Privacy policy

This policy explains what we do with personal data. Subbie Sync Ltd is the data controller — our company number, VAT number and registered office are in the footer of every page.

What we hold, and why

When you place an order we hold your name, email address, telephone number, delivery address and billing address, along with what you bought and what you paid. We need this to take the order, get it to you, and keep the VAT records the law requires of us.

When you open an account we also hold the password you set, which is stored only as a one-way hash and is never visible to us or to anybody else.

When you apply for a trade account we hold the details on the application: the trading name, the registered address, the company or partnership details, the names and positions of the people signing, the trade references given, and the decision we reached along with the reason for it.

When you send us artwork for branding we hold the files you upload and the enquiry they belong to.

If you ask to be told when something is back in stock we hold your email address and which item you asked about, and nothing else. There is a link in that email to stop us telling you, which deletes the request.

When you use the site our hosting and security providers record ordinary technical information such as your IP address. We record failed sign-in attempts in order to slow down somebody guessing at passwords; the email address involved is stored only as a one-way hash and never in a readable form.

Marketing

We only send marketing email if you have asked for it, and every marketing message carries a one-click unsubscribe. Emails about an order you have placed — the confirmation, the dispatch note, the invoice — are not marketing and are sent whether or not you have opted in, because they are part of the sale.

Who else sees it

We use other companies to run parts of the shop. Each of them sees only what it needs:

Our hosting and database providers, which run the site and store the records above.
Our payment provider, which takes card payments. Card numbers are entered directly into their own form and never reach our systems at all.
Our email provider, which delivers order confirmations, dispatch notes, invoices and account email.
Our file storage provider, which holds uploaded artwork and generated documents.
Our search provider, which indexes the product catalogue. It holds no personal data.
Our analytics provider, which counts page views and measures how quickly pages load, and only if you have agreed to it. It sets no cookie, stores nothing on your device, and is served from this site rather than from anybody else's.
Our error monitoring provider, which is sent a report when something on the site goes wrong, so we can find out and fix it. A report says what failed and where in our own code it happened. Names, email addresses, postcodes, order and account numbers, payment references and internal identifiers are removed before it is sent.
An address lookup service, which returns address suggestions as you type at the checkout.
Our supplier, which we pass a delivery address to so it can send you your order.
Couriers, which need the delivery address and a contact number to make the delivery.

We do not sell personal data, and we do not share it for anybody else's marketing.

How long we keep it

Order, invoice and payment records: six years after the end of the accounting period they fall in, which is the retention HMRC requires for VAT.
Trade account applications and the decisions on them: seven years, because they are credit decisions and we may have to account for them.
Your account and its saved addresses: until you ask us to close it.

Your rights

You can ask us to give you a copy of the personal data we hold about you, to correct anything wrong, to delete it, to restrict what we do with it, or to send it to somebody else in a portable form. You can also object to us processing it, and withdraw consent to marketing at any time.

Ask through the contact form and we will respond within one month.

Some of this is subject to the retention periods above: we cannot delete a VAT record we are legally required to keep, and we will tell you plainly when that is the reason rather than refusing without one.

If you are not happy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first, so we get the chance to put it right.

How long we keep the rest

The periods above are set by law. These are ours, and a job deletes this data automatically once the period is up — you do not have to ask.

Messages sent through the contact form: 12 months: A message is correspondence rather than a financial record, so there is nothing to keep it for once it has been answered. Twelve months leaves room to pick up a conversation somebody comes back to.
Branding enquiries that did not become an order: 2 years: Long enough that a repeat order can be quoted from the last one without asking you for the artwork again. An enquiry that DID become an order is kept with the order, under the six-year rule above.
What people typed into the search box: 12 months: We keep search terms to work out what the catalogue is missing. They are not tied to an account, and twelve months is long enough to see a season repeat.
Copies of the emails we sent you: 2 years: We keep a copy of each message so we can answer questions about what was sent. After two years the copy is deleted; the record that we wrote to you, and any invoice the message was about, are kept under the rules above.