Privacy Policy & Platform Disclosures

Effective Date

This policy took effect on November 12, 2026 (2026-11-12). All specifications, signal configurations, retention schedules, and disclosures detailed herein reflect the operational reality of Woodware as of this verified date.

Data Controller Identity

The data controller responsible for the processing of personal data through this website is Woodwaremvt, trading as Woodware at woodwaremvt.com.

Registered workshop premises and postal address: 1080 Route Seven South, Middlebury, Vermont 05753, Middlebury, Vermont, United States. Telephone dispatch line: 802-388-6297. Electronic communications: [email protected].

Categories of Data Collected

Woodware limits data collection strictly to what is required to manage custom woodwork inquiries, maintain workshop security, and attribute marketing campaigns. This site records no account registration credentials, collects no passwords, processes no payment card figures, and accepts no automated retail transactions.

Processing Purposes

Every category of data acquired through woodwaremvt.com serves a defined functional purpose:

• Inquiry Resolution: Evaluating workshop capacity, verifying lumber availability, computing custom dimensional quotes, and responding directly to inquiries submitted by prospective buyers.
• Workshop Visits: Scheduling direct tours and showroom consultations on the Middlebury workshop floor at 1080 Route Seven South.
• Infrastructure Integrity: Monitoring server access logs to protect shop systems against denial-of-service attempts, fraudulent automated bots, and malicious script execution.
• Campaign Measurement: Attributing incoming traffic accurately across paid search and social campaigns, evaluating which timber lines attract consumer interest, and preventing duplicate click costs.

Legal Bases for Processing

Processing activities are anchored in specific lawful grounds:

Advertising Platforms & Click Identifiers

This website is an active landing destination for paid marketing campaigns. We receive traffic directly from commercial ad networks. When a visitor reaches our website through a paid listing, the originating platform appends a unique alphanumeric query parameter to the URL:

Google Ads: Traffic routed from Google search and shopping campaigns carries the gclid (Google Click Identifier) parameter. This token correlates ad interactions with downstream workshop inquiries when consent is present.

Microsoft Advertising: Traffic originating from Bing search listings and Microsoft Merchant Center stores carries the msclkid (Microsoft Click Identifier) token to substantiate advertising reach and lead generation.

Meta Ads: Campaigns distributed across Meta technologies append the fbclid (Facebook Click Identifier) token to destination URLs for attribution modeling.

These click identifiers are handled strictly under client-side consent controls. We never claim or imply that any advertising platform has reviewed, endorsed, certified, or approved our products or this website.

Consent Mode v2 Technical Implementation

To maintain strict compliance with global privacy regulations and platform mandates, woodwaremvt.com implements Google Consent Mode v2 directly in the browser execution stream.

Before any visitor choice is recorded, the website sets default states denying all tracking parameters. Specifically, four standard signals remain in an explicit denied state:

• ad_storage='denied': Prohibits the reading or writing of cookies for advertising purposes.
• ad_user_data='denied': Prohibits the transmission of user-level data to advertising platforms.
• ad_personalization='denied': Prevents data use for personalized remarketing or custom audiences.
• analytics_storage='denied': Restricts analytical cookies and aggregated engagement logging.

Only when a visitor actively clicks the Accept control on our consent banner are these parameters updated to granted. If the visitor clicks Decline or later resets choices through the Cookie Settings control, all four parameters immediately revert to denied, terminating storage operations instantly.

Third-Party Data Processors

Woodware engages select third-party service providers to deliver hosting infrastructure, route communications, and measure advertising campaigns. Each entity processes data under contractually binding terms:

Cross-Border Data Transfers

Our primary servers and workshop premises operate in Middlebury, Vermont, United States. Visitors browsing from outside the United States understand that information submitted through our forms or chat widget will be transferred to and processed within the United States.

Where transfers involve individuals residing in the European Economic Area or the United Kingdom, transfers are supported by recognized lawful mechanisms, including European Commission Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements, or adequacy determinations under the EU-U.S. Data Privacy Framework.

Data Retention Schedules

We do not hold data indefinitely. In conformity with data minimization principles, Woodware enforces exact mathematical retention periods across all data categories:

Security Architecture

Woodware applies practical physical, technical, and organizational measures to safeguard consumer information. All communication between visitor browsers and our server is secured using Transport Layer Security (TLS 1.3) with 256-bit encryption.

Inquiry forms incorporate automated honeypot verification (department and homepage hidden fields) and strict timestamp thresholds to prevent automated script injection. Database servers are firewalled with restricted SSH public-key authentication, and workshop workstations are protected by hardware firewalls, disk encryption, and mandatory multi-factor authentication.

GDPR Individual Rights

For visitors located in the European Union, European Economic Area, or United Kingdom, the General Data Protection Regulation (GDPR) guarantees specific legal entitlements over personal data:

• Right of Access: You have the right to request a complete record of all personal data held concerning your identity.
• Right to Rectification: You may require us to correct inaccurate or incomplete contact details or specifications.
• Right to Erasure (“Right to be Forgotten”): You may demand the permanent deletion of personal records where processing is no longer necessary.
• Right to Restriction: You can limit how your data is processed during active disputes regarding accuracy or lawful grounds.
• Right to Data Portability: You may request personal data provided to us in a structured, commonly used, machine-readable JSON format.
• Right to Object: You possess the absolute right to object to processing founded upon legitimate interests.
• Right to Withdraw Consent: Where processing rests on consent (such as advertising attribution), you may withdraw it immediately using our cookie settings control.

US State Privacy Rights & CCPA Disclosures

Residents of California, Colorado, Connecticut, Utah, Virginia, and other states with comprehensive consumer privacy statutes enjoy statutory protections regarding their information. Pursuant to the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

Notice of Collection: We collect contact identifiers and commercial specifications exclusively to execute consumer inquiries and workshop consultations.

No Sale or Sharing of Personal Information: Woodware does not sell personal data for monetary remuneration. We do not share personal identifiers with data brokers. Advertising measurement operates solely under explicit user consent through platform conversion tags.

Consumer Rights: You hold the right to know what personal details have been gathered, request deletion of that data, correct factual errors, and receive equal service without discrimination for exercising privacy rights.

Global Privacy Control (GPC)

Woodware recognizes and respects the Global Privacy Control (GPC). If your browser or privacy extension transmits the Sec-GPC header, our consent engine reads this signal as an automatic, binding request to opt out of non-essential storage.

When a GPC signal is detected, tracking tags remain disabled, Consent Mode v2 flags stay fixed at denied, and no marketing cookies are placed on your machine, without requiring manual interaction with our consent banner.

Children’s Privacy Protection

Our website is intended strictly for adults seeking commercial hardwood homeware, custom turned wood products, or workshop visits. While we craft tumbled wooden children’s building blocks, those products are marketed solely to adult parents and institutions.

We do not intentionally or knowingly collect, solicit, or maintain personal information from individuals under sixteen years of age. If we learn that a minor under sixteen has submitted contact details via our forms, we will permanently delete those records immediately.

Regulatory Complaints

You hold the right to register a formal complaint regarding our data practices with relevant regulatory authorities.

In the United States, visitors may complain to their state Attorney General, including the Office of the Vermont Attorney General, and to the California Privacy Protection Agency (CPPA) in California. Governing law for our operations is the law of Vermont, United States, with disputes heard in the courts of Middlebury.

In the European Union, you may lodge a complaint with the supervisory authority of your EU member state of habitual residence or employment. In the United Kingdom, complaints may be submitted to the Information Commissioner’s Office (ICO).

Data Subject Access Request (DSAR) Protocol

To exercise your statutory rights of access, correction, deletion, or portability, submit a formal request to our Middlebury administration:

Please include “Data Subject Request” in the subject line, state the specific right you wish to exercise, and supply sufficient information to enable us to verify your identity. All data requests are acknowledged and answered within 7 days of receipt without assessment of administrative fees.

Policy Amendments

As workshop tooling evolves or ad platform technical requirements update, we may revise this policy. Material alterations will be published on this page with an updated effective date.

We encourage visitors to inspect this URL periodically. Continued use of woodwaremvt.com after modifications confirms acknowledgment of the revised provisions.

Direct Privacy Contact

Questions, feedback, or legal notices concerning this policy or our data handling practices should be addressed directly to our operational desk: