[ LEGAL ]
Privacy
Last updated 2026-09-06
Who is responsible
Sideways
56 St Thomas Close, Alfreton, Derbyshire, DE55 5PD
We are the data controller for the personal data described below. Contact [email protected] about anything on this page.
What we collect, and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email, delivery address, phone | To fulfil and deliver your order | Performance of a contract |
| Order contents and value | To fulfil the order and keep accounting records | Contract / legal obligation |
| Basket contents | To remember what you added | Legitimate interests |
| Hashed IP address | Rate limiting, to protect the site from abuse | Legitimate interests |
We do not store your card details. Payment is handled entirely by Stripe; card numbers never reach our systems.
We hash IP addresses rather than storing them. Our rate limiting needs to tell requests apart, not to know who you are, so the address is put through a one-way function with a secret salt and the original is never written down.
Who we share it with
- Stripe — payment processing. Stripe privacy policy
- Printify and its UK production partner — your name and delivery address, so your order can be printed and posted
- IONOS — website and database hosting
We do not sell your data, and we do not share it for advertising.
How long we keep it
Order records are kept for six years after the end of the financial year in which the order was placed, because HMRC requires it. Abandoned baskets are deleted after 30 days. Rate-limiting records are deleted after 24 hours.
Your rights, and one honest limitation
You have the right to access, rectify, erase or port your data, to restrict or object to processing, and to complain to the Information Commissioner's Office.
Erasure has a genuine limit, and we would rather explain it than promise something we cannot do. We are legally required to keep records of completed sales for six years. So if you ask us to erase your data and you have placed an order, we remove your name, address and phone number from that order and replace your email with a non-identifying reference — but the transaction record itself has to stay until the retention period expires. Everything not required for that record is deleted outright.
Cookies
We set one strictly necessary cookie, duk_cart, which holds a
random identifier linking your browser to your basket. It contains no personal
data and lasts 30 days.
We do not currently use analytics, advertising or tracking cookies. If that changes we will ask for your consent first, and nothing will load before you give it.