Privacy Policy

1. Who we are

UNDERRATED is a trading name of [COMPANY LEGAL NAME], a company registered in [England and Wales] under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS] (“we”, “us”, “our”).

We are the controller of the personal information we collect through this website. This policy explains what we collect, why, and the choices you have. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What we collect

Information you give us

• Order details: your name, email address, phone number, delivery address and billing address.
• Messages: anything you send us by email or through customer service.
• Account details: if you create an account, your name, email address and password. Your password is stored only as a one-way scrypt hash with a unique salt, so nobody at UNDERRATED can see or recover it.

Payment information

Card and other payment details are entered on a secure page run by our payment provider, Stripe. We never see or store your full card number. Stripe shares with us limited details such as the card type, the last four digits and whether the payment succeeded.

Information collected automatically

• Technical data: your IP address, browser type, device type and the pages you visit, recorded in our server logs.
• Your bag: the items in your bag are saved in your own browser’s local storage so they are still there when you come back. This stays on your device and is not sent to us until you check out.

3. How we use your information

• To take payment, process and deliver your order.
• To send you order confirmations, receipts and delivery updates.
• To run your account: confirming your email, signing you in, showing your order history and resetting your password.
• To handle returns, refunds and questions you send us.
• To prevent fraud and keep the website secure.
• To meet our legal obligations, such as keeping accounting and tax records.
• To send marketing emails, but only if you have agreed to receive them. You can unsubscribe at any time using the link in each email.

4. Our lawful bases

We only use your personal information when the law allows us to:

• Contract: to process and deliver the order you have placed.
• Legal obligation: to keep financial records and comply with the law.
• Legitimate interests: to run and secure our website, prevent fraud and improve our service, where those interests are not outweighed by your rights.
• Consent: for marketing emails and any non-essential cookies. You can withdraw consent at any time.

5. Who we share it with

We do not sell your personal information. We share it only with service providers who help us run the business, and only as much as they need:

• Stripe: payment processing and fraud prevention. See Stripe’s privacy policy.
• Delivery partners: [COURIER NAME(S)], to deliver your order.
• Hosting and IT providers: [HOSTING PROVIDER], who host this website.
• Email providers: [EMAIL PROVIDER], to send order and, if you agree, marketing emails.
• Professional advisers and authorities: our accountants, lawyers and insurers, and regulators or law enforcement where the law requires it.

6. International transfers

Some of our providers, including Stripe, may process data outside the UK. When this happens we make sure your information is protected, for example through UK adequacy regulations or the International Data Transfer Agreement or Addendum approved by the Information Commissioner’s Office (ICO).

7. How long we keep it

• Order and payment records: 6 years from the end of the financial year they relate to, to meet tax and accounting rules.
• Customer service messages: up to [2 years] after your last contact with us.
• Marketing preferences: until you unsubscribe, after which we keep only your email address on a suppression list so we do not contact you again.
• Server logs: up to [90 days].
• Accounts: until you ask us to close your account. Order records are still kept for the period above.

8. Your rights

Under UK data protection law you have the right to:

• access the personal information we hold about you;
• ask us to correct information that is wrong or incomplete;
• ask us to delete your information;
• ask us to restrict how we use it;
• object to us using it, including for direct marketing;
• receive it in a portable format;
• withdraw consent at any time, where we rely on consent.

To use any of these rights, email us at [CONTACT EMAIL]. We will reply within one month. There is normally no charge.

9. Cookies and local storage

We keep cookies and similar technologies to a minimum:

• Local storage (essential): remembers the items in your bag on your device.
• Sign-in cookie (essential): if you sign in to your account, a secure cookie keeps you signed in for up to 30 days or until you sign out.
• Stripe (essential): Stripe sets cookies on its checkout page to process payments securely and prevent fraud.
• Fonts: our typeface is loaded from Google Fonts, which means your browser sends your IP address to Google when the page loads.

We do not currently use advertising or analytics cookies. If we add them, we will ask for your consent first and update this policy.

10. Security

We use appropriate technical and organisational measures to protect your information, including encrypted (HTTPS) connections and a payment provider that meets the PCI DSS security standard. No website can be completely secure, so please let us know straight away if you think your information has been put at risk.

11. Children

Our website is not aimed at children under 13 and we do not knowingly collect their personal information.

12. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top shows when it last changed. If we make significant changes, we will let you know on the website or by email.

13. Contact and complaints

If you have any questions about this policy or how we use your information, contact us:

• Email: [CONTACT EMAIL]
• Post: [COMPANY LEGAL NAME], [REGISTERED ADDRESS]

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first, so please contact us before you go to the ICO.