Privacy & Data Protection Policy

What information we collect

We only collect the information we need to process your orders and provide our service. Depending on how you use the site, this may include:

• Account details — if you create an account, we store your name, email address, mobile number and a securely encrypted (hashed) version of your password. We never store your password in plain text.
• Order & checkout details — your name, email, phone number, delivery or collection preference, and (for delivery orders) your delivery address.
• Order contents — the products, sizes, schools, personalisation and embroidery options you order, along with the order total and status.
• Payment information — payments are handled securely by our payment provider, Stripe. We never see or store your full card details on our servers.
• Communications — any messages, emails or enquiries you send us.
• Basic technical data — your browser stores your shopping basket locally on your own device; standard server logs may record your IP address and browser type for security and troubleshooting.

How we use your information

We use your personal data only for legitimate, clearly-defined purposes:

• To process and fulfil your orders — preparing your uniform, arranging collection or delivery, and keeping you updated on progress.
• To manage your account — allowing you to log in, view your order history and track order progress.
• To take payment securely — via Stripe, our PCI-compliant payment processor.
• To communicate with you — sending order confirmations, updates and responding to enquiries.
• To meet legal obligations — such as keeping records for tax and accounting purposes.

We do not sell, rent or trade your personal data to any third parties for marketing, and we will never send you marketing you have not asked for.

Our lawful basis for processing

Under UK GDPR we rely on the following lawful bases to process your data:

• Contract — we need your details to fulfil the order you have placed with us.
• Legal obligation — we must keep certain records (e.g. sales records) to comply with the law.
• Legitimate interests — to run our business securely, prevent fraud and improve our service, in a way that does not override your rights.
• Consent — where you have given us clear permission (for example, if you opt in to any updates), which you may withdraw at any time.

How we store and protect your data

Keeping your information safe is a priority. We take the following measures:

• Our website is served over a secure, encrypted HTTPS (SSL) connection.
• Account passwords are stored using strong one-way encryption (hashing) — they cannot be read or recovered by us.
• Order and account data is stored on secure, access-controlled hosting, restricted to authorised staff only.
• Card payments are processed entirely by Stripe; sensitive card data never touches our own systems.
• We limit access to personal data to only those who need it to fulfil your order.

Children's information

Because we supply school uniforms, orders may include details such as a child's clothing size or the school they attend. We only ever collect this in connection with a uniform order placed by a parent, guardian or responsible adult, we use it solely to fulfil that order, and we do not use children's information for any other purpose.

Who we share your data with

We only share your data with trusted parties where it is necessary to provide our service, including:

• Stripe — to process your payment securely.
• Delivery / courier services — where you have chosen delivery, to get your order to you.
• Our web hosting provider — who stores the website and order data on secure servers on our behalf.
• Authorities — only where we are legally required to do so.

These parties are only permitted to use your data for the specific purpose we provide it and in line with data protection law.

How long we keep your data

We keep your personal data only for as long as necessary:

• Account details — for as long as you keep your account with us. If you ask us to delete your account, we will remove your personal details.
• Order records — retained for a reasonable period (typically up to 6 years) to meet accounting and tax obligations, after which they are securely deleted.

Your rights under UK GDPR

You have the following rights over your personal data, and we will always help you exercise them free of charge:

• Right to be informed — to know how your data is used (this policy).
• Right of access — to request a copy of the personal data we hold about you.
• Right to rectification — to have inaccurate or incomplete data corrected.
• Right to erasure — to ask us to delete your data ("the right to be forgotten") where there is no legal reason to keep it.
• Right to restrict processing — to ask us to pause how we use your data.
• Right to data portability — to receive your data in a portable format.
• Right to object — to object to certain types of processing.

To exercise any of these rights, simply contact us at allsewnupbangor@gmail.com and we will respond within one month.

Cookies & your device

Our website uses only essential functionality to work correctly. Your shopping basket is stored locally in your own web browser (using local storage) so we can remember the items you've added, and we use a secure session cookie to keep you logged in to your account. We do not use advertising or third-party tracking cookies. You can clear this data at any time through your browser settings.

Changes to this policy

We may update this policy from time to time to reflect changes in our practices or the law. Any updates will be posted on this page with a revised "last updated" date shown above.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can put things right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or by calling 0303 123 1113.