Pocket Workshop Ltd · Last updated 1 November 2026
Privacy notice
Who we are
Pocket Workshop is a trade-only design and manufacturing service for bespoke cabinetry. This notice explains what personal information we collect about the people who use our website and our service, why we collect it, who we share it with and what rights you have.
The data controller is Pocket Workshop Ltd, a company registered in England and Wales (company number 16978923), registered office 71-75 Shelton Street, London WC2H 9JQ. We are registered with the Information Commissioner's Office (registration number ZC268737).
To ask anything about your information, email design@pocketworkshop.co.uk or message us on WhatsApp on 0330 303 1303.
Our customers are businesses, but the information we hold about the people who work for or run them, including sole traders, is still personal information and is protected by UK data protection law.
What we collect
| Information | When we collect it |
|---|---|
| Business name, your title (optional), first name, surname, mobile number, email address, business address and postcode | When you set up an account |
| Confirmation that you are registering as a trade or business customer, and when you gave it | When you set up an account |
| Your password | When you set up an account or change your password. It is stored in scrambled (hashed) form by our sign-in provider; we cannot see it |
| Your account code, and which manufacturing partner we've allocated to you | When we approve your account |
| Sketches, photos, measurements, site details and other job information | When you send us a job by WhatsApp, email or through your account |
| Your quotes, orders, design packs and their status | As we work on your jobs |
| A record of each time you accept our terms: which quote, the price, the version of the terms, and the date and time | When you press Pay on a quote |
| When you authorise a design pack quote: the name you type, your email, whether you approved it or asked for changes and what they were, whether you want panels drilled, the price, the terms and declaration versions, and the date and time | When you authorise |
| Requests for a new quote and order cancellations, with the date | When you press the button |
| A new email address you ask to change to, kept for one hour until you confirm it | When you change your email |
| Messages you send us and our replies | When you contact us by WhatsApp, email or phone |
| Photographs of completed installations, and any credit you ask for | Only if you choose to send them to us. Please make sure no people, house numbers or personal items are visible. |
| Technical information such as your IP address and browser type, which Cloudflare processes to deliver and protect the website. Our own website does not record IP addresses | Automatically, when you use the website |
Payment details: card and bank details are handled entirely by our payment provider, Stripe, through our accounting system, Xero. We never see or store your full card details.
Where your data comes from
Most of it comes from you. To check you're a trade business, we may also look you up in public sources such as Companies House.
How we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Set up and run your account, and sign you in | Contract: needed to provide the service you asked for |
| Prepare quotes, produce designs, and pass manufacturing data to the factory once you approve a design | Contract |
| Record your acceptance of our terms for each quote, and your authorisation of each design pack quote | Contract, and our legitimate interest in being able to show what was agreed |
| Check that new accounts belong to genuine trade businesses before approving them | Legitimate interests: we only offer trade pricing to trade customers |
| Use your postcode to choose the manufacturing partner for your area | Contract |
| Tell us when you change your postcode, so we can check your manufacturing partner | Legitimate interests |
| Send you service emails: sign-in links, password resets, account approval and messages about your quotes and orders | Contract |
| Keep invoices and accounting records | Legal obligation |
| Keep the website secure and prevent misuse | Legitimate interests |
| Occasionally offer you a printed catalogue or tell you about new modules relevant to your work | Legitimate interests. You can ask us to stop at any time. We do not send marketing emails without your agreement |
| Use installation photographs you send us to promote Pocket Workshop on our website and social media | Legitimate interests: showing examples of finished work. You can ask us to stop using a photograph at any time. |
We do not sell your information, and we do not make decisions about you using solely automated processing.
Do you have to give us this information?
You need to give us your sign-up details to open an account, and your job details for us to quote and design. Without them we can't provide the service.
Who we share it with
We share information only where needed to run the service, with providers who act on our instructions and must keep it secure:
| Who | Why |
|---|---|
| Supabase | Stores your account and order information and runs sign-in |
| Cloudflare | Hosts the website |
| Netlify | Hosts the logo in our email signatures |
| Resend | Delivers the emails our website sends |
| Xero | Invoicing and accounting |
| Stripe | Takes card payments for our invoices |
| Namecheap (Private Email) | Our email: handles emails between you and us, and the alerts our website sends us |
| Google (Drive) | Stores job files and exported order messages |
| Apple (iCloud) | Holds an encrypted backup of our WhatsApp messages, which Apple cannot read |
| WhatsApp (Meta) | Carries messages if you choose to contact us that way, and handles your phone number on our behalf, under WhatsApp's own terms |
Xero, Stripe and WhatsApp also use some information for their own purposes, under their own privacy notices.
We also share information with:
- Our manufacturing partner. Once you approve a design, we send the manufacturing data for that job to the manufacturing partner allocated to you, with the contact and delivery details needed to make, deliver and invoice your order. Only the manufacturing partner receives your name and contact details.
- Hardware suppliers receive no personal information: only the hardware picking list for the job.
- Professional advisers such as our accountant and solicitor, where needed.
- Authorities where the law requires it.
- Anyone who visits our website or social media accounts, if we publish an installation photograph you sent us.
Information sent outside the UK
Some of our providers store or process information outside the UK. For each one, this is where, and the safeguard it relies on:
- Supabase: stores your account in London (eu-west-2). Supabase's data processing terms use the UK International Data Transfer Addendum to the EU standard contractual clauses.
- Cloudflare: processes website requests on its global network. Its data processing terms rely on the EU–US Data Privacy Framework and its UK Extension (the UK–US "data bridge"), and otherwise on the UK International Data Transfer Addendum.
- Resend: processes our emails in Ireland (eu-west-1). Resend states that it complies with the UK Extension to the EU–US Data Privacy Framework, and its data processing terms also use the UK International Data Transfer Addendum.
- Xero: its UK data processing terms use the UK International Data Transfer Addendum, and allow transfers to countries the UK recognises as adequate, such as New Zealand.
- Stripe: Stripe states that it complies with the UK Extension to the EU–US Data Privacy Framework.
- Netlify: its data processing terms rely on the UK Extension to the EU–US Data Privacy Framework, and otherwise on the UK International Data Transfer Addendum.
- Google (Drive): may store and process information in the United States and other countries. Google states that it complies with the UK Extension to the EU–US Data Privacy Framework and otherwise relies on standard contractual clauses with the UK Addendum.
- Apple (iCloud): holds an encrypted backup of our WhatsApp messages, which Apple cannot read. Apple Distribution International Limited in Ireland provides iCloud to UK users, and Apple generally stores data in the United States. Apple states that its international transfers of UK personal data are governed by standard contractual clauses.
- WhatsApp: WhatsApp LLC provides WhatsApp in the UK and uses Meta data centres in the United States and Singapore. For transfers from the UK it relies on the UK International Data Transfer Agreement and the UK Addendum to the EU standard contractual clauses.
- Namecheap (Private Email): our mailbox is hosted in the United States (Phoenix, Arizona). Namecheap's data processing terms include standard contractual clauses, with UK transfer clauses.
How long we keep it
| Information | How long |
|---|---|
| Sign-ups we decline, and accounts that are never activated | 12 months after our decision, then deleted |
| Accounts with no orders | 24 months after the account was last used, then deleted |
| Active account details | While your account is open |
| Quotes, orders, acceptance and authorisation records, our messages about the order (including exported WhatsApp chats), and the job files that go with them | 6 years after the order, for tax and legal purposes, then anonymised |
| Alert emails our website sends us, and routine messages not linked to an order, including WhatsApp chats | 12 months after we receive them, or after the last message in a WhatsApp chat |
| Installation photographs you send us | Until you ask us to stop using them |
| IP addresses | Our own website does not record IP addresses |
If you ask us to delete your information, we handle the request by hand and reply within one month. Records we must keep for tax and legal purposes are kept for the period above, then anonymised.
Cookies
Our website uses one cookie, and only once you sign in. It keeps you signed in to your account. It is strictly necessary for the account to work, so it does not need your consent.
| Cookie | Purpose | How long |
|---|---|---|
| pw_session | Keeps you signed in | 90 days if you tick "Keep me signed in", otherwise until you close your browser |
We also store one setting in your browser, not a cookie: a note that you've added the site to your home screen, so we don't show the tip again. It holds no personal information.
We do not use analytics, advertising or tracking cookies.
Your rights
You have the right to:
- ask for a copy of the information we hold about you
- ask us to correct anything that is wrong
- ask us to delete your information, where we no longer have a reason to keep it
- ask us to restrict how we use it, or object to us using it on the basis of legitimate interests
- ask for information you gave us in a format you can pass to someone else
- tell us to stop sending you anything about new products or catalogues
To use any of these rights, email design@pocketworkshop.co.uk. We will reply within one month.
If you're unhappy with how we've handled your information, email design@pocketworkshop.co.uk with "Data complaint" in the subject. We'll acknowledge it within 30 days, look into it, and tell you the outcome without undue delay. If you're still unhappy, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Other things to know
- Keeping it secure: your password is stored in hashed form and the website uses encrypted connections. Through the website, only you and we can see your account information. The providers listed above process it for us.
- Trade only: our service is for businesses and is not intended for anyone under 18.
- Changes: we will update this notice when the way we handle information changes. The date at the top shows the current version.
Pocket Workshop Ltd. Company no. 16978923. Registered in England and Wales. Registered office: 71-75 Shelton Street, London WC2H 9JQ.