This policy explains what personal data MTB Outlaws collects, how we use it, and your rights under UK GDPR and the Data Protection Act 2018.
1. Data we collect
- Account data: name, email address, password (hashed), and chapter affiliation.
- Order data: shipping address, billing address, items ordered, order history.
- Payment data: handled directly by our payment processor — we do not store full card details.
- Technical data: IP address, browser type, basic analytics on how you use the site.
2. How we use it
- To process and ship your orders.
- To manage your account and chapter membership.
- To send transactional emails (order confirmations, password resets).
- To send event updates and newsletters where you've opted in.
- To keep the site secure and improve it.
3. Legal basis
We process your data on the basis of contract (to fulfil orders and provide your account), legitimate interests (site security, improvement), and consent (marketing emails). You can withdraw consent at any time.
4. Sharing your data
We share data only with the providers needed to run the site and ship orders:
- Our hosting and backend platform.
- Our payment processor.
- Shipping carriers, for fulfilling orders.
- Email delivery providers for transactional and opted-in emails.
We never sell your personal data.
5. Retention
We keep account data for as long as your account is active. Order records are kept for at least 6 years to meet tax and consumer-law requirements. You can request deletion of your account at any time.
6. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data.
- Request erasure ("right to be forgotten") where applicable.
- Object to or restrict certain processing.
- Request a copy of your data in a portable format.
- Complain to the Information Commissioner's Office (ico.org.uk).
7. Cookies
We use essential cookies to keep you signed in and to remember your basket. We may also use limited analytics cookies to understand site usage. You can control cookies through your browser settings.
8. Contact
For any privacy request, get in touch via the contact page.