Privacy Policy

The data controller is JMB JOINERY & BUILDING SERVICES LTD (trading as Grainwork), 82 Windsor Square, Penicuik, Scotland, EH26 8ET, United Kingdom. You can reach us about privacy at support@jmbjoinery.shop or +44 7654514034.

We sell white-label desk, workspace and maker goods and ship them worldwide. This policy applies to this website and to orders, accounts and support handled through it.

We collect only what we need to run the store:

• Order and delivery data: name, email, phone (optional), your shipping address (delivery address) and billing address, and the items ordered — used for order fulfilment.
• Account and membership data: email, membership tier and status, and saved bench lists if you create them.
• Support and enquiry data: the details and messages you send through our contact and bulk-order forms.
• Payment metadata: confirmation of payment, amount and last-four/brand from our payment processor. We never receive or store your full card number.
• Technical data: IP address, device and browser type, and essential cookies needed for the cart and checkout.

We use the following collection sources, and no others:

• Directly from you: what you type into the checkout, contact and bulk-order forms, including your shipping address, and what you tell our support team.
• Automatically from your device: IP address, device and browser type, and essential cookies set when you browse, collected as you use the site.
• From our payment processor (Stripe): payment confirmation metadata such as result, amount, card brand and last four digits — never your full card number.
• From our delivery carriers: dispatch, tracking and delivery-status updates relating to your parcel.

We do not buy personal data, and we do not collect it from data brokers, social networks or other third-party lists.

• To fulfil your order — process payment, ship goods and handle returns (performance of a contract).
• To provide accounts and membership — manage your tier, benefits and saved lists (contract).
• To answer enquiries — respond to contact and bulk-order messages (legitimate interests / pre-contract steps).
• To improve and secure the store — prevent fraud and keep the site working (legitimate interests).
• To send service updates — order and delivery notifications (contract). Marketing email is sent only with your consent and you can opt out at any time.
• To meet legal duties — tax, accounting and consumer-law records (legal obligation).

Because we ship physical kits, order fulfilment is the main reason we handle your data. This is how each part is used:

• Shipping address: your shipping address is used to pick, pack, label and deliver your order, and to work out shipping cost and any import duties. It is shared with the delivery carrier handling your parcel and is not used for marketing.
• Order fulfilment records: the items, quantities, prices, order number and dispatch status are kept so we can fulfil the order, prove what was sent, and honour warranty and consumer-law obligations.
• Delivery carriers: we pass your name, shipping address and (where needed) phone or email to the parcel carrier so they can deliver and notify you. Carriers act as separate controllers for their own delivery records.
• Returns and exchange support: if you return a kit, we process your order number, contact details, return address and the reason for return to authorise the return, arrange collection or refund, and log quality issues.
• Payment and billing data: your billing address and payment confirmation metadata (amount, result, card brand, last four digits) are handled to take payment, match it to your order, issue refunds and meet tax and accounting duties. We never receive or store your full card number.

See our Shipping & Delivery Policy and Refund & Return Policy for the operational detail.

We share data only with the processors that help us run the store, under contract:

• Payments: Stripe processes card payments and the membership customer portal. Stripe receives the data needed to take payment; we do not receive your full card number.
• Hosting and infrastructure: our website host and serverless platform, which stores order and account records securely.
• Database and authentication: our managed database provider, which stores order, account and enquiry records.
• Email and delivery: our transactional email provider and the shipping carriers used to deliver your order.

We do not sell your personal data.

We ship worldwide, so some processors may handle data outside your country, including outside the UK and EEA. Where that happens we rely on appropriate safeguards such as UK/EU adequacy decisions or standard contractual clauses to protect your data.

We keep order and tax records for as long as required by law (typically up to six years for accounting). Enquiry and marketing-lead data is kept for up to 24 months and then deleted or anonymised. Account data is kept while your account is active and removed on request, subject to legal retention duties.

Depending on where you live you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data or complete incomplete data.
• Delete your data ("right to be forgotten"), subject to legal retention.
• Restrict or object to certain processing, including direct marketing.
• Port your data to another provider.
• Withdraw consent at any time where processing relies on consent.

California residents may also request the categories and specific pieces of personal information collected, and may opt out of any "sale" or "sharing" of personal information — see the next section. To exercise any right, email support@jmbjoinery.shop.

We do not sell your personal information and we do not share it for cross-context behavioural advertising. If this ever changes we will provide a clear "Do Not Sell or Share My Personal Information" control and honour opt-outs. You can contact us any time to confirm your preferences.

We use essential cookies for the cart, checkout and security. Any non-essential analytics are used only with your consent. See our Cookie Policy for the full list and how to control them.

Card payments are processed by Stripe on Stripe-hosted checkout. Your full card number is entered on Stripe's secure systems and is never transmitted to or stored on Grainwork servers. We receive only confirmation and limited metadata needed to fulfil and support your order.

Grainwork is not intended for children under 13, and we do not knowingly collect their data. Customers aged 13–17 must have guardian consent to order. We do not make solely automated decisions that produce legal or similarly significant effects about you; the Bench Builder gives general suggestions only.

We use encryption in transit, access controls and reputable processors to protect your data. No method of transmission is completely secure, but we take reasonable steps to keep your information safe and to notify you and regulators of any material breach as required by law.

Contact JMB JOINERY & BUILDING SERVICES LTD at support@jmbjoinery.shop for any privacy request. If you are in the UK or EEA and are unhappy with our response, you may complain to your local data protection authority (in the UK, the Information Commissioner's Office). Governing law: England and Wales.