Privacy Policy

Last updated: August 2026

This policy explains what data we collect when you use thenewforest.co, how we use it, and your rights under UK data protection law.

The data controller is The Burley Trading Co Ltd, registered in England and Wales (No. 17061537). You can contact us at [email protected].

Contact form

When you submit an enquiry through this site, we collect your name, shop or business name, town or village, email address, and any message you include. This data is transmitted to and stored by Formspree, a third-party form processing service. We use this information solely to respond to your enquiry. We do not add you to any mailing list without your explicit consent.

The lawful basis for processing this data is legitimate interests: you have contacted us with a trade enquiry and we have a legitimate interest in responding to it.

We retain enquiry data for as long as it is relevant to an ongoing or potential business relationship, and no longer than three years from the date of submission.

Analytics

We use PostHog to collect anonymous analytics about how this site is used. This includes pages visited, time on page, device type, and approximate location derived from IP address. We do not use cookies for analytics. Data is processed on PostHog's EU infrastructure and is not used to identify individual visitors.

The lawful basis for this processing is legitimate interests: understanding how our site is used helps us improve it for trade buyers visiting the site.

Cookies

This site does not set analytics or tracking cookies. We use session memory only, which is cleared when you close your browser tab. No data is stored on your device beyond what your browser requires to load the page.

If you use The New Forest Co Portal (our stockist portal), a persistent device identifier is stored in your browser's local storage (localStorage). This identifier is required by HMRC's Making Tax Digital fraud prevention regulations and is a legal obligation. It cannot be opted out of if you use the portal to submit VAT returns via Making Tax Digital.

Third-party links

This site links to third-party websites including 1percent.gives and Instagram. We are not responsible for the privacy practices of those sites.

Stockist portal (The New Forest Co Portal)

We operate a trade stockist portal that allows wholesale customers to manage orders, view stock, and access account information. When you use the portal, we process the following data:

  • Authentication data: You sign in using your Microsoft account. We receive your name and email address from Microsoft solely to authenticate your session. We do not store your Microsoft password.
  • Session data: We maintain a secure session to keep you signed in during your visit.
  • Business contact and sales data: We hold your business name, contact details, delivery addresses, and trading history in order to provide the portal service and manage our wholesale relationship.
  • Order and stock data: We process order history, product preferences, and stock allocation data as part of delivering the portal service.
  • Device identifier: A persistent device identifier is stored in your browser's local storage. This is required for HMRC Making Tax Digital fraud prevention compliance (see below) and constitutes a legal obligation under HMRC MTD regulations.

The lawful bases for processing portal data are:

  • Contract performance: Processing your orders, managing stock, and providing account access are necessary to perform our contract with you as a wholesale customer.
  • Legitimate interests: Maintaining accurate trading records and improving the portal experience.
  • Legal obligation: Collecting the device identifier and associated fraud prevention headers as required by HMRC MTD regulations.

Making Tax Digital (HMRC VAT)

We use HMRC's Making Tax Digital (MTD) API to submit VAT returns and access VAT liability and payment data. In connection with this:

  • VAT data accessed: We access VAT obligation periods, liabilities, and payment records via the HMRC MTD API. This data is used solely for VAT compliance purposes and is not retained beyond operational need.
  • OAuth tokens: We store encrypted OAuth tokens that authorise access to HMRC's MTD API on your behalf. These tokens are held securely and used only to make authorised API calls.
  • Fraud prevention headers: HMRC's MTD regulations require us to transmit certain fraud prevention information with every API call. This includes a device identifier stored in your browser's local storage, your IP address, browser details, and a timestamp. Collection of this data is a mandatory legal obligation under HMRC MTD fraud prevention regulations and cannot be waived.

The lawful basis for processing MTD-related data is legal obligation: HMRC requires submission of fraud prevention headers as a condition of accessing the MTD API, and VAT submission is itself a statutory requirement.

Your rights

Under UK GDPR you have the right to access, correct, or request deletion of any personal data we hold about you. To exercise any of these rights, email us at [email protected]. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk.

Changes to this policy

We may update this policy from time to time. The date at the top of this page reflects the most recent revision.