why I process this: to build and maintain an accurate public directory, and — occasionally — to let a business know its profile is listed so it can claim and correct it. Where I rely on legitimate interests, the interest is running an accurate UK timber directory; the invitation is factual, one-off, and always has a one-click opt-out.
Who gets contacted:only businesses that are verifiable corporate subscribers (e.g. a limited company or LLP confirmed on Companies House). Sole traders and ordinary partnerships are not emailed unless they have asked us to. If we hold a named person's work address, it is treated as personal data and this notice applies to it in full.
Your right to object: you can object to this use at any time. The fastest route is the opt-out page — one click, permanent, and it survives any future research on the listing. You can also email hello@millandmerchant.co.uk.
Retention: contact evidence is kept while the listing is in the directory and for audit purposes after that. Opt-out records are kept indefinitely — that is the point of them.
You can request access, correction, deletion, restriction, or portability of your personal data, and object to certain processing. Contact me at the address above. You can also complain to the ICO — but please try me first; I actually answer.
Some processors (email, hosting, Stripe) may store data outside the UK. Where that happens, I rely on appropriate safeguards such as UK adequacy decisions or standard contractual clauses.
Not legal advice — if you need a bespoke policy for your own business, speak to a solicitor. For anything about this site: hello@millandmerchant.co.uk.