Privacy Policy

We collect information you provide directly, automatically through your use of our website, and from third-party sources.

Information you provide:

• Name, email address, phone number when you create an account or place an order
• UK billing and shipping address for order fulfilment
• Payment information (processed securely by Stripe — we do not store card details)
• Messages and enquiries submitted via our contact form
• Newsletter subscription email address
• Custom order measurements and preferences if requested

Automatically collected information:

• IP address, browser type, and operating system
• Pages visited, time spent, and navigation paths on our website
• Device information and screen resolution
• Referring URLs and search terms
• Cookie data (see our Cookie Policy)

We use the information we collect to:

• Process and fulfil your orders to UK addresses and send order confirmations
• Communicate with you about your orders, returns, or enquiries
• Send marketing emails (only if you have opted in)
• Improve our website and product offerings
• Detect and prevent fraud or unauthorised transactions
• Comply with legal obligations under UK law, including HMRC requirements
• Personalise your shopping experience

We will never sell your personal information to third parties. Our marketing emails always include an unsubscribe option.

We share your information only where necessary to operate our business:

• UK Shipping Carriers (Royal Mail, DPD, Evri, DHL) — your name and delivery address are shared with the carrier best suited to your UK location.
• Stripe — secure payment processing (PCI-DSS Level 1 certified). We never store your card details.
• Google Analytics — anonymous website usage analytics to improve our site.
• Klaviyo — email marketing platform, used only if you have opted in to receive our newsletter.
• Legal authorities — only when required by applicable UK law or to protect our legal rights.

All third-party service providers are contractually bound to protect your information and use it only for the specified purpose. We do not sell, rent, or trade your personal data.

We use cookies and similar technologies to improve your browsing experience, analyse traffic, and personalise content. Under UK PECR regulations, we obtain your consent before placing non-essential cookies. For full details on what cookies we use and how to manage them, please read our Cookie Policy. You can manage cookie preferences through your browser settings at any time.

We take the security of your personal data seriously. Our measures include:

• SSL/TLS encryption across all pages and during payment processing
• Secure, access-controlled servers with regular security audits
• Payment data processed exclusively by PCI-DSS Level 1 certified Stripe
• Staff access to personal data limited strictly to those who need it
• Regular security training for our team

While we take all reasonable precautions, no method of transmission over the internet is 100% secure. In the event of a data breach, we will notify the ICO within 72 hours and affected users promptly, as required under UK GDPR.

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the following rights:

• Right of Access: Request a copy of the personal data we hold about you (Subject Access Request)
• Right to Rectification: Ask us to correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restriction: Ask us to limit how we use your data
• Right to Data Portability: Request a machine-readable copy of your data
• Right to Object: Object to our processing of your data for marketing or legitimate interests
• Rights re: automated decisions: Not be subject to solely automated decisions that significantly affect you
• Withdraw Consent: Unsubscribe from marketing emails at any time

To exercise any of these rights, please email support@blackstonejackets.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We retain your personal data for as long as necessary to provide our services and comply with legal obligations:

• Order and transaction data: 6 years (HMRC and UK tax compliance)
• Account data: Until you request deletion
• Marketing data: Until you unsubscribe
• Analytics data: 26 months (Google Analytics default)

Our website may contain links to third-party websites. We are not responsible for the privacy practices of those sites. We recommend reviewing their privacy policies before providing any personal information.

Our website is not directed at children under 13. We do not knowingly collect personal data from children. Under the UK Age Appropriate Design Code, we take additional care to protect younger users. If you believe a child has provided us with personal information, please contact us and we will delete it immediately.

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or by posting a notice on our website. The "Last updated" date at the top of this page reflects when changes were last made. Continued use of our website after changes constitutes acceptance of the updated policy.