Skip to content

Capital at risk. Physical gold and whisky casks are not regulated investments. The value of investments can go down as well as up. Past performance is not a guide to future performance.

Privacy

Privacy policy

What we collect, why we collect it, who we share it with, and how to ask us to stop.

Last updated 27 September 2026

Who we are

This is the privacy policy for oakandmason.co.uk. Oak & Mason Ltd is a company registered in England and Wales (company no. 14960471). Our registered office is at 1 Allied Business Centre, Coldharbour Lane, Harpenden, AL5 4UT. For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller for the personal data we collect through this site.

For anything privacy-related, write to admin@oakandmason.co.uk.

What we collect

  • What you give us through forms: names, email addresses, phone numbers, postcodes, and any free-text messages you choose to send. The free text might include your goals, budget ranges or background, depending on which form you use.
  • What we need to open and run your account: if you start an account, we collect identification documents, address verification and source-of-funds evidence. This is required by anti-money-laundering rules (MLR 2017) and is not optional.
  • Web analytics and session replay: we use PostHog (hosted in the EU) to log page views, click and scroll behaviour, and record anonymised session replays so we can see how people use the site and find faults. All form inputs are masked in replays: we never see what you type into a name, email, phone or message field, only that you typed something. PostHog sets a small number of cookies to keep your session consistent across pages.
  • Meta advertising measurement: we run the Meta (Facebook) Pixel, which records page views and form submissions and sends them to Meta so we can measure how our paid Facebook and Instagram campaigns perform. The Pixel sets a _fbp cookie on first visit.

Why and how

We collect data for the following reasons, each tied to a lawful basis under UK GDPR:

  • To send you the guide or information you asked for. Lawful basis: consent (you submitted a form asking for it).
  • To follow up on a question or enquiry. Lawful basis: legitimate interests (responding to your message).
  • To open and operate your account. Lawful basis: contract (we cannot run your account without it) and legal obligation (anti-money-laundering rules).
  • To improve the site. Lawful basis: legitimate interests (running and improving the service).
  • To measure paid advertising performance. Lawful basis: legitimate interests (understanding which Facebook and Instagram campaigns convert). You can opt out through Meta’s ad preferences page.

If we want to use your data for a new purpose that is not covered above, we will ask you first.

Who we share it with

We do not sell your data. We share it only with parties we need to share it with so that the service can work:

  • The HMRC-bonded warehouse holding your cask, so it can register the cask in your name.
  • The London vault holding your gold, so it can allocate the coins to you on its inventory.
  • Our payment provider, so payments can be processed.
  • HMRC, where the law requires it (anti-money-laundering, tax reporting).
  • Our IT and email providers, so the site can run and we can reply to you.
  • PostHog, our analytics and session-replay provider, hosted in the EU. It receives page-view, click and form-submission events and an anonymised session replay, with all form inputs masked.
  • Meta Platforms (Facebook), through the Meta Pixel on this site. Meta receives page-view and form-submission events tied to a browser-level identifier so we can measure the performance of our paid campaigns. You can opt out at facebook.com/adpreferences.

All of our processors are bound by data-processing agreements that meet UK GDPR standards.

How long we keep it

We keep enquiry data for up to two years after the last contact, in case you come back to us. Account data is kept for the life of your account and for six years after it closes, the period required by anti-money-laundering rules. Web analytics is anonymised after 14 months.

Your rights

Under UK GDPR you have the right to:

  • ask for a copy of the data we hold about you
  • ask us to correct anything that is wrong
  • ask us to delete your data, subject to legal retention
  • ask us to restrict how we use it
  • object to a particular use
  • ask for your data in a portable format
  • withdraw consent, where consent was the basis.

To use any of these rights, write to admin@oakandmason.co.uk. We aim to respond within five working days, and have one calendar month under UK GDPR to complete the request.

If you are not happy with how we have handled it, you can complain to the Information Commissioner’s Office at ico.org.uk.

Cookies

We use a small number of cookies for the site to work, for example to remember form progress. PostHog sets a few cookies to keep your session for analytics and replay. The Meta (Facebook) Pixel sets a _fbp cookie on first visit so we can measure how our paid Facebook and Instagram advertising performs. You can control cookies through your browser settings, and opt out of Meta’s advertising tracking at facebook.com/adpreferences.

Children

This site and our services are for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you think a child has submitted a form to us, write to admin@oakandmason.co.uk and we will delete it.

Changes

If we change this policy in any meaningful way, we will update the date at the top and tell anyone with an active account.

Contact

For anything privacy-related: admin@oakandmason.co.uk. For anything else: our contact page.

A question about your data?

Call us on 020 8103 7273, Monday to Friday, 9am to 6pm, arrange a fifteen-minute call at a time that suits you, or send a message. We reply to messages by email, usually within one working day.

Arrange a call Or send a message