Privacy policy

Last updated 4th October 2026.

This notice explains how we use personal data when you browse our shop, place an order, sign up to hear when we open, apply through our supplier form, or email or call us. It also covers the business contact details of people at suppliers, wholesalers, carriers and other businesses we get in touch with, and what you can do about any of it.

Who we are

Yard & Field is a trading name of West Park Labs Ltd, a company registered in England and Wales with company number 17490221. Our registered office is Lytchett House, 13 Freeland Park, Wareham Road, Poole, Dorset, BH16 6FA. West Park Labs Ltd is the controller of the personal data described here.

You can contact us about anything in this notice at hello@yardandfield.co.uk or by post at the address above.

If you'd rather not hear from us

Reply to any email from us saying so, or email hello@yardandfield.co.uk. We'll stop straight away and add your address to our do-not-contact list, so we don't get in touch again.

Orders

What we collect:

When you order: your name, delivery and billing addresses, email address, phone number, what you bought and what you paid, and any notes you add, such as delivery instructions.
When you pay: Shopify Payments handles your card. We see the card type, the last four digits and whether the payment went through, never the full card number.
If you create an account: your login details and order history.
If you sign up for our emails in the shop: your email address, when you signed up and what you agreed to.

Why we use it, and our lawful basis:

To take, deliver and support your order, including returns and refunds: to perform our contract with you (UK GDPR Article 6(1)(b)).
To keep tax and accounting records: because the law requires it (Article 6(1)(c)).
To prevent fraud and keep the shop secure: our legitimate interests (Article 6(1)(f)).
To send you offers and news of new ranges: your consent, which you can withdraw at any time with the unsubscribe link in every email (Article 6(1)(a)).

If you sign up to hear when we open

Our sign-up box asks for your email address. We store it with the date and time you signed up, whether you ticked the box for offers and new ranges, and which version of the sign-up wording you saw, so we can show what you agreed to.

Everyone who signs up gets one email from us when our first ranges go on sale. If you didn't tick the box, that's all: we delete your address once that email has gone, or after 12 months if we haven't opened by then. If you ticked it, we'll also send you occasional offers and news of new ranges, and keep your address until you unsubscribe. After that we keep only your address and the date you unsubscribed, so nobody can sign you up again, unless you ask us to delete that too. Every email we send has an unsubscribe link.

Our lawful basis is your consent (UK GDPR Article 6(1)(a)), and you can withdraw it at any time. We never share or sell your address. Cloudflare stores the list for us. To have your address deleted, email us at hello@yardandfield.co.uk.

Suppliers and trade contacts

What we hold and where it comes from:

Your name, job title and the business you work for.
Your business email address and phone number.
What we've said to each other: emails, voicemail messages, quotes and trade terms.

We collect these from the places a business publishes them: your company's own website, trade directories and exhibitor lists, and the Companies House register. After that, from what you send us.

If you apply through our supplier form at forms.yardandfield.co.uk, we collect what you enter there, from you: your business's name, company number and website, your name and email address, your answers about your range, deliveries and product data, and anything else you write. Cloudflare stores each application for us until we copy it into our own records, usually within a day, and then it's deleted from Cloudflare.

Why we use it, and our lawful basis: we use your details to ask about your products, prices and trade terms, to set up and run a trading relationship if we both want one, and to keep a record of who has asked us not to get in touch.

Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)). Our interest is finding suppliers and running a business with them. We only use business contact details, only for that purpose, and you can object at any time. Where we end up trading together, some records are kept because the law requires it (Article 6(1)(c)).

If you email or call us

We hold your name, contact details and what you write or say, including voicemail messages, so we can reply. If it's about an order, our lawful basis is our contract with you (UK GDPR Article 6(1)(b)). Otherwise it's legitimate interests (Article 6(1)(f)): answering the people who get in touch.

Counting page views

When you browse the shop, Shopify records your device and browser details, IP address, the pages you visit and what you put in your basket, to run the shop and protect it from fraud. Shopify also measures how the shop is used and shows us the figures.

We also count visits with Matomo, which we run ourselves on our own server in the UK, only to see in total how the shop is used so we can improve it. Our own counter on the shop pages sends us the page's address and title and the site that sent you here, and sets no cookie. From your IP address and browser we make a visitor code that changes every day, and we shorten your IP address to its network before anything is kept, so the records don't identify you and are never used for advertising. Cloudflare holds each page view for us, under its data processing terms, until our server collects it, usually within minutes.

The law lets us count visits this way without asking first, as long as we tell you and make it easy to stop (the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025). To stop it, send a Global Privacy Control or Do Not Track signal from your browser, or block scripts from yardandfield.co.uk; the counter then sends nothing. Our lawful basis is legitimate interests (UK GDPR Article 6(1)(f)): knowing, in totals, how the shop is used so we can improve it.

Cookies

Shopify sets cookies to keep your basket, run the checkout, remember your choices and protect the shop from fraud. These are strictly necessary and don't need your consent.

Shopify also sets cookies that measure how the shop is used and help with advertising, from your first visit. You can block or delete them at any time in your browser's settings; the shop still works without them.

Our sign-up and supplier application pages, at forms.yardandfield.co.uk, load Cloudflare Turnstile, a security check that keeps spam off their forms. To run it, Cloudflare processes information about your browser and device on those pages. Cloudflare is our processor for the check itself, and a controller when it uses that information to improve its bot detection; its Turnstile privacy addendum explains how. The check is strictly necessary to protect the forms, and our lawful basis is legitimate interests: keeping them secure.

Who we share it with

We don't sell your details or pass them to anyone for their own marketing. We share what is needed with:

Shopify, which runs our online shop, checkout and payments, and stores your order details for us. Shopify acts as our processor for running the shop. The Shopify company we contract with is Shopify International Limited in Ireland, which may pass data to Shopify Inc. in Canada and to Shopify's sub-processors.
Shopify, as a controller in its own right, where it uses data for its own purposes: Shop Pay and the Shop app if you choose them, and fraud checks and services that use data from our shop alongside data from other shops that use Shopify and from Shopify itself, to provide analytics, product customisation and advertising services (Shopify's Network Intelligence). Shopify's own privacy policy explains how: https://www.shopify.com/legal/privacy
Payment processing: Shopify Payments and its payment partners, which process your card to take payment and check for fraud. For UK shops these are Stripe Payments Europe, Limited for cards, and PayPal UK Ltd or Adyen N.V. for some other methods. They process your payment data for us through Shopify, and may also use it as controllers in their own right, for example for fraud and anti-money-laundering checks.
The supplier of your item. Many products are sent direct by the supplier, including through Shopify Collective. We pass the supplier your name, delivery address, contact details and the items ordered. It uses them only to deliver your order and handle any return, under Shopify Collective's terms.
Delivery carriers and couriers, which get your name, delivery address, phone number and sometimes your email address, so they can deliver and send updates.
Cloudflare, which hosts our domain and our forms site, runs the spam check on our supplier form and sign-up box, holds applications until we copy them, stores our sign-up list and holds page views until our server collects them.
Our email, office, mail-handling and phone providers, which hold our correspondence, post and voicemail for us, and software providers that help us draft and organise our correspondence.
Our accountant, HMRC and others where the law requires it, and our professional advisers if we need them to protect our rights.

Some of these providers process data outside the UK, including in the EU, Canada, the United States and other countries where Shopify's group companies work. Where they do, the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), by standard contractual clauses with the UK's International Data Transfer Addendum, or by the UK's International Data Transfer Agreement. You can email us for a copy of the safeguards that apply.

How long we keep it

Orders, payments and refunds: six years after the end of the accounting period they belong to, which is how long we must keep tax records.
Emails and messages from customers, shoppers and the public: up to two years after our last contact, then deleted, or as long as the order record they belong to.
Accounts: until you ask us to close yours, with the order records kept as above.
Email sign-ups in the shop: until you unsubscribe. After that we keep only your address and the date you unsubscribed, to avoid emailing you again, unless you ask us to delete that too.
Sign-ups to hear when we open: until our opening email has gone, or 12 months if we haven't opened by then; if you ticked the box for offers and new ranges, until you unsubscribe, then only your address and the date you unsubscribed, so you aren't signed up again.
Supplier enquiries and applications that don't lead anywhere: up to two years after our last contact, then deleted.
If we trade together: for as long as we do, then six years, which is how long business and tax records must be kept.
Page views counted by Matomo: 25 months, then deleted, leaving only totals that don't identify anyone.
Our do-not-contact list: for as long as we trade, holding only your email address, name and business, so we can keep honouring your request.

Automated decisions

We don't make decisions about you that have legal or similarly significant effects by automated means alone. Shopify Payments may block a payment it judges a high fraud risk before an order is placed. Orders that are placed are never cancelled automatically: Shopify's fraud checks may flag an order, and we review a flagged order ourselves before deciding.

Automated checks screen the supplier form and the sign-up box for spam. If they stop you, you can send the same details by email instead.

Your rights

You can ask for a copy of the personal data we hold about you, and ask us to correct it, delete it or restrict how we use it. You can object to our using it, and ask for data you gave us in a portable format. Email hello@yardandfield.co.uk; we reply within one month.

You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Changes

We update this notice when our use of your data changes, and show the date at the top. If a separate company takes over Yard & Field, we will update this notice to name it, and the records described here will move to that company for the same purposes.