Privacy Policy

GMC Shop Ltd ("we", "us", "our") is the data controller responsible for your personal data when you use our website or purchase from us. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZA000000. Our registered office is at 12 Marsden Street, Manchester, M2 1HW, United Kingdom.

We collect the following categories of personal data:

• Identity & contact data: full name, email address, phone number, billing and delivery addresses.
• Order data: products purchased, order history, order value, shipping method, and delivery preferences.
• Payment data: last four digits of your card, card brand, and expiry date. Full card numbers are processed and stored solely by Stripe and never reach our servers.
• Technical data: IP address, browser type and version, device identifiers, time zone, and pages visited.
• Marketing preferences: your consent choices for our newsletter and promotional communications.

We use your personal data on the following lawful bases:

• Performance of a contract: to process and deliver your orders, handle returns, and provide customer support.
• Legal obligation: to comply with HMRC record-keeping requirements, tax law, and consumer-protection legislation.
• Legitimate interests: to operate our business, prevent fraud, improve our products and services, and ensure the security of our website.
• Consent: to send you marketing communications (which you can withdraw at any time) and to set non-essential cookies.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We only collect data that is necessary for the purposes set out above, we keep it accurate and up to date, and we apply appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure.

Cookies are small text files placed on your device when you visit a website. We use three categories of cookies:

• Strictly necessary: required for the site to function, including session management and your shopping basket. These do not require consent.
• Analytics: help us understand how visitors use the Site so we can improve it. Set only with your consent.
• Marketing: used to measure the effectiveness of advertising. Set only with your consent.

You can review or change your preferences at any time using the "Cookie settings" link in the footer. Blocking cookies may impact the functionality of the Site.

We share personal data only with carefully selected processors who act on our instructions and provide adequate safeguards:

• Stripe Payments UK, Ltd — processes card and wallet payments. See stripe.com/gb/privacy.
• Royal Mail and selected couriers — for delivery of your orders.
• Email service providers — for transactional and (with consent) marketing emails.
• Cloud hosting providers within the UK/EEA — for secure storage and processing.

Where data is transferred outside the UK, we rely on the UK International Data Transfer Agreement or equivalent safeguards approved by the ICO.

We retain personal data only for as long as necessary:

• Order and transaction records: 7 years, to comply with HMRC requirements.
• Account information: for as long as your account is active, then deleted within 12 months of closure.
• Marketing preferences: until you withdraw consent.
• Cookies: per the duration set on each cookie, typically 30 days to 24 months.

Under UK GDPR you have the right to:

• Request access to a copy of the personal data we hold about you;
• Request correction of inaccurate or incomplete data;
• Request erasure of your data ("right to be forgotten");
• Object to or restrict processing based on legitimate interests;
• Request data portability in a structured, machine-readable format;
• Withdraw consent at any time where processing relies on consent;
• Lodge a complaint with the Information Commissioner's Office at ico.org.uk.

To exercise any of these rights, contact our DPO using the details below. We will respond within one calendar month.

Our Data Protection Officer can be reached at:

• Email: dpo@gmcshop.co.uk
• Post: Data Protection Officer, GMC Shop Ltd, 12 Marsden Street, Manchester, M2 1HW