Last updated: 11 November 2026
This policy explains how Mulberry Workshop Ltd collects, uses and protects personal data when you visit our website, contact us, or work with us as a client or supplier.
Mulberry Workshop Ltd (“Mulberry Workshop”, “we”, “us”) is the controller of the personal data described in this policy. We are a CNC routing and bespoke fabrication business.
For any question about this policy or your personal data, including any request to exercise your rights, please email info@mulberryworkshop.com.
We collect only the information we need to respond to enquiries, deliver our work and run our business.
| Who | What we collect | Where it comes from |
|---|---|---|
| Website visitors who contact us | Name, email address, phone number and the content of your message | Our website contact form |
| Clients and potential clients | Name, job title, company, business email address, phone number, delivery or site address, project details, quotes, invoices and correspondence | You, your colleagues, or someone who recommended us |
| Suppliers and contractors | Name, company, business contact details, invoices and correspondence | You or your company |
| Website visitors | Technical information, such as IP address and browser type, recorded in our website host’s server logs | Your browser |
| Anyone who messages us on social media | Your profile name and the content of your message | Instagram, Facebook or LinkedIn |
We do not collect special category data (such as health information) and we do not knowingly collect data about children. Our services are for businesses and organisations.
UK data protection law requires us to have a lawful basis for each use of your personal data.
| Purpose | Lawful basis |
|---|---|
| Responding to your enquiry and preparing quotes | Legitimate interests (responding to business enquiries), or steps taken at your request before entering a contract |
| Designing, making, delivering and installing your project | Performance of a contract |
| Managing our relationships with suppliers and contractors | Performance of a contract, or legitimate interests (running our business) |
| Invoicing, accounting and keeping financial records | Legal obligation |
| Keeping in touch with existing and past clients about relevant work | Legitimate interests (developing our business) |
| Running and securing our website | Legitimate interests |
| Handling complaints, disputes and legal claims | Legitimate interests (protecting our business) |
Where we rely on legitimate interests, we have considered your rights and expectations, and only use your data in ways you would reasonably expect from a business you deal with.
We do not currently send marketing emails or newsletters. If we start doing so, we will update this policy and give you a clear way to opt out. We do not sell your data, and we do not use it for automated decision-making or profiling.
We use trusted service providers to run our business. They process personal data only on our instructions and are required to keep it secure.
| Provider | What they do for us |
|---|---|
| Gandi | Email and domain name registration |
| Elementor | Website hosting, including the contact form submissions stored on our website |
| Cloudflare | Website security and performance, provided through our website host, including protecting the site from malicious traffic and bots |
| Documents and file storage (Google Docs and Google Drive) | |
| Xero | Accounting and invoicing |
| Telesma | Client and supplier contact management |
| Couriers and delivery partners | Delivering your order, where you have asked us to |
| Our accountant and professional advisers | Accounting, tax and legal advice |
We may also share personal data where the law requires it, for example with HM Revenue & Customs, or to protect our legal rights.
International transfers. Some of these providers may store or access data outside the UK. Where they do, we rely on the safeguards provided by UK law, such as UK adequacy regulations or the International Data Transfer Agreement, to make sure your data stays protected.
Our building. Our workshop is located at Make North Docks, which operates CCTV throughout the building. That CCTV is run by Make CIC, not by Mulberry Workshop, and Make CIC is responsible for the footage it records.
| Type of data | How long we keep it |
|---|---|
| Client and supplier records, quotes, invoices and related correspondence | 6 years after our last transaction with you, to meet tax and accounting requirements |
| Website enquiries that do not lead to work | 12 months from your last contact with us |
After these periods, we securely delete the data or make it anonymous.
We use password-protected accounts, secure (encrypted) connections to our website and service providers, and lock screens on devices used for work. Access to personal data is limited to the people at Mulberry Workshop who need it.
Our website does not use advertising or analytics cookies, and it does not load tracking from third parties such as Google or Meta. We only use cookies that are strictly necessary for the website to work and to keep it secure, so we do not need to ask for your consent. These are security cookies set by Cloudflare to protect the site from malicious traffic and bots (__cf_bm, _cfuvid and cf_clearance), and cookies set when our team logs in to manage the site.
Links on our website to Google Maps, Instagram, Facebook and LinkedIn take you to those services, whose own privacy and cookie policies apply. If we ever add non-essential cookies, we will ask for your consent first and update this policy.
Under UK data protection law, you have the right to:
To use any of these rights, email info@mulberryworkshop.com. We will respond within one month. There is normally no charge.
If you are unhappy with how we have handled your personal data, please contact us first at info@mulberryworkshop.com and we will try to resolve it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk or on 0303 123 1113.
We may update this policy from time to time, for example if we start sending marketing emails. The date at the top of this page shows when it was last updated.