Privacy policy
A plain-English explanation of what data we collect, why, and what your rights are. Last updated 2 July 2026.
Who is the data controller
The data controller for personal information collected by this site is [PLEASE UPDATE: your legal name], trading as Hull City Nostalgia, based in Hull, East Yorkshire, United Kingdom. Contact: info@hullcitynostalgia.co.uk.
We are not currently registered with the Information Commissioner's Office (ICO) because our data processing falls within the exemption for small-scale personal, family, or small-business use. If our processing scale changes, we will register and update this notice.
What we collect and why
| Data | Why we collect it | Lawful basis |
|---|---|---|
| Name, email address, shipping address, phone (if given) | To fulfil your order and communicate about it | Contract (Art. 6(1)(b)) |
| Payment details (via PayPal) | To process your payment | Contract (Art. 6(1)(b)) |
| Contact form submissions | To answer questions you send | Legitimate interest (Art. 6(1)(f)) |
| Server logs (IP address, timestamps, browser) | Security, abuse prevention, fixing bugs | Legitimate interest (Art. 6(1)(f)) |
| Cookies (see cookie policy) | Basket state, cookie-consent decision | Consent + strictly necessary |
What we do NOT do
- We do not sell, rent, or share your personal data with third parties for their marketing.
- We do not run cross-site behavioural advertising.
- We do not store your card or bank details — those are held by PayPal.
- We do not send marketing email without you opting in.
How long we keep it
- Order details: 6 years, for HMRC / accounting compliance.
- Contact-form messages: 2 years, or until we've closed the conversation and archived the reply.
- Server logs: rolling 90-day window, then automatically deleted.
- Cookies: see cookie policy for retention periods.
Who else sees the data
- PayPal (Europe) S.à r.l. et Cie, S.C.A. — payment processor. Their privacy notice.
- Royal Mail — for dispatched orders, we share your name and address so the parcel can be delivered.
- Krystal Hosting Ltd — our web host. Data is stored on their UK-based servers.
Your rights
Under UK GDPR you have the right to:
- Ask what personal data we hold about you (a "subject access request");
- Correct anything that's wrong;
- Delete your data, except where we need to keep it for legal/accounting reasons;
- Object to processing based on legitimate interest;
- Complain to the ICO if you're not happy with how we've handled your data.
To exercise any of these rights, email info@hullcitynostalgia.co.uk. We aim to respond within 30 days.
Changes to this policy
If we make material changes, we'll update the date at the top and, where the change materially affects you, contact you directly.