Privacy Policy

My Store (“we”, “us”, “our”) sells clothing online and is the data controller responsible for the personal information described in this policy.

• Contact: our contact page

We process personal data in line with the UK GDPR and the Data Protection Act 2018. If you shop with us from the EU, the EU GDPR applies to your data in the same way.

Information you give us

• Name, email address, delivery and billing address, telephone number
• Order details: the garments you buy, sizes, prices and order history
• Account details if you create one, including your password in encrypted form
• Messages you send us about sizing, an order, a return or a complaint
• Marketing preferences, if you subscribe to our newsletter

Information collected automatically

• Device and browser type, operating system, approximate location from your IP address
• Pages viewed, products viewed, items added to the basket and checkout steps reached
• Cookie and similar identifiers — see our Cookie Policy

Information from others

• Payment confirmation and fraud-screening results from our payment provider
• Delivery status from the carriers that ship your order
• Aggregated audience and campaign data from analytics and advertising partners

We never see or store your full card number. Card details are entered directly with our PCI-DSS compliant payment provider.

Where we rely on consent you can withdraw it at any time, and where we rely on legitimate interests you can object. Neither affects the lawfulness of anything we did beforehand.

We only send marketing emails if you asked us to, or if you bought from us and did not opt out when you ordered. Every email has an unsubscribe link, and you can also write to us at our contact page to stop at any time. Unsubscribing from marketing does not stop order and delivery emails, which we must send to complete your purchase.

We do not sell your personal information, and we never have.

• Payment providers — to take payment securely, screen for fraud and process refunds
• Delivery partners — name, address, email and phone number so your order can be delivered and tracked
• Our ecommerce platform and hosting providers — to run the store and store order data securely
• Email and customer service tools — to send transactional and, where you consented, marketing emails
• Analytics and advertising partners — where you have consented to analytics and marketing cookies
• Professional advisers, insurers, accountants and authorities — where the law requires it or to establish or defend legal claims

Each provider acts on our documented instructions as a processor, or as an independent controller where it is accountable for its own use of the data. All are bound by contracts that require appropriate security.

Some of our providers process data outside the UK. When that happens we rely on UK adequacy regulations, or on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with additional safeguards where needed, so that your data keeps an equivalent level of protection.

• Order and transaction records: 6 years after the end of the tax year in which the order was placed, as required by HMRC
• Account details: while your account is open, then up to 12 months after you ask us to close it
• Customer service messages: up to 24 months after the enquiry is closed
• Marketing consent records: until you unsubscribe, and a suppression record afterwards so we do not contact you again
• Analytics data: no longer than 26 months

Once a retention period ends we delete or anonymise the data.

The store runs over encrypted HTTPS connections, access to customer data is restricted to people who need it to do their job, passwords are stored hashed, and payment details are handled entirely by our payment provider. No system is perfectly secure, so if a breach ever affects your rights we will tell you and the Information Commissioner within the deadlines the law sets.

Under UK data protection law you have the right to:

• Be told how your data is used, which is the purpose of this policy
• Access a copy of the personal data we hold about you
• Have inaccurate data corrected
• Have your data deleted, where we have no overriding reason to keep it
• Restrict or object to how we use it, including objecting to direct marketing
• Receive your data in a portable, machine-readable format
• Withdraw consent at any time, where we rely on consent
• Not be subject to decisions made solely by automated means with legal effects

To exercise any of these, write to us at our contact page. We respond within one month and it is free of charge. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

We use cookies and similar technologies to keep your basket, secure checkout, measure how the store is used and, with your consent, show you relevant advertising. Full detail, the categories involved and how to change your choice are in our Cookie Policy.

Our store is intended for adults. We do not knowingly collect personal data from children under 16, and orders should be placed by someone aged 18 or over. If you believe a child has given us personal data, contact us and we will delete it.

We may update this policy as our shop, our providers or the law change. The date at the top of the page shows the current version. For anything about your privacy, write to us at our contact page.