privacy.
Short version: I only use your details to make and deliver your order, to help you if you get in touch, and to email you about new drops if you’ve signed up. I don’t sell your data, and I don’t share it for anyone else’s marketing.
1. Who I am
passerby is run by Lucas Tinsley, a sole trader in the UK. I’m responsible for your personal data (the "controller" under UK data protection law). Contact me at [email protected]. My postal address is on the terms page.
2. What I collect and why
When you buy something
- What: your name, delivery address, email, phone number (if you give one) and what you ordered.
- Why: to make, post and support your order, including returns and refunds.
- Legal basis: it’s needed to carry out our contract. Without these details I can’t fulfil your order.
For my records
- What: order and payment records (not your card details).
- Why and legal basis: UK tax law requires me to keep business records (legal obligation).
When you contact me
- What: your name, contact details and what you tell me, by email or by message on Instagram or TikTok.
- Why: to reply and sort out your question or complaint.
- Legal basis: my legitimate interest in helping customers, or our contract if it’s about an order.
If you join the email list
- What: your email address, when you signed up and confirmed, and whether you open or click my emails.
- Why: to tell you about new drops.
- Legal basis: your consent. You confirm it by clicking the link in a confirmation email, and you can withdraw it any time with the unsubscribe link in every email. Buying a tee doesn’t add you to the list. You only join if you sign up.
I don’t make automated decisions about you, and I don’t build profiles for advertising.
3. Who I share it with
Only with the services I need to run the shop. Each one only gets what it needs:
- Square takes your payment and helps prevent fraud. I never see your full card details. Square also handles your payment data under its own privacy notice.
- Printful prints and posts your tee, so it receives your name, address, email and order details. It passes your address to the courier delivering it (such as Royal Mail or DPD).
- Kit (kit.com) stores the email list and sends the emails.
- Google (Gmail) hosts my business email.
- Cloudflare hosts this website and provides cookie-free visitor analytics.
- HMRC or an accountant, only if I’m legally required to share records.
4. Where your data goes
Some of these companies process data outside the UK, including in the United States and the EU. Your tee may also be printed at a facility in the EU or US. When data leaves the UK, it’s protected by UK adequacy rules or the UK’s approved safeguards for international transfers, such as the International Data Transfer Addendum.
5. How long I keep it
- Order records: 6 years after the end of the tax year, because UK tax law requires it.
- Emails and messages: up to 2 years after we last spoke, unless they’re part of an order record.
- Email list: until you unsubscribe. If you haven’t opened anything from me in 2 years, I’ll remove you.
6. This website, analytics and cookies
I use Cloudflare Web Analytics to see how many people visit, which pages they look at and roughly where they’re coming from (for example, a TikTok link). It doesn’t use cookies, doesn’t track you across other sites and doesn’t build a profile of you. My legal basis is my legitimate interest in understanding how the shop is used.
This site doesn’t set any tracking or advertising cookies, so there’s no cookie banner. Cloudflare hosts the site and processes technical data like your IP address to deliver pages and keep them secure. It may set a strictly necessary security cookie. Checkout happens on Square’s site, which has its own cookie policy.
7. Keeping it safe
I use reputable services with strong security, protect my accounts with two-factor authentication, and only keep what I need. If there’s ever a data breach that puts you at risk, I’ll tell you and the ICO as the law requires.
8. Your rights
You have the right to:
- ask for a copy of your data
- correct anything that’s wrong
- ask me to delete it, unless I have to keep it for legal reasons (like tax records)
- restrict or object to how I use it
- get your data in a portable format
- withdraw your consent at any time (for the email list)
Email [email protected] and I’ll respond within one month. It’s free. If you’re not happy with how I’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
9. Children
This shop isn’t aimed at children under 13, and I don’t knowingly collect their data.
10. Changes
If I change this policy, I’ll update the date at the top. If it’s a big change, I’ll let customers and subscribers know.