Privacy Policy
We respect your data. Here is what we do with it.
1. Who We Are
This privacy policy is issued by Bradley Howe trading as Urban Basics (referred to in this policy as "Urban Basics", "we", "us", or "our"), established in England and Wales.
Data Controller contact details:
Name: Bradley Howe t/a Urban Basics
Address: Unit 149004, PO Box 7169, Poole, BH15 9EL, United Kingdom
Email: admin@urbanbasics.co.uk
2. What We Collect and Legal Basis for Processing
Under the UK GDPR, we process your personal data on the following legal bases:
- Contractual Necessity: Processing your identity, contact, and order data to fulfill and ship your order.
- Consent: Sending you marketing emails and using non-essential analytics and functional cookies (only if you explicitly opt-in).
- Legitimate Interest: Processing technical data for preventing fraud, improving our website's security, and resolving bugs.
3. Categories of Personal Data
We may collect the following categories of personal data: Identity Data (name), Contact Data (email, billing/delivery addresses), Financial Data (payment details are handled securely by processors), Transaction Data (details of products purchased), Technical Data (IP address, browser type), Profile Data (purchases, preferences), and Usage Data (how you use our site).
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects. If you choose not to provide necessary personal data, we may not be able to fulfill your order or provide certain services.
4. How We Share Your Data and Our Processors
We share your personal data with the following service providers. Where a provider acts as our data processor (processing data only on our instructions), we have a Data Processing Agreement in place. Where a provider acts as an independent data controller (determining their own processing purposes), we are not responsible for their processing and we direct you to their own privacy notice.
| Provider | Role | Data Shared | Location | Transfer Mechanism |
|---|---|---|---|---|
| Gelato AS (fulfilment) | Data processor | Name, delivery address, email, order details | Norway (EEA); onward to print partners globally | Norway is UK-adequate. Onward transfers covered by Gelato's DPA at gelato.com/legal/data-processing-terms |
| Stripe Payments Europe, Ltd | Data processor (payment services) & independent controller (fraud prevention) | Name, email, billing address, payment data, IP | Ireland (EEA); US for Stripe LLC | UK Addendum to EU SCCs + Data Privacy Framework. Privacy policy: stripe.com/gb/privacy |
| PayPal (Europe) / PayPal UK Ltd | Independent data controller | Payment data, transaction data, name, email | Luxembourg, UK, global | PayPal's own BCRs + UK Addendum. Privacy statement: paypal.com/uk/legalhub/privacy-full |
| Supabase, Inc. (database/auth) | Data processor | All account and order data | Singapore; AWS and Google Cloud globally | UK Addendum to EU SCCs (incorporated in our DPA) |
| Plus Five Five, Inc. (Resend) | Data processor | Name, email address, email content | USA | UK Addendum to EU SCCs + Data Privacy Framework |
| MailerLite (marketing email) | Data processor | Name, email address, marketing preferences | Lithuania (EEA); US sub-processors | UK Addendum to EU SCCs (auto-incorporated) |
| PostHog, Inc. (analytics) | Data processor | IP address, session data, click paths, device data | USA | UK Addendum to EU SCCs + Data Privacy Framework |
| Algolia, Inc. (site search) | Data processor | Search queries, IP address, session identifiers | USA | UK Addendum to EU SCCs |
We require all data processors to implement appropriate technical and organisational security measures and to process your data only on our documented instructions, in accordance with Article 28 of the UK GDPR.
5. International Data Transfers
Some of our service providers are established outside the United Kingdom. Where your data is transferred to a country not covered by a UK adequacy decision, we ensure appropriate safeguards are in place. For transfers to the United States, we rely primarily on the UK Addendum to the EU Standard Contractual Clauses (version B.1.0, issued by the Information Commissioner's Office under section 119A of the Data Protection Act 2018), and where applicable, on the UK Extension to the EU-US Data Privacy Framework. You may obtain a copy of the applicable safeguards by contacting us.
6. Cookies and Tracking Technologies
We use the following categories of cookies:
- Strictly necessary cookies: required for the site to function (e.g. shopping cart, session authentication). No consent is required for these.
- Analytics cookies (PostHog): used to understand how visitors interact with our site. These cookies are only placed with your consent.
- Functional/preference cookies (Algolia): used to improve search functionality and remember preferences. These cookies are only placed with your consent.
When you first visit our site, you will be shown a cookie consent banner. Non-essential cookies will only be activated if you actively accept them. You can withdraw your consent at any time. Withdrawal of consent does not affect processing that occurred before withdrawal.
7. Data Retention
We retain your personal data only for as long as necessary to fulfill the purposes we collected it for. Order and financial data is retained for 6 years to comply with HMRC tax requirements. Account data is retained until account deletion, plus a short post-deletion period. Analytics data is retained for up to 12 months. Email marketing data is retained until you withdraw consent or unsubscribe, plus a short suppression period. Website technical logs are typically retained for 30-90 days.
8. Your Data Rights
Under data protection laws, you have rights including:
- Access: Request a copy of your personal data.
- Rectification: Request that we correct inaccurate data.
- Erasure: Request that we erase your data, subject to legal exceptions.
- Restriction: Request restriction of processing your personal data.
- Object: Object to processing of your personal data.
- Data Portability: Request the transfer of your data to you or a third party in a structured, commonly used, machine-readable format.
- Withdraw Consent: Withdraw consent at any time where we are relying on consent to process your data. This does not affect the lawfulness of any processing carried out before you withdraw your consent.
You have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.
9. California Residents (CCPA/CPRA)
Urban Basics is a small UK business that does not meet the revenue or data volume thresholds to be subject to the CCPA/CPRA. We do not "sell" your personal information within the meaning of the CCPA.
10. Contact Us
To exercise any of these rights, or if you have questions about our privacy practices, contact us at admin@urbanbasics.co.uk or via our contact form.