This policy explains what personal information we collect when you visit or buy from old-school.com, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

1. Who we are

1.1     Old School Brand UK Ltd is the data controller responsible for your personal information.

 

Old School Brand UK Ltd

Registered in England and Wales, company number 16513086

Registered office: 1 Merus Court, Meridian Business Park, Leicester, Leicestershire, LE19 1RJ, United Kingdom

VAT registration number: GB 511 6732 15

Email: support@old-school.com

Website: old-school.com

1.2     You can contact us about anything in this policy, including any request about your personal information, by emailing support@old-school.com or by writing to the registered office address above.

1.3     Customers in South Africa are served by our South African website under a separate privacy notice.

2. What we collect

Category	Examples	Where it comes from
Identity and contact	Name, email address, telephone number, billing address, delivery address	From you
Order and transaction	Items ordered, order value, order history, delivery details, the last four digits and expiry of your payment card	From you and our payment processor. We never see or store your full card number
Device and usage	IP address, browser type and version, time zone, device identifiers, pages viewed, search terms, referring site, how you interact with the site	Collected automatically through cookies and similar technologies
Marketing and communications	Subscription preferences, records of consent, engagement with our emails and messages	From you and our marketing platform
Customer service	Correspondence with our team, returns records, complaint records	From you
Fraud prevention	Risk indicators and scores associated with an order	From our payment and fraud prevention providers

 

We may also collect additional information if you contact us for support, enter a competition, or leave a product review.

Special category data

We do not ask for, and do not knowingly collect, special category data. Under UK and EU data protection law that means information revealing your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, together with genetic data, biometric data used to identify you, data about your health, and data about your sex life or sexual orientation.

Please do not send us information of this kind. If you do include it in a message to our team, for example when explaining why you need to return an item, we will use it only to answer you and will delete it once it is no longer needed for that purpose.

3. Why we use it, and our lawful basis

We only use your personal information where the law allows. The basis we rely on for each purpose is set out below.

Purpose	Information used	Lawful basis
Processing and delivering your order, and handling returns, exchanges and refunds	Identity, contact, order	Performance of a contract with you
Taking payment	Order, transaction	Performance of a contract with you
Keeping accounting and tax records	Identity, order, transaction	Compliance with a legal obligation
Screening orders for fraud and misuse	Order, device, fraud prevention	Legitimate interests: preventing fraud and protecting our business and our customers
Operating, securing and troubleshooting the website	Device, usage	Legitimate interests: keeping the site available, working and secure
Analytics, to understand and improve how the site is used	Device, usage	Consent, given through our cookie banner, in the UK, EU and other regions with equivalent rules. Legitimate interests elsewhere
Sending marketing emails and messages	Identity, contact, marketing	Consent. Where you have already bought from us we may send similar product updates in our legitimate interests, and you can opt out at any time
Showing you our advertising on other websites and apps	Device, usage, order	Consent, given through our cookie banner, in the UK, EU and other regions with equivalent rules
Responding to your enquiries and providing support	Identity, contact, customer service	Legitimate interests: providing a responsive customer service
Complying with legal requests, and establishing or defending legal claims	Any relevant category	Compliance with a legal obligation, or legitimate interests in defending claims

 

Where we rely on legitimate interests, we have assessed whether those interests are overridden by your rights and freedoms. You can object at any time. See section 8.

4. Who we share it with

We share personal information with the following categories of recipient, each of which is bound to use it only on our instructions:

•     our e-commerce platform, Shopify, which powers our online store (shopify.com/legal/privacy);

•     payment processors, who receive your card details directly;

•     couriers and logistics providers, to deliver your order;

•     our returns portal provider;

•     our email and SMS marketing platform;

•     analytics providers, including Google Analytics (policies.google.com/privacy);

•     advertising platforms, including Meta and Google, where you have consented;

•     our product review platform, where you choose to leave a review;

•     fraud prevention providers;

•     professional advisers, including our accountants, auditors, lawyers and insurers;

•     public authorities and law enforcement, where we are required to disclose by law, or to respond to a lawful request, or to protect our rights.

 

We do not sell your personal information for money. Please see section 9 for how "sell" and "share" are defined under United States state privacy laws, which is broader than the everyday meaning.

5. Cookies and similar technologies

5.1     Cookies are small files placed on your device when you visit our site. We also use comparable technologies such as pixels, tags and local storage. This policy refers to all of them as cookies.

5.2     Strictly necessary cookies keep the site working: your cart, checkout, login session, language and currency selection, and site security. These do not require your consent because the site cannot function without them.

5.3     All other cookies require your consent if you are in the UK, the EU, or another region with equivalent rules. This covers analytics, advertising and personalisation. When you first visit we show a banner where you can accept all, reject all, or choose by category. Rejecting is as straightforward as accepting.

5.4     You can change or withdraw your consent at any time through the Cookie Preferences link in our site footer.

5.5     A current list of every cookie we set, including those placed by Shopify, Google and Meta, together with its purpose and lifespan, is maintained in the Cookie Preferences panel. Lifespans range from the length of a single browsing session to two years.

5.6     You can also control cookies through your browser settings. Blocking cookies may mean parts of the site no longer work properly.

5.7     Do Not Track and Global Privacy Control. There is no consistent industry standard for responding to "Do Not Track" browser signals, and we do not currently respond to them. We do honour the Global Privacy Control signal where the law requires it, and treat it as a valid opt-out of sale and sharing for residents of the US states described in section 9.

6. Sending information outside your country

6.1     We are based in the United Kingdom. Your personal information may be processed outside your country of residence, including in the European Economic Area, the United States and South Africa.

6.2     Where we transfer personal information out of the United Kingdom, we rely on UK adequacy regulations, or on the International Data Transfer Agreement, or on the UK Addendum to the European Commission’s Standard Contractual Clauses.

6.3     Where we transfer personal information out of the European Economic Area, we rely on an adequacy decision or on the European Commission’s Standard Contractual Clauses.

6.4     Our wider group has operations in South Africa, which is not covered by an adequacy decision. Transfers there are made under Standard Contractual Clauses or the International Data Transfer Agreement, supported by a transfer risk assessment.

6.5     You can request a copy of the safeguards we use by emailing support@old-school.com.

7. How long we keep it

Category	Retention period
Order and transaction records	6 years from the end of the tax year in which the transaction took place, to meet UK tax and accounting requirements
Customer account details	For as long as your account remains open, then 12 months
Marketing contact details	Until you unsubscribe or withdraw consent. We keep the record of your withdrawal for a further 24 months so that we do not contact you again by mistake
Customer service correspondence	24 months from your last contact with us
Returns and warranty claims	6 years from the claim, to cover the period in which a legal claim could be brought
Website analytics	Up to 14 months
Cookie consent records	12 months
Fraud prevention records	6 years

 

At the end of these periods we delete or anonymise the information. We may keep it for longer where the law requires it, or where it is needed for an ongoing legal claim.

8. Your rights

Depending on where you live, you have some or all of the following rights. If you are in the UK or the EU, you have all of them.

•     Access: to receive a copy of the personal information we hold about you.

•     Rectification: to have information that is inaccurate or incomplete corrected.

•     Erasure: to have your information deleted in certain circumstances.

•     Restriction: to ask us to limit how we use your information in certain circumstances.

•     Portability: to receive your information in a structured, commonly used, machine-readable format, or to have it sent to another provider.

•     Objection: to object to processing we carry out on the basis of legitimate interests.

-      You have an absolute right to object to direct marketing. If you tell us to stop, we will stop, and we do not need a reason.

•     Withdraw consent: at any time, where we rely on your consent. Withdrawing does not affect the lawfulness of anything we did before you withdrew it.

•     Not to be subject to automated decisions that produce legal effects or similarly significant effects. See section 10.

 

8.1     To exercise any of these rights, email support@old-school.com. We will respond within one month. If your request is complex we may extend that by up to two further months, and we will tell you if so.

8.2     We may need to verify your identity before acting on a request.

8.3     Exercising these rights is free, and we will never treat you differently or provide you with a worse service because you did.

9. Additional rights for United States residents

9.1     If you live in California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, you have rights to know what we collect and why, to access, correct and delete your information, to opt out of targeted advertising and of the sale or sharing of your information, and to limit the use of sensitive personal information.

9.2     Sale and sharing. We do not sell personal information for money. However, when we use advertising cookies to show you Old School advertising on other websites, that may count as "selling" or "sharing" for cross-context behavioural advertising under the California Consumer Privacy Act and similar state laws. You can opt out at any time using the "Do Not Sell or Share My Personal Information" link in our site footer, through the Cookie Preferences panel, or by sending a Global Privacy Control signal from your browser.

9.3     In the twelve months before the date of this policy we collected the categories of personal information listed in section 2, used them for the purposes in section 3, and disclosed them to the categories of recipient in section 4.

9.4     What counts as sensitive personal information. United States state privacy laws treat a specific list of categories as sensitive. It covers:

•     government identifiers, such as a social security number, driving licence, state identification card or passport number;

•     your account login details, or a financial account, debit or credit card number together with any password or security code that would allow access to that account;

•     precise geolocation, meaning your specific physical location rather than your general area;

•     racial or ethnic origin, religious or philosophical beliefs, or trade union membership;

•     the contents of your mail, email or text messages, unless we are the intended recipient;

•     genetic data, and biometric data processed to identify you;

•     information about your health, your sex life or your sexual orientation.

 

9.5     What we actually hold. Selling clothing to you does not require any of the above, and we do not collect it. The one exception is that if you open an account with us, your login details fall into the second category. We use them only to operate your account and keep it secure, which is a permitted purpose that does not trigger the right to limit. We do not use sensitive personal information to infer characteristics about you, and we do not sell or share it.

9.6     We do not knowingly sell or share the personal information of anyone under 16.

9.7     Non-discrimination. We will not deny you goods or services, charge you a different price, or give you a different standard of service because you exercised any of these rights.

9.8     You may use an authorised agent to make a request on your behalf. We may ask for proof that you authorised them.

10. Automated decision-making

10.1   We do not make decisions about you that produce legal effects or similarly significant effects using solely automated means.

10.2   Our platform provider uses limited automated processing to prevent fraud, which does not have a legal or similarly significant effect on you. This includes temporarily blocking IP addresses associated with repeated failed transactions, which lasts a small number of hours, and temporarily blocking payment cards associated with those IP addresses, which lasts a small number of days.

10.3   If an order of yours is declined for fraud reasons and you believe that is wrong, contact us and a member of our team will review it personally.

11. Children

This site is not intended for children under 16, and we do not knowingly collect their personal information. If you are a parent or guardian and believe your child has given us personal information, email support@old-school.com and we will delete it.

12. Security

We use appropriate technical and organisational measures to protect your personal information, including encryption in transit, access controls, and limiting access to staff who need it to do their job. No system can be completely secure. If a breach occurs that is likely to result in a high risk to your rights, we will tell you and notify the relevant regulator as the law requires.

13. Complaints

13.1   Please contact us first at support@old-school.com. We would rather put something right than have you go elsewhere.

13.2   United Kingdom. You have the right to complain to the Information Commissioner’s Office at ico.org.uk, or by telephone on 0303 123 1113.

13.3   European Union. You have the right to complain to the supervisory authority in the country where you live or work, or where you believe the issue arose. Contact details for every authority are available from the European Data Protection Board at edpb.europa.eu.

13.4   United States. You may contact the Attorney General of your state.

14. Changes to this policy

We may update this policy from time to time to reflect changes in our practices or for operational, legal or regulatory reasons. The "last updated" date at the top of this document shows when it last changed. Where a change is significant, we will tell you by email or through a notice on the site.

15. Contact

For any question about this policy or about how we handle your personal information, contact us by email at support@old-school.com, or by post at the registered office address in section 1.