Privacy Policy

Who We Are

Graftwork is a digital product business based in Worcester, UK. We sell workplace templates, trackers, guides, and tools for small manufacturers, sole traders, and operations teams.

What Information We Collect

We collect minimal personal data. Here is what we may collect and why:

• Purchase information — when you buy from our Gumroad store (graftwork.gumroad.com), Gumroad processes your payment and may share your name and email address with us so we can fulfil your order.
• Contact enquiries — if you contact us via the form on graftwork.uk or by email, we collect your name, email address, and the content of your message.
• Website analytics — we use Google Analytics to understand how visitors use our website. This collects anonymised data such as pages visited, time on site, and general location (country/region). No personally identifiable information is collected through analytics.

How We Use Your Information

We use the information we collect only for the following purposes:

• To deliver your purchase and provide customer support.
• To respond to enquiries or service requests.
• To understand how our website is used and improve it.

We do not use your data for automated decision-making or profiling.

Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:

• Contract — to fulfil your purchase or respond to a service enquiry.
• Legitimate interests — to understand website usage and improve our products and services.

Who We Share Your Data With

We do not sell or rent your personal data. We may share it with:

• Gumroad — our sales platform, which processes payments and manages digital product delivery. Gumroad's own privacy policy applies to data they hold.
• Google Analytics — anonymised website usage data only. No personal information is passed to Google through analytics.

No other third parties receive your personal data.

How Long We Keep Your Data

• Purchase records — retained for 6 years for accounting purposes (HMRC requirement).
• Contact enquiries — retained for 12 months, then deleted.
• Analytics data — retained by Google Analytics per their standard data retention settings.

Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate data.
• Request deletion of your data (where we have no legal obligation to retain it).
• Object to or restrict processing of your data.
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at graftwork.sales@gmail.com. We will respond within 30 days.

Cookies

Our website uses cookies via Google Analytics to collect anonymised usage data. These are analytics cookies only — we do not use advertising or tracking cookies.

You can disable cookies at any time through your browser settings. This will not affect your ability to use the site or make purchases.

Data Security

We take reasonable steps to protect the personal data we hold. Email communications are processed through Google's secure infrastructure. Our website is served over HTTPS.

No method of transmission over the internet is 100% secure. If you have concerns about a specific piece of data, contact us directly.

Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated date at the top. We recommend checking back periodically.

Contact Us

If you have any questions about this Privacy Policy or how we handle your data: