1. Who we are
CORE FUGAZI is run by [Business legal name], the "controller" of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. In this policy "we", "us" and "our" mean that business.
- Trading name: CORE FUGAZI
- Legal name: [Business legal name]
- Address: [Business address]
- Email: corefugazi@gmail.com
For anything to do with your data, email corefugazi@gmail.com or use our contact form.
2. What we collect
When you place an order
- Your name, email address, phone number and delivery address.
- What you ordered, the price paid, the delivery option, and the payment and delivery status.
- Limited payment information from our payment provider, such as the payment method type and the last four digits of a card. We never receive or store your full card number, expiry date or security code.
When you contact us or sign up for emails
- Contact form: your name, email address, optional order reference, the topic and your message.
- Newsletter: your email address and the date you signed up.
When you browse
- Your shopping bag (product, size and quantity only) is saved in your own browser so it is still there next time. It is not sent to us until you check out.
- Our hosting provider keeps standard server logs (such as IP address, browser type and the page requested) for security and to keep the site running. Your IP address is also used briefly in memory to limit repeated requests and block abuse; we do not store it with your order.
We do not use advertising, tracking or analytics cookies, and we do not build marketing profiles about you. See our Cookie Policy.
3. Why we use it and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|
| Taking payment, delivering your order, handling returns, refunds and order questions | Contract |
| Keeping order and payment records for tax and accounting | Legal obligation |
| Preventing fraud, chargebacks and misuse, and keeping the site secure | Legitimate interests |
| Answering messages you send us | Legitimate interests (or contract, if it is about an order) |
| Sending our newsletter | Consent, which you can withdraw at any time |
| Dealing with legal claims | Legitimate interests |
You do not have to give us your details, but we cannot process an order without a name, email address, delivery address and payment.
4. Fraud checks
Payments are screened by our payment provider's automated fraud tools, which may decline a payment that looks high-risk. If you think a payment was declined in error, contact us and a person will review it.
5. Who we share it with
We only share what each party needs to do its job, and we never sell your personal data.
- Stripe, our payment provider, which collects your card details directly on its own secure checkout page and processes your payment. Stripe is certified to PCI DSS Level 1, the highest card-industry security standard. See Stripe's privacy policy.
- Our website hosting and database providers, which store the site and order records for us.
- Delivery companies, which receive your name, address and, where needed for delivery updates, your phone number or email.
- Email services, if we email you about your order or our newsletter.
- Professional advisers and authorities (such as accountants, HMRC, the police or a court) where the law requires it or to protect against fraud.
These providers act on our instructions under written contracts and must keep your data secure.
6. International transfers
Some providers, including Stripe, may process data outside the UK. When they do, the transfer is protected by an approved safeguard, such as a UK adequacy decision, the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Agreement.
7. How long we keep it
- Orders, payments and refunds: 6 years from the end of the financial year they belong to, as required for UK tax records.
- Orders that were never paid for: up to 12 months, then deleted.
- Contact messages: 24 months after we last reply, unless they relate to an order or a claim.
- Newsletter sign-ups: until you unsubscribe. We then keep your email address on a suppression list so we do not email you again.
- Your shopping bag stays in your browser until you clear it or check out.
8. How we protect it
- The whole site runs over encrypted HTTPS, with strict browser security headers.
- Card details go straight to Stripe and never touch our servers.
- Payment confirmations from Stripe are cryptographically signed, and we reject any that cannot be verified.
- Prices and stock are always checked on our server, so an order cannot be changed in the browser.
- Our admin area is password-protected and only the people who run the store can access it.
- Forms and order lookups are rate-limited to block automated attacks.
- We collect only what we need and delete it when we no longer need it.
No system is completely secure. If a breach puts your data at risk, we will report it to the Information Commissioner's Office within 72 hours where required, and tell you without undue delay if there is a high risk to you.
9. Your rights
Under UK data protection law you have the right to:
- get a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, unless we must keep it (for example, tax records);
- restrict or object to how we use it, including at any time to direct marketing;
- receive the data you gave us in a portable format;
- withdraw your consent, for example by unsubscribing from emails.
To use any of these rights, email corefugazi@gmail.com. We will reply within one month. It is free, though we may need to confirm your identity first.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Age
Our store is for adults aged 18 and over. We do not knowingly collect data from children.
11. Changes to this policy
We will update this page if anything changes, and the date at the top will show the latest version.