Privacy Policy

The Embroidery Company Ltd ("we", "us", "our") are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our branded merchandise and rewards platform (the "Service").

This policy applies in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. By accessing or using the Service, you consent to the practices described in this policy.

We are the data controller responsible for your personal data. Our contact details are:

Company: The Embroidery Company Ltd

Address: Unit 3B Ham Barn Business Park, Farnham Road, Liss, Hampshire, GU33 6LB

Email: info@simplemerch.co.uk

Companies House No: 4790257

VAT No: 897400886

If you have any questions about this policy or how we handle your data, please contact us using the details above.

We may collect and process the following categories of personal data:

• Identity data: your name, job role, and organisation.

• Contact data: your email address and phone number (where provided).

• Account data: your login credentials (managed securely via one-time passcode authentication), organisation membership, and user role.

• Order data: products ordered, sizes, colours, quantities, delivery addresses, and order history.

• Token data: reward token balances, allocations, and redemption history.

• Technical data: your IP address, browser type, and usage data collected through cookies and similar technologies.

• Correspondence data: messages you send us via contact forms or email.

We do not collect special category personal data (such as health, religion, or ethnicity). If you provide any such data inadvertently, we will not process it without your explicit consent.

We process your personal data for the following purposes:

• To set up and manage your account and grant access to your organisation's store.

• To process and fulfil your orders, including delivery and order tracking.

• To administer the token rewards programme, including allocating, tracking, and redeeming tokens.

• To communicate with you about your account, orders, and relevant updates.

• To provide administrative and customer support.

• To maintain records for accounting, tax, and invoicing (including VAT-compliant records).

• To ensure the security and proper functioning of the Service.

• To comply with our legal and regulatory obligations.

We will only process your data for these specified purposes and will not use it in a way that is incompatible with those purposes.

Under the UK GDPR, our legal bases for processing your personal data are:

• Performance of a contract: to fulfil your orders and deliver the Service you have requested.

• Legal obligation: to maintain records required for tax, accounting, and regulatory compliance.

• Legitimate interests: to operate and improve the Service, ensure security, and communicate with you, provided this does not override your rights.

• Consent: where you have given clear consent, for example to non-essential cookies or marketing communications. You may withdraw consent at any time.

We use cookies and similar technologies to operate and improve the Service. Cookies are small files stored on your device.

• Essential cookies: required for the Service to function (e.g. authentication and security). These cannot be disabled.

• Functional cookies: remember your preferences (e.g. consent choices and session state).

• Analytics cookies: help us understand how visitors use the Service so we can improve it.

When you first visit the Service, we will display a cookie consent bar allowing you to accept all cookies or reject non-essential ones. You may change your cookie preferences at any time. For more detail, see our cookie configuration available to site administrators.

We do not sell your personal data. We may share your data with the following categories of recipients where necessary:

• Your organisation's administrators — so they can manage users, products, orders, and token allocations within your organisation's store.

• Payment processors (e.g. Stripe) — to securely process card payments. Payment processors are independent data controllers of the data they collect.

• Delivery couriers — to fulfil and ship your orders.

• IT and hosting providers — to operate and maintain the Service securely.

• Professional advisers and authorities — where required for legal, tax, or regulatory compliance.

We require all third parties to protect your data appropriately and to process it only for the purposes for which it is shared.

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy, including any legal, accounting, or reporting requirements.

• Account data is retained for the lifetime of your account and a reasonable period thereafter for record-keeping.

• Order and transaction data is retained for up to 7 years to meet tax and accounting obligations.

• Token data is retained while your account is active.

• Contact form submissions are retained for up to 2 years.

When your data is no longer needed, we will either delete it or anonymise it so that you can no longer be identified.

Under the UK GDPR, you have the following rights:

• The right to be informed about how we use your data (this policy).

• The right of access to your personal data and a copy of it.

• The right to rectification of inaccurate or incomplete data.

• The right to erasure ("right to be forgotten") in certain circumstances.

• The right to restrict or object to processing.

• The right to data portability.

• Rights relating to automated decision-making and profiling.

• The right to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, please contact us using the details in section 2. We will respond within one month of receiving your request.

Your personal data is primarily stored and processed within the United Kingdom. Where data is transferred outside the UK, we will ensure appropriate safeguards are in place — such as UK GDPR adequacy decisions or Standard Contractual Clauses — to protect your data to UK standards.

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or disclosure. These include encrypted authentication, access controls, regular reviews, and secure hosting infrastructure. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Service is intended for use by organisations and their authorised users. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us and we will take steps to delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or the Service. We will notify you of significant changes by posting the updated policy on the Service and updating the "last updated" date. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

Email: info@simplemerch.co.uk

Address: Unit 3B Ham Barn Business Park, Farnham Road, Liss, Hampshire, GU33 6LB, United Kingdom

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data appropriately.