Privacy Policy

Effective 26 August 2026.

WoodWay Expert supplies European hardwood — veneer, edge-glued panels, boards and related products — to manufacturers in the United States and elsewhere. This website is a catalog and inquiry site for business customers. It does not sell online: there is no checkout, no customer account, and we never ask for or receive payment card details here.

This policy explains what we collect when you browse the site or send us an inquiry, why we collect it, who it is shared with, how long we keep it, and what rights you have. It applies to woodway-expert.com and to the inquiries we receive through it.

The short version

  • We collect what you type into an inquiry form, plus technical information your browser sends with it.
  • We do not sell or rent personal information, and we do not use it for advertising or profiling.
  • There is no online checkout, no customer account and no payment data on this site.
  • Your quote list stays in your own browser until you choose to send it to us.
  • We ask before switching analytics on, and nothing reaches Google unless you accept.
  • You can ask us for a copy of your information, ask us to correct it, or ask us to delete it.

Who we are

WoodWay Expert (“we”, “us”, “our”) operates this website and decides how the personal information described here is used. In data protection terms we are the controller.

Privacy questions and requests about your own information should go to [email protected].

Information you give us

Every form on this site — the contact form, the callback request and the quote request — sends its contents to our sales team. Depending on the form, it collects:

  • Your name and telephone number. These are required on every form.
  • Your email address, on the contact and quote forms.
  • Your message, if you write one.
  • A file you attach, if you choose to — for example a drawing or specification. Attachments are limited to 5 MB.
  • The product you were looking at, and, if you have built a quote list, the products on it with the quantity and unit you entered.

Please send only what is needed to answer your inquiry. Do not attach documents containing information you would not want to travel by email, and do not send us special categories of personal data such as health or identity documents — we have no use for them.

Information collected automatically

When you submit an inquiry we record the following alongside it, so that we can route it, understand its context and tell genuine inquiries from automated ones:

  • the IP address the inquiry came from;
  • your browser’s user-agent string;
  • which language version of the site you were using;
  • the page the form was on;
  • an approximate location — city, region and country — worked out from the IP address.

The approximate location is obtained by sending the IP address to ipapi.co, a geolocation service. Only the IP address is sent; your name, message and contact details are not.

Separately, our web server keeps access logs of every request to the site, containing the IP address, the date and time, the address requested, the response code, the referring page and the user-agent string. These are ordinary server logs, used for security and troubleshooting. They are rotated automatically and are normally kept for about 90 days.

We also keep a running count of visits by country and city, resolved by Cloudflare. It is a total that many visits share — no address, session or identifier is stored, and it cannot be traced to you.

Cookies and similar technologies

This site sets no cookies of its own for ordinary visitors. That is deliberate: pages are served from a cache that will not store a response carrying a cookie. Members of our staff who sign in to the site’s administration area receive the usual WordPress session cookies, which are necessary for signing in.

The following third-party services may set cookies in your browser:

  • Google Analytics — sets cookies beginning _ga to measure how the site is used. These typically expire after two years. No analytics cookie is written unless you accept: nothing is stored on your device until you choose “Accept analytics” on the notice shown on your first visit. Google’s script does load on every page, with analytics storage switched off by default. If you decline, or simply ignore the notice, nothing is stored on your device, but Google still receives an anonymous record of the visit — your country, device type, browser and how you arrived. It is not linked to you, sets nothing on your device, and is not used for advertising.
  • Cloudflare — our security and delivery provider may set cookies such as __cf_bm and cf_clearance to distinguish people from automated traffic. These are used for security and expire within about a day.
  • Cloudflare Turnstile — the anti-spam check on our forms, which may store a short-lived token while it verifies the submission.

You can change your choice at any time using the “Cookie settings” link at the bottom of any page, which brings the notice back. Your choice is remembered in your own browser and is not sent to us.

The Cloudflare items above are not optional and are not covered by that choice. They are what tells a genuine buyer from an automated one, and a contact form with its anti-spam check switched off is not a service anyone asked for. That is the distinction the ePrivacy rules draw between strictly necessary and optional storage.

We also use two things that are stored in your browser but are not cookies: your quote list, described below, and a hidden timestamp recorded when a form is drawn on screen. The timestamp lets us tell a person filling in a form from a script submitting it instantly; it contains nothing about you.

Our fonts are served from our own server, so displaying this site does not involve a request to a font provider.

Your quote list stays in your browser

When you add products to your quote list, the list is saved in your own browser’s local storage. It is not sent to us and we cannot read it. It becomes information we hold only at the moment you submit the quote request form, and only then does it reach our sales team. You can empty the list at any time by removing the items, or by clearing site data in your browser.

Why we use your information, and our legal basis

Where the General Data Protection Regulation applies, we rely on the following legal bases:

  • To answer your inquiry and prepare a quotation — because it is necessary to take steps at your request before entering into a contract, and because we have a legitimate interest in responding to people who contact us.
  • To keep a record of every inquiry, so that none is lost if email delivery fails — our legitimate interest in running the business reliably.
  • To keep the site secure and free of automated abuse — our legitimate interest in protecting the site and our staff from spam and attack.
  • To measure how the site is used — your consent, where consent is required for analytics in your country.
  • To meet legal, tax and accounting obligations — compliance with a legal obligation.

Where we rely on legitimate interests, we have considered whether those interests are outweighed by your rights, and you may object at any time as described under “Your rights”.

Who your information is shared with

We do not sell, rent or trade personal information, and we do not disclose it for anyone else’s advertising. An inquiry you send reaches the following recipients, each of which processes it on our behalf or as part of delivering the service named:

  • Google — our business email runs on Google Workspace, so the inquiry email itself is delivered and stored there.
  • Google Sheets — inquiries are also written to a spreadsheet we use as a working log, through a Google Apps Script.
  • Telegram — a notification containing the inquiry is sent to the sales team’s Telegram so that it is seen quickly.
  • Our own CRM — the inquiry is stored in a customer relationship system that runs on our own server, not on a third-party platform.
  • Cloudflare — all traffic to this site passes through Cloudflare, which provides security filtering and content delivery, and which therefore sees the technical details of your request.
  • Google Analytics — usage measurement, as described above.
  • ipapi.co — receives the IP address only, to return an approximate location.
  • Our hosting provider — operates the servers on which the site and its data run.

We may also disclose information where we are required to by law, or to establish or defend legal claims, or as part of a sale or reorganization of the business — in which case the recipient would be bound by this policy.

International transfers

We are based in Ukraine, and the services listed above are operated from the United States and the European Union. Your information will therefore be transferred outside your own country, and, if you are in the European Economic Area or the United Kingdom, outside that area.

Where such a transfer takes place, we rely on the safeguards permitted by applicable law, such as the European Commission’s standard contractual clauses or the recipient’s certification under an approved framework. You may ask us for details of the safeguards that apply to a particular transfer.

How long we keep it

  • Inquiries and the correspondence arising from them — 24 months from our last contact with you, unless we are in an ongoing business relationship, or unless tax, accounting or legal obligations require us to keep records for longer.
  • Attachments you send — delivered with the inquiry email; the temporary copy on the web server is removed once the message has been sent.
  • Server access logs — about 90 days.
  • Analytics data — retained according to the settings in Google Analytics, by default 14 months.
  • Blocked spam submissions — we keep only a count of how many were rejected. The submissions themselves are not stored.

How we protect it

The site is served only over an encrypted connection. Access to inquiry records is limited to the members of staff who need it, and the administration area requires a password to reach. Application logs are stored outside the area the web server will serve, and automated traffic is filtered before a submission is accepted. No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we take these measures seriously and review them.

Your rights

If you are in the European Economic Area or the United Kingdom, you have the right to ask us to: give you a copy of the personal information we hold about you; correct it if it is wrong; delete it; restrict how we use it; provide it in a portable form; or stop using it where we rely on legitimate interests. Where we rely on consent, you may withdraw it at any time, without affecting what we did before you withdrew it.

If you are in Ukraine, you have the equivalent rights under the Law of Ukraine “On Personal Data Protection”, including the right to know who holds your data, to access it, and to require its correction or deletion.

To exercise any of these rights, email [email protected] and tell us what you would like us to do. We may need to ask you for information to confirm who you are, so that we do not disclose your data to someone else. We will respond within 30 days, and will tell you if we need longer.

If you are not satisfied with our answer, you may complain to a data protection authority. In the European Economic Area or the United Kingdom this is the supervisory authority for the country you live or work in. In Ukraine it is the Ukrainian Parliament Commissioner for Human Rights.

Notice for residents of California

In the 12 months before the date of this policy we have collected the following categories of personal information from visitors to this site: identifiers, such as your name, email address, telephone number and IP address; commercial information, such as the products you inquired about; internet activity, such as the pages you visited and your browser type; and approximate geolocation derived from your IP address. We collect it from you directly when you submit a form, and automatically from your browser, for the business purposes described in this policy.

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16.

You have the right to know what we have collected, to request that we delete or correct it, and not to be discriminated against for exercising those rights. Make a request by emailing [email protected].

Children

This is a site for businesses buying wood materials in commercial quantities. It is not directed at children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has sent us information, write to us and we will delete it.

Automated decision-making

We do not make decisions about you by automated means that produce legal effects or similarly significant effects. Our forms do apply automated spam filtering, which can result in a submission being rejected; if that happens to you, please email or telephone us using the details above and we will deal with your inquiry directly.

Changes to this policy

If we change how we handle personal information we will update this page and change the effective date at the top. Where a change is significant we will say so on the page. Please check back from time to time.

How to contact us

For any question about this policy, or to exercise your rights, write to [email protected] or to WoodWay Expert, 17 Dniprovska Naberezhna St, Kyiv, 02081, Ukraine.