PRIVACY

WHO IS RESPONSIBLE

Metic State Digital, trading as Ormr, is the data controller and is registered with the Information Commissioner's Office. Postal address on the terms page, or write to info@ormr.co.uk.

WHAT IS COLLECTED, AND WHY

• Your email address, if you reserve something or join a queue. Used to confirm it, remind you before it runs out, and tell you if something comes free. The lawful basis is performing a contract you asked for.
• Your name, address and email, if you buy something. Used to take payment, post the item, and keep the records HMRC requires. Lawful bases are contract and legal obligation.
• Server logs kept by the hosting provider, which include IP addresses and are used to keep the site up and stop abuse. Lawful basis is legitimate interests.

WHAT YOU HAVE TO GIVE

An email address to reserve something, and a name and delivery address to buy something. Neither is required by law; both are required to do the thing you asked for, and without them the shop cannot.

WHAT IS NOT COLLECTED

No analytics, no advertising pixels, no third party trackers and no profiling. There is no cookie banner because there are no cookies. The site does briefly keep one thing on your own device: which items were reserved or sold when the page last loaded, so a reserved item does not flash up as available while the page is still loading. It is held in the browser tab, it is deleted when you close it, and it contains nothing about you.

No card numbers. Stripe collects and stores those under its own terms, and this shop only ever sees the last four digits on a receipt.

WHO ELSE SEES IT

• Stripe, to take payment.
• Resend, to send the emails about your reserve or order.
• Netlify, which hosts the site and stores the reserve and order records.
• Royal Mail, which gets the name and address on the parcel.
• Nobody else. Nothing is sold, shared or rented to anyone, ever.

WHERE IT GOES

Three of those companies are based outside the United Kingdom, so some of this data is transferred abroad.

• Stripe processes payments in the UK and Ireland and transfers data to the United States under its own safeguards.
• Resend sends the emails from servers in Ireland. Its account records and sending logs are held in the United States, and the logs keep a copy of each message for thirty days.
• Netlify hosts the site and stores the reserve and order records in the United States.

All three are certified under the UK Extension to the EU-US Data Privacy Framework, which is the United Kingdom's adequacy regulation for the United States, and that is what the transfers rely on. Stripe also holds standard contractual clauses in reserve should that framework ever fall. If you would rather not have your data leave the United Kingdom, the honest answer is that this shop cannot run without these three, and you should not buy from it.

HOW LONG IT IS KEPT

• Reserve and queue records, with the email address: deleted 90 days after the reserve or queue place ends.
• Order records: kept six years from the end of the tax year, because tax law requires it.
• Server logs: kept as long as the hosting provider retains them, which is a matter of weeks.

YOUR RIGHTS

You can ask what is kept about you, ask for it to be corrected, ask for it to be deleted where there is no legal reason to keep it, ask for processing to be restricted while something is sorted out, object to processing, and ask for the data you gave in a form you can take elsewhere. Email info@ormr.co.uk and it gets done, free, within a month.

If you are unhappy with how it is handled you can complain to the Information Commissioner's Office at ico.org.uk.