Privacy Policy
Last updated: TODO: confirm publish date
Wych Vintage ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why, how we use it, and what rights you have over it. It applies to wychvintage.co.uk and any purchases made through it.
If you have any questions about this policy or your data, contact us at info@wychvintage.co.uk.
1. Who we are
Wych Vintage is a UK-based online retailer of vintage clothing, trading cards and TCG accessories.
- Business/legal name: TODO: confirm
- Registered address: TODO: confirm
- ICO registration number: TODO: confirm
- Contact email: info@wychvintage.co.uk
2. What data we collect
We collect the following categories of personal data:
2.1 Order and account data
When you place an order or create an account, we collect your name, email address, delivery address, billing address, phone number (if provided), and a record of the items you've purchased.
2.2 Payment data
We use Stripe to process payments. When you pay, your card details are sent directly and securely to Stripe - we do not receive, see, or store your full card number, expiry date or CVV on our own systems. We retain only order and transaction reference data (order total, date, and Stripe's transaction ID) needed to fulfil and reconcile your order.
2.3 Delivery data
To dispatch your order, we share your name and delivery address with Royal Mail (or another courier we use), solely for the purpose of delivering your parcel.
2.4 Contact form data
If you use our contact or newsletter sign-up form, we collect your name and email address, and any message you send us.
2.5 Cookies and analytics
We use cookies and similar technologies to run the site and to understand how it's used. See section 7 (Cookies) below.
3. How we use your data, and our lawful basis
| Purpose | Data used | Lawful basis (UK GDPR) |
|---|---|---|
| Processing and fulfilling your order | Order, account, payment, delivery data | Performance of a contract |
| Customer service and responding to enquiries | Contact form data, order data | Performance of a contract / legitimate interests |
| Sending order confirmations and delivery updates | Order, delivery data | Performance of a contract |
| Sending marketing emails (new arrivals, promotions) | Name, email (newsletter sign-up) | Consent |
| Fraud prevention and payment processing | Payment data (via Stripe) | Legal obligation / legitimate interests |
| Understanding site usage (analytics) | Cookie/analytics data | Consent (non-essential cookies) |
| Keeping financial records | Order and transaction data | Legal obligation |
You can withdraw consent for marketing emails at any time by using the unsubscribe link in any email, or by contacting us directly.
4. Who we share your data with
We share personal data only with the third parties needed to run our business, and only the data each of them needs:
- Stripe (payment processing) - receives payment details directly; we do not store card data. See Stripe's privacy policy.
- Royal Mail / delivery couriers - receive name and delivery address to deliver your order.
- TODO: confirm any analytics provider, e.g. Google Analytics - receives anonymised or pseudonymised usage data if you've consented to analytics cookies.
- TODO: confirm any email marketing platform used for the newsletter
We do not sell your personal data to anyone.
5. Where your data is stored
Your data is stored on secure servers TODO: confirm hosting location/provider, e.g. within the UK/EEA . Where a provider (such as Stripe) processes data outside the UK/EEA, they do so under approved safeguards (such as Standard Contractual Clauses).
6. How long we keep your data
- Order and transaction records: retained for TODO: confirm, typically 6 years to meet HMRC/accounting obligations.
- Account data: retained while your account is active, and deleted or anonymised TODO: confirm period after account closure or last activity.
- Marketing/newsletter data: retained until you unsubscribe or ask us to delete it.
- Contact form enquiries: retained for TODO: confirm, e.g. 12 months to allow us to handle follow-up queries, then deleted.
7. Cookies
We use cookies to make the site work and, where you consent, to understand how visitors use it.
| Type | Purpose | Consent required? |
|---|---|---|
| Strictly necessary (e.g. shopping bag, checkout session) | Keep the site and checkout working | No - always active |
| Analytics (e.g. TODO: confirm tool ) | Understand site traffic and improve the shopping experience | Yes |
| Marketing (if used) | TODO: confirm if any marketing/retargeting cookies are used | Yes |
You'll see a cookie banner when you first visit the site, letting you accept or decline non-essential cookies. You can change your preference at any time via TODO: confirm cookie settings link/mechanism , or by adjusting your browser settings.
8. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Ask us to correct inaccurate data
- Ask us to delete your data ("right to be forgotten"), subject to legal retention requirements
- Restrict or object to certain processing
- Data portability (receive your data in a portable format)
- Withdraw consent at any time, where we rely on consent
- Complain to the Information Commissioner's Office (ICO) if you're unhappy with how we've handled your data
To exercise any of these rights, email info@wychvintage.co.uk. We'll respond within one month, as required by law.
9. Children's data
Wych Vintage is not intended for children under 16, and we do not knowingly collect data from children.
10. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top will always reflect the most recent version. Significant changes will be highlighted on this page.
11. Contact us
Questions, requests, or concerns about your data:
Email: info@wychvintage.co.uk
Post: TODO: confirm registered address