Privacy Policy

Effective and last reviewed: 9 September 2026.

This policy explains how VAIN & MORTAL collects and uses personal information when you visit www.vainandmortal.co.uk, join the email list, contact us or buy from us.

1. Who is responsible for your information?

The data controller is Chris Roys, a sole trader trading as VAIN & MORTAL / Vain and Mortal Alternative Clothing ("we", "us" or "our").

Address: 2 the Villas, Ollerton Road, Edwinstowe, Nottinghamshire, NG21 9QF, United Kingdom
Email: support@vainandmortal.co.uk

Use the subject "Privacy request" or "Data protection complaint" where appropriate.

2. Information we collect

Depending on how you use the store, we may collect:

• Identity and contact information: name, email address, delivery and billing addresses and any telephone number you provide or the checkout requires.
• Order information: products, variants, sizes, prices, discounts, delivery method, order status, returns, refunds and related correspondence.
• Payment information: payment status, payment method and limited transaction information supplied by the provider shown at checkout. Payment credentials are entered into that provider's systems; we receive only the information the provider makes available to the store.
• Communications: enquiries, complaints, product-safety reports and messages sent through the contact form, email or another support channel.
• Marketing information: email-list subscription, the date and source of the sign-up, the notice associated with it, preferences, and unsubscribe or objection records.
• Technical and usage information: IP address, browser and device information, pages viewed, referral information, cart activity, cookie or similar identifiers and security or diagnostic information.
• Fraud and security information: risk indicators supplied by Shopify, a payment provider or another service used to protect transactions and the site.

Please do not send health information, identity documents or other sensitive information through the general contact form unless we specifically ask for it and explain why it is needed.

3. Where information comes from

We obtain information directly from you; from someone who places an order for delivery to you; from Shopify and the provider used at checkout; from our fulfilment and delivery providers; and automatically from a browser or device through cookies and similar technologies, subject to the applicable choices.

4. Why we use information and our lawful bases

Our legitimate interests include operating and securing the store, preventing fraud, providing effective support and protecting legal rights. We consider those interests against the possible effect on your rights and freedoms.

5. Information needed for an order

Information marked as required at checkout is needed to take payment, form and perform the contract, deliver goods and meet legal obligations. We cannot process an order without it. Joining the email list is optional and is not a condition of buying from us.

6. Email marketing

If you submit a dedicated email-list form, we use the email address to send the launch, product and collection emails described beside that form. We do not add a contact-form user to marketing merely because they contacted us.

You may unsubscribe through the link in an email or by contacting us. Withdrawing consent does not affect processing that occurred before withdrawal. We may retain a minimal suppression record so that we continue to respect an unsubscribe or direct-marketing objection.

You have an absolute right to object to the use of your information for direct marketing. If you object, we will stop that marketing.

7. Who receives information?

We disclose only the information reasonably needed for the relevant service to:

• Shopify, which hosts the storefront, checkout and related commerce services;
• Google Ireland Limited (Google Analytics), to provide consent-controlled website usage and ecommerce measurement;
• the payment provider shown at checkout, for payments, refunds and fraud checks;
• Hyper Merch Limited trading as Inkthreadable, our print-on-demand fulfilment provider, for production, packing and dispatch;
• delivery companies, for transport, tracking and delivery;
• email and technical service providers, where used to operate the site or deliver requested communications;
• professional advisers, insurers and accountants where reasonably necessary; and
• courts, regulators, law-enforcement bodies or public authorities where disclosure is required or permitted by law.

If the business or its assets are sold or reorganised, relevant information may be disclosed to advisers and a prospective or actual successor subject to appropriate confidentiality and data-protection requirements.

Shopify's own processing

Shopify generally processes store-customer information to provide services to us. Shopify may act as an independent controller when you choose a Shopify-controlled service such as Shop or Shop Pay, or where an enabled Shopify feature provides enhanced services. Read the Shopify Consumer Privacy Policy. Shopify also provides a privacy portal for processing for which it is the controller.

Google Analytics

We use Google Analytics 4 through Shopify's Google & YouTube integration to understand how visitors find and use the store and how the buying journey performs. Subject to the applicable consent choice, this can include page views, searches, product and collection views, cart activity, checkout steps and purchases, together with referral information, device and browser information, general location, cookie or similar identifiers, and ecommerce details such as product, currency, value and a transaction reference. We do not intend to send names, email addresses, delivery addresses or payment-card details to Google Analytics.

Google Ireland Limited processes Analytics data on our behalf under Google's applicable data-processing terms. Read How Google uses information from sites or apps that use its services and Google Analytics data privacy and security information. You can refuse or withdraw optional analytics consent through the store's privacy controls as described in our Cookie Policy.

8. International transfers

Shopify, Google and some service providers may process information outside the United Kingdom. Shopify documents transfers to Canada and other locations in its privacy information and data-processing terms. Where UK law requires a transfer safeguard, the transfer must be covered by an applicable adequacy regulation or an approved contractual mechanism, such as the UK International Data Transfer Agreement or UK Addendum. Contact us for information about the relevant safeguard.

9. How long we keep information

We use the following criteria rather than keeping every record for the same period:

• order, transaction, return and refund records are kept for as long as needed to perform the contract and meet tax, accounting, consumer-law, safety and legal-claims requirements;
• general enquiries are kept until resolved and for a limited period afterwards where reasonably needed for follow-up or to establish what was agreed;
• complaint, rights-request and dispute records are kept while the matter is active and afterwards for the period reasonably needed to evidence its handling or address a legal claim;
• email-list details are kept until consent is withdrawn, you object, or they are removed following a reasonable inactivity review; a minimal suppression record may be kept for longer;
• Google Analytics user-level and event-level data follows the retention settings applied in the relevant Analytics property and may be deleted or aggregated sooner where appropriate;
• security and diagnostic records follow the service provider's documented cycle unless an incident, fraud concern or legal requirement justifies longer retention; and
• where information is no longer needed, it is deleted or anonymised, subject to protected backup cycles and legal restrictions.

Factors considered include the amount and sensitivity of the information, risk of harm, the purpose, whether that purpose can be achieved another way, provider controls and applicable legal periods.

10. Your rights

Depending on the circumstances, UK data-protection law gives you rights to request access, correction, erasure or restriction; receive certain information in a portable format; object to processing based on legitimate interests; object to direct marketing; withdraw consent; and challenge qualifying decisions made solely by automated means.

Shopify, payment providers or fraud-prevention services may use automated risk indicators. If an automated decision has a legal or similarly significant effect, contact us and we will explain the applicable route and rights. Rights are not absolute and exemptions may apply.

Email us to exercise a right. We may ask for proportionate information to confirm identity. We normally respond within one month; the law permits an extension in some complex cases.

11. Data-protection complaints

Email support@vainandmortal.co.uk with the subject "Data protection complaint", or write to the address above. Explain what happened, the information involved and the outcome you seek. You do not have to use legal terminology or a particular channel.

We will acknowledge a data-protection complaint within 30 days, make appropriate enquiries without undue delay, keep you informed where the investigation continues, and explain the outcome and any action taken without undue delay.

You may also complain to the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Telephone: 0303 123 1113
ico.org.uk/make-a-complaint

12. Security

We take appropriate technical and organisational measures intended to protect personal information. No internet transmission or storage system can be guaranteed completely secure.

13. Other websites

Another organisation's website or service is governed by its own privacy information. We are not responsible for that organisation's independent processing.

14. Changes

We may update this policy when services, suppliers or legal obligations change. The effective date identifies the current version. Where a change materially affects you, we will provide an additional notice where appropriate. A later policy does not retrospectively change the legal basis on which information was collected.