Privacy Policy

The data controller is REGAN CARPENTRY AND BUILDS LTD (“Grovework”, “we”, “us”), registered at 8 St. Michaels Close, Walton-On-Thames, Surrey, KT12 3AJ, United Kingdom. For any privacy question or request, contact us at support@reganbuild.shop or +44 7749393583.

• Order and fulfilment data: name, email, phone, shipping address, billing address, items ordered, order value, delivery status, tracking reference and return or exchange history.
• Account and membership data: membership tier, subscription status and preferences.
• Support and enquiry data: messages you send via our contact and wholesale forms, including order references and information needed to handle delivery, returns, refunds or product-safety questions.
• Payment and billing data: Stripe or PayPal handles the payment details you submit when that method is offered. We receive confirmation and limited transaction details (such as payment status, card brand and last four digits where supplied) but never your full card number or security code.
• Technical and usage data: IP address, device and browser type, and essential cookie identifiers.

We do not collect identity documents, and we do not store full payment card numbers.

We collect personal data from the following sources:

• Directly from you: when you enter a shipping address or billing details at checkout, place an order, request a return, join a membership, complete a form, call us or email us.
• Automatically from your device: through essential cookies, security controls and server logs when you browse or use the store.
• From payment providers: Stripe or PayPal sends us payment status, transaction identifiers and limited billing metadata after it processes your payment.
• From delivery carriers: tracking updates, delivery attempts, address exceptions, loss or damage reports and proof-of-delivery information used for order fulfilment.

• For order fulfilment (contract): validate your shipping address, process payment, pick and pack goods, share necessary delivery details with a carrier, provide tracking, handle delivery issues, returns, exchanges and refunds, and provide order support.
• To run memberships (contract): manage your subscription and its benefits.
• To answer enquiries (legitimate interests / consent): respond to your messages and, where you started a checkout, follow up about your order.
• To meet legal duties (legal obligation): tax, accounting and consumer-law records.
• To secure and improve the store (legitimate interests): prevent fraud and keep the site working.

We share data only with the processors needed to run the store, and never sell it. These include:

• Hosting and deployment: our website and serverless hosting provider.
• Payment processing: Stripe or PayPal, where offered, which receives payment and billing data directly through its hosted checkout. Neither method gives us your complete card number or security code.
• Database and storage: our managed database provider, which stores orders, membership and enquiry records.
• Email delivery: our transactional email provider, used to send order and support messages.
• Delivery carriers: the carriers used for order fulfilment, which receive your name, shipping address, contact details, parcel information and delivery instructions only as needed to deliver and resolve shipment issues.

We may also disclose data where required by law or to protect our rights.

Some processors operate outside the UK or EEA. Where data is transferred internationally, we rely on appropriate safeguards such as UK/EU adequacy decisions or Standard Contractual Clauses, so your data keeps an equivalent level of protection.

We keep order and accounting records for as long as required by law (typically up to six years). Enquiry and checkout-lead data is kept for no longer than 24 months unless you become a customer. Membership data is kept while your subscription is active and for the retention periods above afterwards.

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data or complete incomplete data.
• Erase data where there is no ongoing legal reason to keep it.
• Restrict or object to certain processing, including direct marketing.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time where processing is based on consent.
• For California residents: know, delete, correct and opt out of “sale” or “sharing” of personal information, without discrimination.

To exercise any right, email support@reganbuild.shop. We respond within the time limits set by applicable law.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising. If this ever changes, we will update this policy and provide a clear opt-out mechanism first.

We use essential cookies to run the cart, checkout and admin session. Any optional analytics are covered in our Cookie Policy. We do not write long-term marketing cookies for form submissions.

We do not make solely automated decisions that produce legal or similarly significant effects about you. Our store is intended for adults. Anyone under 13 must not use it; those aged 13–17 must have a parent or guardian's consent, and sharp, hot or bladed items require adult supervision or purchase. We do not knowingly collect data from children under 13.

Payments are processed by Stripe or PayPal on that provider's secure checkout when the relevant method is offered. Grovework never receives or stores your full card number, CVC, PayPal login credentials or complete payment details. We receive only the transaction result and limited billing metadata needed for order fulfilment, support, refunds and disputes.

We use encryption in transit, access controls and reputable processors to protect your data. No method of transmission is completely secure, but we take reasonable steps to protect the information you provide.

Contact us first at support@reganbuild.shopand we will try to resolve any concern. UK and EEA residents also have the right to complain to their data protection authority (in the UK, the Information Commissioner's Office). This policy was last updated on 13 July 2026.