Privacy Policy

Last updated: 4 September 2026

This policy explains what personal information Brandum Limited collects, why we collect it, how long we keep it and what rights you have over it. We have written it in plain English rather than legal language, and we have named the specific companies we share data with rather than hiding behind vague categories.

1. Who we are and how to contact us

Brandum Limited is the data controller for the personal information described in this policy. That means we decide what is collected and why, and we are responsible for looking after it.

Brandum Limited is registered with the Information Commissioner's Office as a data controller. We are not required to appoint a Data Protection Officer; questions about this policy should go to the email address above.

2. What we collect

When you place an order

• Your name, and your company name where relevant
• Billing and delivery addresses
• Email address and telephone number
• Order details — the garments, sizes, quantities and decoration you ordered
• Artwork and files you upload or send us
• Correspondence with us about your order

We never see or store your full card details. Payments are handled by our payment providers, who process your card information directly on their own systems. We receive only confirmation that a payment succeeded, and the last four digits and card type for reconciliation.

When you contact us

• Your name and contact details
• The content of your message, quote request or enquiry
• Notes we make of telephone conversations

When you use our website

• Pages visited, time spent, and how you arrived at the site
• IP address, browser type and device information
• Where you have accepted the relevant cookies: a recording or heatmap of how you moved around a page, collected through Hotjar — see section 9
• Information collected through the other cookies described in section 9

When you create an account

• Your login details, with your password stored in encrypted form
• Saved addresses and order history

3. Why we use it, and our lawful basis

Data protection law requires us to have a valid reason — a "lawful basis" — for using your information. Ours are set out below.

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and concluded that it is not. You can ask us to explain that assessment, and you can object — see section 12.

4. Artwork and images you send us

Artwork deserves its own section, because it is the most sensitive thing most customers send us.

• We use your artwork only to produce your order. We do not sell it, license it, or share it with anyone except suppliers who need it to fulfil your order.
• Artwork often contains personal information about people other than you — names and numbers on team kit, class lists on leavers' hoodies, photographs, dates on memorial garments. We treat that information with the same care as any other personal data, and we rely on you having authority to provide it.
• We keep artwork after your order so you can reorder without resupplying it. If you would rather we deleted it, tell us and we will.
• Photographs of finished work. We may photograph what we produce and show it as an example of our work. If your order contains anything personal, or you would simply rather we did not, tell us in writing before production and we will not.

5. Our free online tools

Standard website analytics still apply to those pages as they do to the rest of the site — we can see that a page was used, but not what you used it on.

6. How long we keep it

When a retention period ends we delete the information, or anonymise it so it can no longer identify you.

7. Who we share it with

We share your information only where we need to. We do not sell it, and we never share it for anyone else's marketing.

Where a supplier processes data on our behalf, we have a written contract requiring them to keep it secure and use it only on our instructions.

8. Sending data outside the UK

Some of the companies above are based outside the UK or store data outside it — Stripe, PayPal, Klarna, Google, Meta and Hotjar all involve transfers to the United States or the EEA.

Where personal data leaves the UK, it is protected by one of the safeguards the law allows: either the receiving country has UK "adequacy" status, or the transfer is covered by the International Data Transfer Agreement, or by the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards applying to a particular transfer.

9. Cookies and tracking

Cookies are small files a website stores on your device. Similar technologies include pixels and local storage. We group ours as follows.

Strictly necessary — always on

These make the site work and cannot be switched off. They keep items in your basket, keep you logged in, remember your cookie choices, and protect against fraud. They include our shopping basket and session cookies, our contact form's cookie, and the cookie recording your consent decision.

Analytics and performance — only with your consent

• Google Analytics 4 and Google Tag Manager — how many people visit, which pages they use, and where problems occur.
• Hotjar — records how visitors scroll and click on a page, and produces heatmaps. This helps us see where a page confuses people. Hotjar is configured to suppress the text you type into forms, so it does not capture what you write.
• Order source tracking — records how you arrived at our site so we know which of our efforts bring customers.

Advertising — only with your consent

• Google Ads conversion tracking, and the Meta (Facebook) pixel — measure whether an advert led to an order, and let us show relevant adverts.

Your control

Our cookie banner is set so that nothing beyond strictly necessary cookies runs until you choose to allow it. Analytics and advertising are switched off by default. You can change your choices at any time using the cookie settings link on our site, and you can clear cookies in your browser at any point.

10. Marketing

We do not currently send marketing emails or newsletters.

If we start, we will only email you if you have asked us to, or if you have bought from us and we are telling you about similar products — and in either case every message will carry a clear unsubscribe link that we act on promptly. We will never buy a marketing list or email people who have not dealt with us.

Messages about an order you have placed — proofs, despatch notices, delivery updates — are part of fulfilling your order rather than marketing, and you will continue to receive those.

11. How we keep it safe

We take appropriate measures to protect your information, including an encrypted connection to our website, access controls limiting who can see customer and order data, encrypted storage of passwords, and keeping our software up to date.

No system is completely secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it, and tell you directly where the risk to you is high.

12. Your rights

You have the following rights over your personal information:

• Access — ask for a copy of what we hold about you.
• Correction — have inaccurate information corrected.
• Deletion — ask us to delete information where we no longer need it. We may need to keep some records for tax purposes.
• Restriction — ask us to pause using your information while a query is resolved.
• Objection — object to us using your information where we rely on legitimate interests. Where you object to direct marketing, we will always stop.
• Portability — receive information you gave us in a machine-readable format, or have it sent to another provider.
• Withdraw consent — where we rely on consent, withdraw it at any time. This does not affect anything done before you withdrew it.

To exercise any of these, email customersupport@brandum.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity first.

13. Children and young people

Our website is not aimed at children, and we do not knowingly collect personal information directly from anyone under 16.

We recognise that many of our orders involve children's details — school leavers' hoodies, club kit, team names and numbers. Where an adult, school or club places such an order, we rely on them having authority to provide those details. We use that information only to produce the order, we do not use it for marketing, and we keep it only as long as the order and our records require.

14. Changes to this policy

We may update this policy. The date at the top shows when it last changed. Where a change materially affects how we use your information, we will tell you directly rather than relying on you noticing.

15. Complaints

If you are unhappy with how we have handled your information, please tell us first at customersupport@brandum.com — we would like the chance to put it right.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator: