Legal
Privacy notice
Last updated: 29 October 2026
This notice explains what personal data Bio Willow Coffins collects through this website and its customer accounts, why, how long we keep it, who else handles it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is responsible for your data
The controller is Bio Willow Coffins Ltd, company number 12555225, registered office 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.
For anything about your personal data, write to info@biowillowcoffins.co.uk or call 07405 526255. We are a small business and have not appointed a data protection officer; your message will be read by the people who run the company.
2. The short version
- You can design a coffin without telling us who you are.
- If you open an account or order, we keep only what we need to run the account and make and deliver the coffin.
- Card payments happen on Stripe's page: we never see your card number.
- We use no advertising, analytics or tracking cookies; only the cookies the site needs to work.
- We do not sell your data or pass it to anyone for their own marketing.
3. What we collect
Visitors and saved designs
Using the configurator needs no account. If you save a design, we store your choices (model, size, colours, handles, lining, name plate wording and similar) under a code. A saved design holds no name, e-mail or price. Together with the design we store a scrambled fingerprint of your internet address, which cannot be read back as the address itself, to stop the service being abused.
Private customers
Your first name, last name, telephone number and e-mail address, the date you accepted this notice, whether you asked for our news, the delivery addresses you save, the designs in your account, and your orders.
Funeral directors
Your name, business name and address, e-mail and telephone, and, if you give them, your Companies House number, VAT number and NAFD or SAIF membership number; the date you accepted this notice and whether you asked for our newsletter; the result of the check of your trade account (approved, pending or refused, by whom and when); any trade discount; your delivery addresses, saved designs (with any reference you add, such as your file number) and orders.
Orders and payments
For each order: the design, the prices, the delivery address and contact for delivery, the delivery date and the funeral date if you give it, any notes, the order status, and the payment status and reference returned by Stripe (with Stripe's receipt link). We do not receive or keep card numbers.
Log-in and security records
One-time log-in codes are stored only as a one-way fingerprint, never as the code itself. We record when an account logs in and key actions in a security log (for example an approval or a change of details), with a scrambled fingerprint of the internet address. We also count attempts per e-mail address and per connection to stop automated abuse; these counters use fingerprints, not the addresses themselves.
When you contact us
If you phone or e-mail us, we keep what you tell us for as long as it is needed to answer you and deal with any order it concerns.
4. Where the data comes from
- Mostly from you, when you register, save a design, order or contact us.
- From a funeral director, when they order a coffin for a family or enter delivery details.
- From Stripe, which tells us whether a payment succeeded.
- To check trade registrations, we keep a list of funeral businesses with their business contact details. If you are on that list and have questions about it, contact us.
5. What we use it for, and our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Opening and running your account, sending log-in codes, showing your prices | Contract: needed to provide the account you ask for |
| Taking, making, delivering and supporting your order; e-mails about its progress | Contract |
| Checking that a trade applicant is a funeral business before showing trade prices | Legitimate interests: protecting our trade pricing and preventing misuse |
| Saving and sharing designs by code, link and QR code | Legitimate interests: providing the feature you asked for, without needing an account |
| Keeping order and payment records for tax and accounting | Legal obligation |
| Security logs, rate limits and preventing fraud or abuse | Legitimate interests: keeping the site and our customers safe |
| Sending our newsletter or news | Consent, which you can withdraw at any time |
| Dealing with complaints and legal claims | Legitimate interests; legal obligation where it applies |
A trade request whose e-mail address is on our list of funeral directors is approved automatically once the address is confirmed. When there is no match, a person at Bio Willow Coffins reviews the request. No request is refused by a machine.
6. Details about the person who has died
An order may include a name for the name plate, a funeral date or notes about the funeral. Data protection law covers living people only, but we treat these details with the same care: we use them only to make and deliver the coffin and keep them with the order record.
7. E-mails and the newsletter
We send e-mails that are part of the service: log-in codes, confirmation of registration, approval of a trade account, and messages about your orders. You cannot switch these off while you have an account or an open order, because the service does not work without them.
We send news or a newsletter only if you ticked the box when you registered. Every newsletter has a way to stop it, or you can write to us. We send it from info@biowillowcoffins.co.uk.
8. Who else handles your data
We use a few service providers who process data on our instructions and under contract:
- Stripe, for card payments. On the payment page, Stripe collects your card details directly and also acts as a controller for its own legal duties, such as fraud prevention; see Stripe's own privacy notice.
- Aruba S.p.A., which hosts this website and its database.
- Our e-mail provider, which sends and stores our e-mails (Aruba S.p.A., Italy).
- Delivery: the delivery address and contact are given to whoever makes the delivery (our own staff or a carrier we choose).
We may also share data with our accountant or legal advisers, or with authorities when the law requires it. If a funeral director orders a design that a family saved, the funeral director sees the design but none of the family's account details.
9. Data held outside the UK
Our website and database are hosted by Aruba in Italy, in the European Economic Area. UK law recognises the EEA as giving adequate protection, so no further safeguards are needed. Stripe may process payment data in other countries, including the United States, under safeguards recognised by UK law, such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.
10. How long we keep it
| Data | How long |
|---|---|
| One-time log-in codes | Valid for 10 minutes; deleted within a day of expiring |
| Log-in sessions | Up to 30 days, or 7 days without a visit; deleted after they end |
| Attempt counters for rate limits | About 2 days |
| Saved designs | The code works for 12 months; the design is then deleted automatically within 30 days, unless it is saved in an account or used for an order |
| Account details | While the account is open; deleted or anonymised when you ask us to close it, except what we must keep with orders |
| Orders, payments and related e-mails | Six years after the end of the financial year of the order, for tax and accounting |
| Trade requests that were refused, and the security log | A refused trade request: 12 months after the decision, then deleted. The security log: 24 months |
| Newsletter consent | Until you withdraw it, and a record of the withdrawal after that |
11. How we protect it
Accounts and payments work only over an encrypted (HTTPS) connection. Accounts use one-time codes sent by e-mail instead of passwords, codes and session tokens are stored only as fingerprints, internet addresses are not stored in readable form, and the number of attempts is limited. Staff have their own separate log-in. No method is perfect; if a breach puts you at risk, we will tell you and, where required, the ICO.
12. Cookies and browser storage
We use only cookies that are strictly necessary for the site to work, so we do not ask for consent and show no cookie banner. There are no analytics, advertising or social media tracking cookies, and no third-party scripts that set them. The links to our Facebook and Instagram pages are plain links.
| Name | What it does | How long |
|---|---|---|
bwc_user | Keeps you logged in to your account | Up to 30 days |
bwc_login_user | Remembers which address a log-in code was sent to while you type it | 15 minutes |
bwc_v | Security cookie that protects forms against forgery | Until you close the browser |
bwc_staffs, bwc_login_staff | The same, for our staff only | Hours |
On the live site the names may start with __Host-, a browser security feature. The configurator also uses your browser's own storage: it checks briefly that storage works (the test entry bwc_cm_probe is removed at once), and, during a visit, it can remember a design code you are adding to an account (bwc_trade_design_code, cleared when the tab is closed). When you pay, Stripe's payment page sets its own cookies under Stripe's control.
13. Your rights
You have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected (you can change most details yourself in your account);
- have your data deleted, unless we must keep it, for example order records for tax;
- ask us to restrict how we use your data while a question about it is resolved;
- object to our use of your data where we rely on legitimate interests;
- receive the data you gave us in a common electronic format, or have it sent to someone else;
- withdraw consent to the newsletter at any time, without affecting what was done before.
To use any of these rights, write to info@biowillowcoffins.co.uk. It is free, and we will reply within one month. We may need to confirm your identity first, normally by writing to the e-mail address on your account.
14. Complaints
If you are unhappy with how we have handled your data, please tell us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
15. Changes to this notice
If we change how we use personal data, we will update this page and its date. If a change matters to you, for example a new service provider for your data, we will also tell account holders by e-mail.
See also: Terms and conditions · Cancellations, returns and faults