Privacy notice
The Timedrop Atelier
Last updated: 28 September 2026
I’m Sam, the maker behind The Timedrop Atelier. This notice explains how personal information is handled when you visit thetimedrop.watch, contact me or commission a piece. It covers website enquiries and correspondence by email, telephone and WhatsApp.
1. Who is responsible for your information?
The Timedrop Atelier is a trading name of NowDrive Distribution Limited, company number 16773068. NowDrive Distribution Limited is the business responsible for your personal information, known as the data controller.
When this notice uses “I” or “my”, it refers to how I handle information on the company’s behalf.
Privacy contact: Sam
Email: samuel.wojciak@gmail.com
Registered office and correspondence address: Unit 13, Liss Business Centre, Station Road, Liss, GU33 7AW, United Kingdom.
You can use these details for privacy questions, requests concerning your information or complaints.
2. What information I collect
Enquiries and commissions
The website enquiry form asks for your name, the type of piece, a message and at least one way to reply: an email address or telephone number. Providing both contact methods is optional. You can also select a project or Design Study as inspiration.
As a commission develops, I may need design wording, measurements, photographs or sketches, billing or delivery details, and records of quotations, approvals, payments and correspondence.
Most information comes from you. Someone commissioning a gift or arranging delivery may provide another person’s name, delivery details or relevant design information. Please provide only information needed for the commission and that you are entitled to share.
The public enquiry form does not accept photograph uploads. Photographs sent separately by email or WhatsApp form part of our correspondence. Please avoid sending unnecessary sensitive information or payment-card details.
You are not obliged to make an enquiry. However, without enough information about your request and a way to reply, I cannot progress it. Delivery and billing details may be needed to fulfil an order.
Payments and invoices
I currently accept bank transfers and cash, and issue invoices as PDFs. I use billing details and payment records to issue invoices, match payments to commissions and maintain accounts. There is no online card-payment facility on this website.
Website information
The website and hosting services process technical information such as IP addresses, requested pages, request details and security identifiers to operate and protect the service.
Selecting a project or Design Study can place its public reference in the page address, which may appear in browser history or hosting logs. The enquiry form does not deliberately put your name, contact details or message in the page address.
3. Why I use information and the legal bases
Contract: I use information necessary to discuss a quotation you request personally and to agree, make and fulfil your commission. This includes steps you ask me to take before entering a contract.
Legitimate interests: I use relevant information to answer other enquiries, communicate with business representatives, arrange delivery to a gift recipient, protect the website, provide aftercare and maintain necessary records for complaints or legal claims. These interests are balanced against your rights and reasonable expectations.
Legal obligations: I retain required accounting and tax records and handle applicable data-protection responsibilities.
Consent: I ask for separate permission to publish identifiable customer photographs, testimonials or case studies, as explained below.
I do not operate a newsletter. An enquiry or commission does not subscribe you to a mailing list or give permission for unrelated promotional messages.
Automated security checks may reject suspicious form submissions. Design discussions, quotations and commission decisions are handled by me, not solely by an automated decision-making system.
4. Services and people that handle information
I do not sell personal information or share it with unrelated businesses for their own marketing.
Relevant information is handled by the services used to operate the website and manage commissions:
| Service | Purpose |
|---|---|
| GoDaddy and its hosting/security services, including Cloudflare | Website hosting, delivery and protection against automated abuse |
| Google/Gmail | Enquiry and customer correspondence; my published contact currently uses a personal Gmail address |
| Google Drive through the company’s Google Workspace | Storage of customer photographs and relevant working files |
| Apple/iCloud | Storage, synchronisation or backup of customer photographs held on my phone |
| Messages and files you choose to exchange with me through that service |
Relevant information may also be shared with the company’s bank, delivery providers, accountant or other professional advisers where needed, and with authorities where disclosure is legally required.
I limit sharing to what is needed for the purpose. Providers may act on the company’s instructions or have their own responsibilities for parts of their services. Their applicable privacy and service terms also explain their handling of information.
5. AI-assisted design
I use OpenAI’s ChatGPT for general creative assistance using non-identifying descriptions of design requirements.
My customer-design workflow excludes customer messages, customer photographs, names, contact details, addresses and other identifying material from ChatGPT. This includes identifying wording on a sign. Rewriting information in my own words is not sufficient if it still identifies someone.
ChatGPT is not connected to the website enquiry form, and enquiries are not automatically sent to it.
6. Photographs, testimonials and showing my work
A sign or a photograph of its installation may identify a person through a name, address or recognisable location. Permission to make the piece does not automatically include permission to publish that information.
I ask separately before using identifiable customer material in my website, portfolio or social media, explaining the material and intended use. Publicity is optional and is not a condition of ordering. Where another person is identifiable, I do not assume the person placing the order can consent on their behalf.
You can withdraw permission by contacting me. I will stop the relevant future use and remove the material from online channels I control. Withdrawal does not make earlier permitted use unlawful. Copies already independently saved or shared by others may remain outside my control.
7. How long I keep information
I keep information only for as long as it is needed for its purpose, including relevant legal requirements, and remove unnecessary copies sooner.
| Information | Retention rule |
|---|---|
| Enquiries that do not become commissions, including associated photographs and mock-ups | Normally up to 12 months after our last substantive contact |
| Raw customer photographs and unused mock-ups for completed commissions | Normally up to 12 months after completion |
| Essential commission evidence, such as the agreed design, quotation, approvals and completion record | Normally up to six years after completion, where needed for aftercare or potential disputes; this does not extend to every draft or photograph |
| Accounting and tax records | Six years from the end of the last company financial year to which they relate, or longer where legally required |
| Identifiable portfolio material and testimonials | While the agreed permission remains valid and the material remains relevant, subject to periodic review and removal following withdrawal |
I keep only the permission or withdrawal records needed to demonstrate how publicity choices were handled. A legal obligation or a complaint or legal claim may require particular records to be retained longer; it does not justify keeping unrelated material indefinitely.
Technical records and recovery copies
The enquiry system’s short security lifetimes are described below. They are not the retention period for enquiry emails or customer correspondence.
Other technical records and recovery copies have service-dependent retention. Relevant criteria include security monitoring, investigating faults or incidents, restoring the service and meeting legal obligations. Provider-controlled logs and backups do not necessarily follow the enquiry plugin’s expiry times.
Deletion from active email, phone or cloud records does not necessarily remove every recovery or backup copy immediately. Such copies are subject to the relevant service’s deletion and backup cycles. I do not use recovery copies to extend the routine use of customer information; if a restore brings back information already due for deletion, I remove it again unless there is a valid reason to retain it.
Contact me for information about the retention arrangements relevant to your records.
8. Cookies and enquiry security
The enquiry form uses temporary security information to reduce spam, repeated submissions and misuse.
| Cookie | Purpose | Lifetime |
|---|---|---|
tda_enquiry_browser — this website |
A random security value binding form checks to your browser; issued through the form’s interaction/review process rather than an ordinary page visit. It does not contain your name, contact details or message. | 12 hours |
__cf_bm — Cloudflare through the hosting service |
May be set by the hosting security layer to help distinguish legitimate visitors from automated traffic. | Cloudflare specifies 30 minutes of continuous inactivity |
The enquiry system also uses 10-minute form credentials and 15-minute rate-limit windows. These are separate from the browser cookies. Server-side security markers have expiry and cleanup mechanisms; scheduled cleanup and backup removal may happen later than the configured validity period.
The enquiry plugin passes messages to the website’s email system. It does not create its own separate customer-message inbox in WordPress. Email infrastructure and hosting services still process information.
No advertising or audience-analytics scripts are included in the custom Timedrop theme or enquiry plugin. Hosting and security services still handle technical requests; this is not a claim that the hosting platform keeps no records.
You can manage cookies through your browser. Blocking security cookies may prevent the enquiry form or parts of the website from working. You can contact me by email instead.
Further details about the hosting cookie are available in Cloudflare’s cookie information.
9. Information processed outside the UK
Hosting, email, messaging and cloud-storage providers operate internationally. Information may be processed outside the UK, including in the European Economic Area and the United States.
Where UK international-transfer restrictions apply, the relevant transfer must be covered by UK adequacy regulations or appropriate safeguards. Depending on the service and destination, these can include recognised contractual protections such as the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses.
You can contact me for details of the providers, destinations and applicable arrangements relevant to your information, including how to obtain a copy of the relevant contractual safeguards. This notice does not promise UK-only storage.
10. Protecting information
I limit the information collected and who can access it, and use proportionate account, device and website security measures. No internet or storage system can be guaranteed completely secure.
Please contact me promptly if you believe information you supplied has been exposed or used improperly.
11. Your rights and complaints
Depending on the circumstances, you can ask to access your personal information, correct inaccuracies, have information deleted, restrict its use or receive certain information in a portable form. Some rights have legal limits; for example, necessary accounting records may need to be retained. I will explain any restriction that applies.
Your right to object
You can object to processing based on legitimate interests. I will consider your objection under the applicable rules. You have an absolute right to object to use of your information for direct marketing.
Withdrawing consent and making a request
You can withdraw consent at any time by contacting me. Withdrawal does not affect the lawfulness of earlier processing based on that consent.
Contact me using the details above. You do not need a special form or legal wording. I normally respond to rights requests without undue delay and within one month. Where the law permits an extension or further information is needed, I will explain this. Any identity checks will be proportionate.
Complaints
Please contact me with any concern about how your information has been handled. I will acknowledge a data-protection complaint within 30 days, investigate it, keep you appropriately informed and communicate the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator. See the ICO complaints information or telephone 0303 123 1113. Contacting me does not remove your right to complain to the ICO.
12. Changes to this notice
I will update this notice when relevant practices or legal requirements change. The date above shows the latest update. Where required, I will provide additional information before using personal information for a new purpose.