1. Who we are
We are a sole trader business based in London, England. We sell trend-inspired apparel and accessories online. For the purposes of UK data protection law, we are the data controller for the personal data described in this policy.
Contact: singleuntilseriesb@gmail.com
2. What data we collect
We collect very little. When you place an order, Stripe (our payment processor) collects the following on our behalf:
- Your name
- Your email address
- Your shipping address
- Your payment card details (held by Stripe only; we never see or store your full card number)
There is no account creation on our site. We don't ask you to set a password. We don't collect phone numbers unless Stripe requires one for delivery purposes.
3. What we don't collect
To be clear about what we're not doing:
- We don't sell, rent, or share your data with third parties for marketing purposes
- We don't run advertising pixels or third-party audience analytics on the product page
- We don't use order details for marketing
4. How we use your data
Our lawful basis for processing your order data is contract performance (Article 6(1)(b), UK GDPR): we need the data to fulfil the order you placed with us.
We use your personal data for one purpose: fulfilling your order. Specifically:
- Your shipping address is shared with the approved fulfilment supplier so they can post your order to you
- Your email is used to send order confirmation and any delivery updates
- Your email may be used to contact you if there's an issue with your order (wrong colour, delivery problem, etc.)
We don't use your data for anything else unless you've given us separate permission to do so.
If you arrive through a link containing a source label, such as utm_source=instagram, the product page passes a short source label and your selected colour to Stripe with checkout. We use that limited information to understand which sources lead to orders and to fulfil the selected colour. We do not use it to build an advertising profile. Our lawful basis for that attribution is legitimate interests (Article 6(1)(f), UK GDPR): understanding, in aggregate, which links lead to orders.
We do not use automated decision-making or profiling that produces legal or similarly significant effects about you.
5. Data processors
The following third-party services process data on our behalf:
- Stripe: payment processing. Stripe stores your payment details securely on their PCI DSS compliant servers. See Stripe's privacy policy.
- Vercel: website hosting. Vercel serves the site pages. See Vercel's privacy policy.
- Our approved fulfilment supplier: receives your name and shipping address to fulfil and post your order. They don't use your data for any other purpose.
International transfers: Stripe and Vercel are US-headquartered companies, so some of your data is processed in the United States. Those transfers are protected by the UK's adequacy regulations for the US (the UK Extension to the EU-US Data Privacy Framework) where the recipient is certified under it, and otherwise by the contractual safeguards in each processor's data processing terms. Our fulfilment supplier is UK-based.
6. Cookies and browser storage
The Trend Merch product page does not set analytics or advertising cookies and does not use localStorage or sessionStorage.
Stripe may set functional cookies after you choose to open its hosted checkout. See Stripe's privacy policy for details.
7. Marketing
We do not currently operate a marketing mailing list. We do not use order email addresses for marketing.
8. How long we keep your data
We retain your order data (name, email, shipping address, order details) only for as long as needed to:
- Fulfil your order
- Handle any returns or complaints within the 14-day cancellation period
- Meet our legal obligations (e.g. tax records, which UK law requires us to keep for 6 years)
After that, your data is deleted. Payment card data is held by Stripe according to their own retention policy; we have no access to it.
9. Your rights (UK GDPR)
Under the UK General Data Protection Regulation, you have the right to:
- Access the personal data we hold about you
- Rectify any inaccurate data (e.g. fix a typo in your address)
- Delete your data (subject to legal retention requirements)
- Restrict how we process your data while a question about it is resolved
- Object to processing of your data
- Data portability: receive your data in a structured, commonly used format
To exercise any of these rights, email us at singleuntilseriesb@gmail.com. We'll respond within one month.
Complaints: if you are unhappy with how we have handled your data, you can complain directly to us at the same address. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay, as the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025) requires. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
Customers in the EU/EEA: where the EU GDPR applies to your order, you have equivalent rights, exercisable at the same email address, and the right to complain to the data protection authority in your own country.
10. Data security
We don't store payment data ourselves. All payment processing happens on Stripe's PCI DSS compliant infrastructure. The site is served over HTTPS. We use strong passwords and limit access to order data to those who need it for order handling and fulfilment.
11. Children
We don't knowingly collect data from anyone under 16. If you're under 16, please ask a parent or guardian to place the order on your behalf.
12. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top will change when we do. We won't make significant changes that reduce your rights without letting affected customers know by email.
13. Contact
Questions about your data or this policy: