Privacy Policy

This policy explains what personal data Customs by JM collects, how we use it, and what rights you have over it. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

The data controller is JM, sole trader, trading as Customs by JM. Based in London. Contact: hello@customsbyjm.co.uk.

What data we collect

• Order information — name, email, phone (optional), Instagram handle (optional), city, design brief, reference materials you send us
• Payment information — processed directly by Stripe; we never see or store your card details
• Marketing — email address (only if you sign up for the newsletter)
• Technical — IP address and anonymised analytics (via Vercel Analytics)

Why we collect it & legal basis

• Order fulfilment — legal basis: contract performance. Without this data we can't deliver your order.
• Customer service — legal basis: legitimate interest.
• Marketing emails — legal basis: your consent (you can withdraw at any time via the unsubscribe link).
• Legal & tax records — legal basis: legal obligation. HMRC requires us to keep order records for 7 years.

How long we keep it

• Order records: 7 years (HMRC requirement)
• Marketing list: until you unsubscribe
• Reference images and design files: duration of business relationship, then archived securely
• Analytics: anonymised, retained per Vercel's policy

Who we share it with

We use third-party processors who act on our instructions only. All are UK GDPR-compliant:

• Stripe — payment processing (Ireland / UK data centres)
• Supabase — order database (EU region)
• Resend — transactional email delivery
• Vercel — website hosting and CDN
• Cal.com — consultation booking
• Cloudflare — DNS and edge network

We do not sell or share your data for advertising. We do not use third-party advertising trackers.

Your rights

You have the right to:

• Access the data we hold about you
• Correct inaccurate data
• Request deletion (where legal obligations don't require us to keep it)
• Request a copy of your data in a portable format
• Object to or restrict processing
• Withdraw consent for marketing at any time

To exercise any of these, email hello@customsbyjm.co.uk. We'll respond within one month.

Right to complain

You can complain to the Information Commissioner's Office at ico.org.uk if you think we've mishandled your data.

Cookies

See our Cookie Policy for details on the (essential-only) cookies we use.