Privacy Policy – Underkut

This policy explains what personal data Underkut collects, why, and what rights you have. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who is responsible for your data

The data controller is [LEGAL ENTITY], [LEGAL ADDRESS]. For any question about your data, email us at [CONTACT EMAIL].

2. Data we collect

We only collect the data we need to run the shop and process your orders:

Identity: first name, last name, email address
Delivery: postal address, phone number
Payment: card details are handled directly by our payment provider Stripe and are never stored on our servers
Browsing: IP address, browser type, pages visited (only with your consent for non-essential cookies)
Customer account: order history and preferences

3. Cookies

We use cookies to make the website work, measure traffic and show you relevant ads. There are three types:

Essential cookies: needed for the cart, checkout and your session. They are always on.
Analytics cookies: help us understand how the website is used.
Marketing cookies: used by advertising partners such as Meta and Google to show you relevant ads.

Analytics and marketing cookies are only loaded if you click “Accept” on our cookie banner. If you click “Reject”, they stay off and this does not affect your purchases. Your choice is remembered for 6 months and you can change it at any time with the “Manage cookies” link at the bottom of every page.

4. Why we use your data

to process, deliver and track your orders (performance of a contract)
to answer your questions and handle returns (performance of a contract)
to send you news and offers, only if you have agreed to it (consent, you can unsubscribe at any time)
to improve our website and our products (legitimate interest)
to meet our legal, accounting and tax obligations (legal obligation)

5. Who we share your data with

We never sell or rent your personal data. We only share what is necessary with the service providers that help us run the shop:

Stripe (secure payment)
delivery carriers (to deliver your parcel) and our order tracking tool
Klaviyo (emails and newsletters, only with your consent for marketing)
Google and Meta (audience measurement and advertising, only with your consent)
our web hosting provider

Some of these providers are based outside the UK, in particular in the United States. In that case, your data is protected by appropriate safeguards such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.

6. How long we keep your data

Order data: 6 years, to meet accounting and tax obligations
Customer account: as long as the account is active, then deleted after 3 years of inactivity
Marketing data: until you unsubscribe, then 3 years
Analytics cookies: 13 months maximum

7. Your rights

Under UK GDPR you have the right to:

access the data we hold about you
have inaccurate or incomplete data corrected
have your data deleted
restrict how we use your data
receive your data in a portable format
object to the use of your data, including for direct marketing
withdraw your consent at any time

To use any of these rights, email us at [CONTACT EMAIL]. We will reply within one month.

8. Security

We use appropriate technical and organisational measures to protect your data: TLS/SSL encryption, 3D Secure payments through Stripe, secure hosting and regular backups.

9. Complaints

If you think we have not handled your data properly, please contact us first so we can fix it. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection authority: ico.org.uk, telephone 0303 123 1113.