Privacy Directive
This store is operated by ComplianceIsMandatory LTD, 9748 Abingdon St, London SW1P 3JY, United Kingdom ("we"). We sell one garment design per week. We collect the minimum information required to take your payment and ship your order — nothing else. To contact us about your personal data, write tosupport@complianceismandatory.com.
What we collect, and why
We process personal data only for the purposes described below. The lawful basis for each purpose is given alongside it.
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Taking your payment | Name, email, billing address, card details | Performance of our contract with you (UK GDPR Art. 6(1)(b)) |
| Producing and shipping your order | Name, email, shipping address | Performance of our contract with you (UK GDPR Art. 6(1)(b)) |
| Answering support requests | Name, email, order details | Performance of our contract with you (UK GDPR Art. 6(1)(b)) |
| Meeting tax and accounting obligations | Order records (what you bought, where it shipped, price paid) | Compliance with a legal obligation (UK GDPR Art. 6(1)(c)) |
| Sending drop notifications (only if you sign up) | Email address | Your explicit consent (UK GDPR Art. 6(1)(a)) |
Who we share your data with
- Stripe (US-based) processes your payment on Stripe's own hosted checkout pages. Your card number never touches our servers.
- Our garment manufacturing and fulfilment provider (US/EU-based) receives your name, email, and shipping address at checkout to manufacture and ship your order.
- Cloudflare (US-based) hosts the website and processes standard request logs (IP address, user agent) to serve and secure the site.
- Resend (US-based) sends the drop notification emails and verification codes if you sign up for notifications.
What we do not do
- No accounts. No profiles. No passwords to breach.
- No advertising trackers and no sale of personal data to anyone.
- No marketing email unless you explicitly ask for it.
- No automated decision-making or profiling.
How long we keep your data
- Order records (what you bought, where it shipped, price paid) are retained for 6 years from the end of the financial year they relate to, as required by HMRC for a UK limited company.
- Drop notification list: your email address is kept until you unsubscribe or the list is deleted. Verification codes are deleted automatically after 10 minutes.
Drop notification list
If you sign up for drop notifications, we store your email address solely to send you a message when a new drop goes live. The lawful basis is your explicit consent (UK GDPR Art. 6(1)(a)). You must tick an unticked checkbox to opt in — consent is never assumed. We send a one-time verification email to confirm your address belongs to you.
- What we store: your email address, the date and time you consented, and a randomly generated unsubscribe token. Nothing else — no name, no IP address, no device information.
- Who sends the messages: emails are sent via Resend (US-based). Resend processes your email address under its own privacy terms.
- How to unsubscribe: every notification email includes an unsubscribe link. You can also unsubscribe at any time at/unsubscribe or by writing tosupport@complianceismandatory.com.
International transfers
Some of the providers listed above are located outside the UK, in the US (Stripe, Cloudflare, Resend) and in the US and EU (our garment provider). Where we transfer your personal data internationally, we rely on the UK–US data bridge where it applies to transfers to certified recipients in the US, on UK "adequacy" regulations where they apply to transfers to the EU, and otherwise on the Information Commissioner's International Data Transfer Agreement (IDTA). Write tosupport@complianceismandatory.comfor a copy of the safeguards in place.
Your rights
Under UK data protection law you have the following rights:
- Access: request a copy of the personal data we hold about you.
- Rectification: request correction of inaccurate or incomplete data.
- Erasure: request deletion of your personal data. Deletion requests are honoured except where a record must be retained to comply with a legal obligation (e.g. tax records).
- Restriction: request that we limit our processing of your data pending resolution of a rectification or objection.
- Objection: object to processing based on legitimate interests or direct marketing.
- Data portability: receive your personal data in a structured, machine-readable format.
- Withdraw consent: if you signed up for drop notifications, you can withdraw your consent at any time by unsubscribing.
To exercise any of these rights, write tosupport@complianceismandatory.com.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, atico.org.uk/make-a-complaintor by writing to ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. We encourage you to contact us first, but you are not required to do so.