Privacy Notice

Version: 1.0
Issued: 14/05/2026

Maintaining your privacy and your trust is very important. We strive to be especially clear on how we use your personal information if and when we collect it, and on the ways in which we can work together to protect your privacy.

This document is for compliance with Data Protection and Privacy legislation.

This Privacy Notice explains the:

• Identity and contact information of the data controller
• Legitimate interests of the data controller or third party, if applicable
• Purpose of the processing and the lawful basis for the processing
• Categories of personal data to be processed
• Details of whether personal data came from direct or indirect sources
• Recipients or categories of recipients of the personal data
• Details of data transfers to a third country and safeguards
• Length of time personal data is processed and any criteria used to establish the length of time the data is processed
• Data Subject’s rights, also referred to as your rights
• Right to complain to the supervisory authority/regulator
• Details of any statutory or contractual requirement and possible consequences of failing to provide the personal data
• The existence of any automated decision-making, including profiling, and information about how decisions are made

---

What products and services are covered by this notice?

This Privacy Notice applies to the information that we may obtain from you through your use of our website, when placing an order, when contacting us, or personally when visiting us.

This includes information collected in relation to:

• Browsing our website
• Purchasing furniture or related products
• Requesting product information
• Contacting us by email, telephone, contact form or social media
• Arranging delivery
• Managing returns, refunds, repairs or replacements
• Subscribing to marketing communications
• Visiting us in person, where applicable

These are collectively called the “Services”.

If you have any questions or need more information about these Services, please contact us using the details in the Contacting Us section below.

---

Data Controller

For the purposes of Data Protection and Privacy legislation, the Data Controller is:

Devon Oak Direct
“I”, “we”, “us”, “our”

Legal Status: Private Limited Company

Registered Number: 17120630
Website: devonoakdirect.com

---

Contacting Us

If you have any questions about our website, our services or this Privacy Notice, please contact us:

By email: info@devonoakdirect.com
By post: Arlington Cottage, Shebbear, Beaworthy, Devon, EX21 5 SA

By telephone: 01237 725673

---

Data Protection (Charges and Information) Regulations 2018

Where required, we are registered with the Information Commissioner’s Office.

ICO registration reference: [Add ICO registration number if applicable]

---

Purpose and our legitimate interest

How do we use the information we collect?

We may use the information we collect for a variety of purposes, including to:

• Provide you with the products, services or information that you have asked for
• Process and fulfil customer orders
• Arrange delivery of furniture and related products
• Keep a general record of your relationship with us
• Send you correspondence and communicate with you in relation to our products and services
• Maintain purchase or account history
• Process financial and payment details
• Keep records of enquiries, orders, returns, refunds, complaints and decisions
• Meet our legal, tax and accounting obligations
• Protect our intellectual property rights
• Prevent and detect fraud
• Protect your vital interests, where necessary
• Respond to or fulfil any requests, complaints or queries that you may have
• Understand how we can improve our website, products, services and information
• Generate reports on our work, sales and service performance
• Safeguard our customers, suppliers, visitors and contractors
• Maintain records for general business management
• Send marketing communications where you have consented or where otherwise permitted by law

---

Lawful Basis of Processing

General Personal Data

We may process general personal data under one or more of the following lawful bases:

1. Contract

Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract.

This applies where we process your details to provide a quote, process an order, arrange delivery, handle a return, issue a refund, or provide customer support.

2. Legal Obligation

Processing is necessary for compliance with a legal obligation to which the controller is subject.

This may include keeping accounting records, meeting HMRC requirements, complying with consumer protection rules, responding to lawful requests, or meeting health and safety obligations.

3. Legitimate Interests

Processing is necessary for the purposes of recognised legitimate interests, including crime prevention and detection, safeguarding, emergencies, public task disclosure, and national security or defence where applicable.

Processing may also be necessary for the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests, rights or freedoms of the data subject.

Our legitimate interests may include operating our ecommerce business, managing customer relationships, improving our website, responding to enquiries, handling complaints, preventing fraud, protecting our business, and marketing similar products or services to existing customers where legally permitted.

4. Vital Interests

Processing is necessary in order to protect the vital interests of the data subject or another natural person.

This would usually only apply in an emergency.

5. Consent

The data subject has given consent to the processing of his or her personal data for one or more specific purposes.

This may apply to email marketing, optional cookies, or any other processing where we specifically ask for consent. Consent can be withdrawn at any time.

---

Special Category Personal Data

We do not normally collect special category personal data as part of our standard website and ecommerce services.

Special category personal data may include information about health, race or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, sex life or sexual orientation.

If we ever need to process special category personal data, we will only do so where a lawful basis and a valid special category condition applies, such as:

• Processing is necessary for carrying out obligations and exercising specific rights in the field of employment, social security or social protection law
• Processing is necessary for preventive or occupational medicine, assessment of working capacity, medical diagnosis, provision of health or social care, or management of health or social care systems and services
• Explicit consent has been given for one or more specified purposes
• Processing is necessary for the establishment, exercise or defence of legal claims, or whenever courts are acting in their judicial capacity

---

Categories of personal data and sources

What information do we collect from you, and how is it used?

Direct

You can visit our website without telling us who you are and without revealing personal information about yourself.

To provide our full service, however, and if you contact us directly by other means, we will often need to collect some personal information.

For instance, we may collect information about you when you:

• Place an order
• Complete an online form
• Create or modify an account
• Contact us by email or telephone
• Request product information
• Subscribe to marketing
• Arrange delivery
• Request a return, refund or replacement
• Visit us in person, where applicable

The types of information we collect may include:

---

Children

Our website and services are intended for adults.

We do not knowingly collect personal information from children. If we become aware that a child has provided personal information to us, we will take reasonable steps to delete it.

---

Indirect

From cookies

We may also collect “cookie” information that we save to your computer or electronic device.

Cookies help our website function correctly and improve your online experience. They may be used for shopping basket functionality, checkout, analytics, website performance, marketing and remembering your preferences.

If you do not accept cookies, you may not be able to use all functionality of our online services.

For specific information on cookies, please read our Cookie Policy.

---

Logs

We may record certain information and store it in log files when you interact with our website or services.

This information may include:

• Internet protocol address, also known as IP address
• Device addresses or ID numbers
• Browser type
• Internet service provider
• URLs of referring and exit pages
• Operating system
• Date and time stamp
• Information you search for
• Locale and language preferences
• Mobile carrier, where applicable
• System configuration information

This information helps us monitor website performance, maintain security and improve our services.

---

Analytics

We and our analytics providers may collect and store analytics information when you use our website.

This helps us understand how visitors use our website and how we can improve our services.

Analytics information may include:

• Pages visited
• Products viewed
• Time spent on the website
• Browser and device type
• General location information
• Referral source
• Website errors or performance data

Where possible, we ensure analytics data is anonymous or aggregated by not connecting analytics data directly to personally identifiable data such as a name, email address, physical address or phone number.

---

Social media

There may be instances where our website features social sharing buttons or links to social media platforms.

These help users share website content directly from our pages to the relevant social media platforms.

You use social sharing buttons at your own discretion and accept that doing so may publish content to your social media profile, feed or page.

You should review the privacy and cookie policies of the relevant social media platforms for more information.

---

Public sources

Personal data may be obtained from public sources, such as:

• Companies House
• Public business directories
• News articles
• Sanctions lists
• Public registers
• Internet searches
• Public social media pages

This would usually apply to business contacts, suppliers, contractors or professional relationships.

---

How might we share information?

We are not in the business of selling your personal information.

We consider this information to be a vital part of our relationship with you. There are, however, certain circumstances in which we may share your personal information with third party data processors or other organisations, as set out below.

---

Payment Processing

We use third-party service providers to manage online payments and billing.

These service providers are not permitted to store, retain or use billing information except for the purpose of payment processing, fraud prevention, refunds, chargebacks and meeting legal or regulatory obligations.

We do not store your full card details or banking information on our website systems.

---

Delivery and courier providers

To fulfil your order, we may share relevant personal information with delivery and courier providers.

This may include:

• Name
• Delivery address
• Telephone number
• Email address
• Delivery instructions
• Order details required for delivery

This is necessary so your order can be delivered and so the delivery provider can contact you if required.

---

Where we are required to do so under statutory obligation

We may share personal information where required with:

• HMRC
• Accountants
• Solicitors
• Insurers
• Professional service organisations
• Regulators
• Courts
• Law enforcement agencies
• Other public authorities where legally required

---

Compliance with laws and law enforcement requests; protection of our rights

We may disclose your information, including your personal information, to a third party if:

• We believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process or governmental request
• It is necessary to protect the security or integrity of our products, website or services
• It is necessary to protect our property, rights and safety, or that of our customers or the public, from harm or illegal activities
• It is necessary to respond to an emergency which we believe, in good faith, requires us to disclose information to assist in preventing death or serious bodily injury of any person
• It is necessary to investigate and defend ourselves against any third-party claims or allegations

---

Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, restructuring, or acquisition of all or a portion of our business to another company.

Where appropriate, we will notify you of such a change in ownership or transfer of assets by posting a notice on our website.

---

Data Processor Information

All data processors acting on behalf of the data controller are required to have appropriate safeguards in place.

Processors are only permitted to process personal data in accordance with our instructions, for the purpose of providing services to us, and in line with applicable data protection legislation.

Examples of processors may include:

• Website hosting providers
• Ecommerce platform providers
• Payment providers
• Delivery and courier systems
• IT support providers
• Email and marketing platforms
• Analytics providers
• Review platforms
• Accounting software providers
• Security and fraud prevention providers

---

Data Transfers

We store your data on secure servers located in the UK or EEA where possible when you interact directly with us.

We take appropriate organisational and technical measures to protect the personal information we hold. We limit access to personal information to those who reasonably need to come into contact with that information in order to carry out their day-to-day activities.

Some third-party service providers may process personal data outside the UK or EEA, including in the United States.

Where restricted international transfers take place, appropriate safeguards will be used where required. These may include:

• UK International Data Transfer Agreement
• UK Addendum to the EU Standard Contractual Clauses
• Adequacy regulations
• The Data Bridge – UK Extension to the EU-U.S. Data Privacy Framework
• Other legally recognised transfer safeguards

Where relevant, third-party providers may be certified under the Data Bridge – UK Extension to the EU-U.S. Data Privacy Framework.

---

How long will we keep the personal data?

Retaining some data may be subject to a statutory retention period, and this must be adhered to where applicable.

This may include personal data such as:

• Name
• Address
• Contact details
• Order records
• Invoice details
• Payment records
• Delivery records
• Complaint or dispute records

We will keep personal data only for as long as necessary for the purpose it was collected, including to meet legal, accounting, tax, contractual, customer service and business record requirements.

For example:

• Order and invoice records may be retained for accounting and tax purposes
• Customer service and complaint records may be retained while they remain relevant
• Marketing records may be retained until you unsubscribe or withdraw consent
• Website analytics may be retained in anonymised or aggregated form
• Delivery and order records may be retained to support warranty, returns or dispute handling

On expiry of any statutory or business requirement, personal data will be securely deleted, anonymised or destroyed where appropriate.

Where possible, personally identifiable data will be anonymised or pseudonymised.

---

Statutory or other requirements

The data controller may process personal data as part of a statutory requirement and/or as part of any contractual agreement.

Not supplying required personal data may affect the provision of the controller’s services.

For example:

• We need your name and contact details to respond to an enquiry
• We need your billing and delivery address to fulfil an order
• We need contact details to provide order updates
• We need payment information to complete a transaction
• We may need to keep accounting records to meet legal obligations

If the required personal data is not provided, we may be unable to process your order, arrange delivery, respond to your enquiry, issue a refund or provide our services.

---

Profiling and Automated Decision Making

No profiling or automatic decision-making processes are undertaken by the data controller in respect of personal data processing activities that produce legal or similarly significant effects.

We may use basic website analytics, advertising audiences or customer segmentation to understand website performance, improve our services and show relevant marketing, but this does not involve automated decisions that have a legal or similarly significant effect on you.

---

Your rights

Your fundamental rights as a Data Subject are:

• The right to be informed
• The right of access
• The right of rectification
• The right of erasure, often known as the right to be forgotten
• The right to prevent or restrict processing
• The right to data portability
• The right to object
• Rights in relation to automatic decision-making and profiling
• Right to complain

Under the right of access, you have the right to have:

• Confirmation that your data is being processed
• Access to your personal data
• Other supplementary information

This allows you to be aware of and verify the lawfulness of the processing.

Your right to access can be exercised by contacting the data controller using the contact details above.

Not all fundamental rights are absolute. Some rights only apply in certain circumstances, and we may need to retain certain information where we have a lawful reason to do so.

---

Complaints

You have the right to complain about organisations processing your personal data.

You can raise a complaint with us directly about how we process your personal data by contacting us using the details above.

We will acknowledge receipt of the complaint within 30 days.

Or

You can exercise your right to make a complaint to the Information Commissioner’s Office as follows:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Alternative telephone: 01625 545 745

Please note that in most cases the Information Commissioner may ask you to raise a complaint with us first.