Privacy Policy

1. The information we collect

We collect the following information, depending on how you use the site:

• Order and delivery details — your name, email address, telephone number, billing and delivery addresses, and the contents and value of your order.
• Design details — the text, images, logos and artwork you upload or create, the design choices you make (such as size and optional upgrades), and the finished design preview we generate for your order.
• Payment information — payments are handled by our payment provider, Stripe. We receive confirmation that a payment has been made together with a payment reference; we do not receive or store your full card details.
• Messages you send us — anything you send through our contact form or our live chat, including your name and email address if you provide them, the content of the conversation, and the page you were on when the chat started.
• Reviews — if you leave a review, your name, rating, review text and any photographs you upload.
• Technical and usage information — your IP address, browser, device and operating system, screen size, language and time zone, the approximate location derived from your IP address (country and region), the pages you view, the site you arrived from, and any campaign parameters in the link you followed.
• Anonymous analytics — information about how visitors use the site. This is collected only if you accept our analytics banner, and it is not used to identify you personally.
• Your basket — the items in your basket are stored in your own browser so that they are still there when you return, and are only sent to us when you place an order.

2. How we use your information

We use your information for the following purposes:

• To process, print and deliver your order, and to take payment — this is necessary to perform our contract with you.
• To produce the artwork file we print from, and to keep a record of the design you approved.
• To send you order updates, including confirmation, dispatch and delivery notifications.
• To answer your questions and provide customer support, including through our live chat.
• To invite you to leave a review after your order has been dispatched, where you have agreed to receive marketing or where you are an existing customer and we are permitted to contact you.
• To keep our accounts, handle refunds, and meet our legal, tax and accounting obligations.
• To understand how visitors find and use the site so that we can improve it — based on anonymous analytics, and only with your consent.
• To keep the site secure, prevent fraud and misuse, and protect our legal rights — this is in our legitimate interests.

Where we rely on your consent (for example for analytics or marketing emails), you can withdraw it at any time. Withdrawing consent does not affect anything we did before you withdrew it.

3. Order processing

When you place an order we create a record containing your order details, the design you approved, your delivery and billing details, and the payment reference. That record is used to produce your flag, to dispatch it, to handle any queries or returns, and to keep the accounting records we are required by law to keep.

We send you transactional emails about your order — for example a confirmation when you order and an update when your flag is dispatched, including tracking details where available. These are part of the service you have bought, not marketing, and are sent to the email address you gave us.

4. Payments and third-party providers

Card payments are taken by Stripe on their secure hosted payment pages. Your card details are entered directly with Stripe and are never held on our servers. Stripe processes that information as a separate controller for its own regulatory purposes; you can read Stripe's privacy policy at https://stripe.com/privacy.

We use third-party service providers (our “processors”) to run the site and fulfil orders. They may only use your information on our instructions:

• Stripe — to process payments, issue refunds and carry out fraud checks.
• Base44 — the platform that hosts this website, stores our data, sends our emails and stores uploaded files.
• Our email provider — to deliver order confirmations, dispatch notifications and other service emails to you.
• Delivery couriers — we share your name, delivery address and telephone number so that your flag can be delivered.
• Google — we publish product information (such as product names, descriptions and prices) to Google Merchant Center so that our flags can appear in Google Shopping. This feed contains product data, not your personal information.
• Regulators, law enforcement and professional advisers — where we are required by law to share information, or where it is necessary to establish, exercise or defend a legal claim.

We do not sell your personal information, and we do not share it with advertisers.

5. Cookies and analytics

Cookies and similar browser storage technologies are small pieces of data stored on your device. We keep their use to a minimum:

• Essential storage — remembering the items in your basket, remembering whether you have accepted or declined analytics, and keeping your live chat session open. These are needed for the site to work and cannot be switched off.
• Anonymous analytics — with your consent, we record anonymous information about how the site is used, such as which pages are viewed and which designs are started, so that we can improve the site. Nothing is collected until you accept, and if you decline, no analytics is recorded for you at all.

We do not use advertising or cross-site tracking cookies on this site, and we do not share your information with advertising networks.

You can change your mind about analytics at any time by clearing the site data in your browser, after which the banner will ask you again. You can also block or delete cookies through your browser settings; please note that blocking essential storage may stop parts of the site, such as your basket or the live chat, from working properly.

6. Marketing communications

We only send marketing emails where we are allowed to do so — either because you have asked to hear from us, or because you are an existing customer and we are emailing you about similar products under the soft opt-in rules.

Every marketing email we send includes a way to unsubscribe, and you can also ask us to stop at any time by emailing hello@footballflags.co. If you opt out of marketing you will still receive essential messages about orders you have placed with us.

7. Data security

• The site is served over an encrypted (HTTPS) connection, so information you send us is encrypted in transit.
• Access to customer information is restricted to the members of our team who need it to process orders and answer enquiries.
• Card payments are handled entirely by Stripe, which is PCI DSS compliant. We never store your full card details.
• We keep our systems and accounts up to date and protect them with strong credentials.

No method of transmission or storage is completely secure, but we take these measures to keep your information safe. If a breach ever affected your rights, we would tell you and the Information Commissioner's Office without delay, as the law requires.

8. How long we keep your information

• Order, payment and accounting records: kept for as long as UK tax and accounting law requires us to keep them, which is currently six years from the end of the relevant tax year.
• Design files and artwork: kept while your order is active and for as long as we need them to handle any query or claim about that order.
• Contact messages and live chat conversations: kept for as long as we need them to help you, and then deleted.
• Anonymous analytics: kept in aggregate form, and not linked to you.
• Reviews: kept for as long as they are published on our site, or until you ask us to remove them.

Where we no longer need information and are not required to keep it, we delete it securely. You can ask us to delete anything we are not obliged to retain — see your rights below.

9. Transfers outside the UK

Some of our service providers, including our payment provider and website platform, may process information outside the United Kingdom. Where they do, we make sure the transfer is protected by the appropriate safeguards under UK data protection law — such as the UK's adequacy regulations or an approved international data transfer agreement or addendum — so that your information continues to receive an equivalent level of protection.

10. Your rights

Under UK GDPR you have the right to:

• Access a copy of the personal information we hold about you, and information about how we use it.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to delete information we no longer need to keep.
• Ask us to restrict how we use your information while a concern is being resolved.
• Object to processing based on our legitimate interests, and to object to direct marketing at any time.
• Receive information you gave us in a portable, machine-readable format, or ask us to send it to another provider.
• Withdraw consent at any time where we are relying on your consent.

To exercise any of these rights, email us at hello@footballflags.co. We will respond within one month, and there is normally no charge. We may need to confirm your identity before we act on a request.

We do not carry out automated decision-making that has a legal or similarly significant effect on you. Our payment provider carries out limited automated fraud checks, such as temporarily blocking IP addresses linked to repeated failed payments, which does not have a significant effect on you.

If you are unhappy with how we have handled your information or a request, please contact us first so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Children

This site is intended for adults. We do not knowingly collect personal information from children. If you are a parent or guardian and believe a child has given us their information, please contact us and we will delete it.

12. Links to other websites

Our site may link to other websites, such as our payment provider or social media pages. We are not responsible for how those websites handle your information, so please read their privacy policies before using them.

13. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or in the law. The version published on this page is the one that applies, and the date at the top shows when it was last updated.