Privacy & Cookies Policy

Last updated: July 2026

1. Who We Are

The Flag Shop is operated by The Flag Shop Limited.

Email: [email protected]
Telephone: 01246 297600
Website: www.theflagshop.co.uk
ICO Registration Number: ZC008804

We are registered with the Information Commissioner's Office (ICO) as a data controller. If you have any questions about this policy or how we handle your personal data, please contact us using the details above.

2. What This Policy Covers

This policy explains how The Flag Shop collects, uses, stores and protects your personal data when you visit our website or purchase from us. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We may update this policy from time to time. The date at the top of this page shows when it was last updated. We encourage you to check back periodically.

3. What Personal Data We Collect

We may collect and process the following personal data about you:

• Identity data: name, username or similar identifier
• Contact data: billing address, delivery address, email address, telephone number
• Financial data: payment details (processed securely via Stripe or PayPal — we do not store card details on our servers)
• Transaction data: details of products you have purchased from us
• Technical data: IP address, browser type and version, operating system and platform
• Usage data: information about how you use our website
• Marketing and communications data: your preferences for receiving marketing from us

We do not collect any special categories of personal data (such as data about your race, ethnicity, religious beliefs, health or criminal history).

4. How We Collect Your Personal Data

We collect data through:

• Direct interactions: when you create an account, place an order, subscribe to our newsletter, contact us, or complete a form on our website
• Automated technologies: as you interact with our website, we automatically collect technical and usage data via cookies and similar technologies (see Section 9 below)
• Third parties: we may receive data from payment processors (Stripe, PayPal) and analytics providers (Google Analytics)

5. Legal Basis for Processing Your Data

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following bases:

Purpose	Legal Basis
Processing your order and taking payment	Performance of a contract
Creating and managing your account	Performance of a contract
Sending order confirmations and delivery updates	Performance of a contract
Complying with legal and regulatory obligations	Legal obligation
Sending marketing emails (where you have opted in)	Consent
Improving our website and services	Legitimate interests
Preventing fraud and ensuring site security	Legitimate interests
Analysing how customers use our website	Legitimate interests

Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms. Where we rely on consent (e.g. marketing emails), you may withdraw that consent at any time.

6. How We Use Your Personal Data

• To process and fulfil your orders, including taking payment and arranging delivery
• To create and manage your customer account
• To communicate with you about your orders, including sending confirmations and delivery updates
• To respond to your enquiries and provide customer support
• To send you marketing communications where you have opted in to receive these
• To improve our website, products and services
• To comply with legal obligations
• To detect and prevent fraud and abuse of our website

7. Who We Share Your Data With

• Payment processors: Stripe and PayPal, to process your payments securely
• Delivery providers: Royal Mail and other couriers, to deliver your orders
• IT and system providers: hosting, email and website service providers who process data on our behalf
• Analytics providers: Google Analytics, to help us understand how our website is used
• Professional advisers: lawyers, accountants and insurers where necessary
• Regulatory authorities: the ICO, HMRC or other authorities where required by law

We require all third parties to handle your data securely and in accordance with UK GDPR. We do not sell your personal data to third parties.

8. How Long We Keep Your Data

Data Type	Retention Period
Customer account data	Duration of account plus 2 years after last activity
Order records	7 years (legal/tax requirement)
Marketing preferences	Until you unsubscribe or withdraw consent
Website usage/analytics data	26 months
Correspondence and enquiries	2 years

After these periods, your data will be securely deleted or anonymised.

9. Cookies

What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They help the website function correctly and allow us to improve your experience.

Types of Cookies We Use

Strictly necessary cookies
These are essential for the website to work. They enable core functions such as security, account login and your shopping cart. You cannot opt out of these.

Analytics cookies
These help us understand how visitors use our site (e.g. which pages are most visited). We use Google Analytics for this purpose. These cookies are only placed with your consent.

Marketing cookies
These may be set by our advertising partners to build a profile of your interests. These cookies are only placed with your consent.

Social media cookies
If you use social sharing buttons (Facebook, Twitter/X, Instagram, Pinterest), those platforms may set cookies on your device. We recommend reviewing the privacy policies of those platforms.

Managing Your Cookie Preferences

When you first visit our website, you will be presented with a cookie consent banner where you can choose which categories of cookies to accept or decline. You can change your preferences at any time by clicking the cookie settings link in the footer of our website.

You can also control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of our website. For more information about cookies, visit www.allaboutcookies.org.

10. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to access: you may request a copy of the personal data we hold about you (a Data Subject Access Request or DSAR). This is provided free of charge.
• Right to rectification: you may request that we correct any inaccurate or incomplete data we hold about you.
• Right to erasure: you may request that we delete your personal data, subject to certain legal exceptions.
• Right to restrict processing: you may ask us to pause processing of your data in certain circumstances.
• Right to data portability: you may request a copy of your data in a structured, machine-readable format.
• Right to object: you may object to processing based on legitimate interests or for direct marketing purposes.
• Rights related to automated decision-making: we do not make decisions about you based solely on automated processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within one month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your data correctly:

ICO Website: www.ico.org.uk
Telephone: 0303 123 1113

11. Data Security

We take the security of your personal data seriously and have implemented appropriate technical and organisational measures to protect it against unauthorised access, loss, destruction or alteration. These include:

• Secure HTTPS encryption across our website
• Access controls and authentication measures
• Regular security monitoring and scanning
• Secure payment processing via Stripe and PayPal (we do not store card details on our servers)

In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.

12. International Data Transfers

Some of our third-party service providers (such as Google Analytics and Stripe) may process data outside the UK or European Economic Area. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR, such as Standard Contractual Clauses or adequacy decisions.

13. Marketing Communications

We will only send you marketing emails if you have opted in to receive them. You can unsubscribe at any time by:

• Contacting us at [email protected]

We will never share your email address with third parties for their own marketing purposes.

14. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to read their privacy policies.

15. Children's Privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

16. Changes to This Policy

We may update this policy from time to time to reflect changes in law or our practices. We will update the date at the top of this page when we make changes. For significant changes, we will notify you by email or a prominent notice on our website.

17. Contact Us

For any questions about this privacy policy or to exercise your data rights, please contact:

The Flag Shop
Email: [email protected]
Telephone: 01246 297600
ICO Registration Number: ZC008804