Privacy policy
The rudeness is on the merchandise, not in how we treat your data. This page explains what personal data we collect, why, who we share it with and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018).
Who we are
MrTourette is run by This Way Up Distribution Ltd, a company registered in England and Wales (company number 16600736), registered office 809 Salisbury House, 29 Finsbury Circus, London EC2M 7AQ. We are the controller of your personal data. Contact us about anything on this page at hello@mrtourette.com.
What we collect and why
| What | Why | Lawful basis |
|---|---|---|
| Name, delivery address, email address and, if you give it, phone number, collected when you pay | To make, deliver and support your order, send order and dispatch emails, and deal with cancellations, returns and faults | Contract |
| What you ordered, including any slogan you created in the Translator | To print your order and keep business records | Contract; legal obligation (tax and accounting records) |
| Messages you send us | To reply and help you | Legitimate interests (customer service) |
| Newsletter email address, sign-up date, the wording you agreed to and when you confirmed by clicking the link we email you | To send occasional emails about new designs and offers, and to prove you asked for them | Consent, which you can withdraw at any time |
| Server logs (IP address, browser type, page requested, time) | To keep the site secure and working | Legitimate interests (security) |
If you use the order status page, we check the order number and email address you enter against our records and show the result. We don't keep what you type there, though the request appears in our server logs like any other.
We never see or store your card details. Payments are taken by Stripe on its own secure checkout page.
The Translator runs in your browser. What you type is not sent to us unless you add it to an order or create a share link (the link contains your words and settings, so anyone you send it to can see them). When someone opens a share link, the words are checked against our list of banned slurs before they are shown.
Cookies, local storage and visitor counts
We do not use cookies, advertising trackers or third-party analytics. The site saves a few settings on your own device using your browser's local storage: your basket, that you confirmed you are 18 or over, and whether you prefer redacted or unredacted text. These stay on your device, are needed for the features you ask for, and you can clear them in your browser settings.
To see what is popular, the site sends simple anonymous events (for example "page viewed", "Translator used in the posh style", "mug added to basket"). We store only daily totals. No IP address, cookie or identifier is stored with them, so they cannot be linked to you.
Who we share it with
- Stripe Payments Europe Ltd and Stripe, Inc. take your payment and collect your delivery details. Stripe also uses data to prevent fraud and meet its own legal duties, for which it is a separate controller. See Stripe's privacy policy.
- Inkthreadable, our UK print partner, receives your name, delivery address, phone number (if given) and order so it can print and post your items.
- Royal Mail delivers your parcel and receives the delivery details it needs.
- Hetzner Online GmbH (Germany) hosts our website and order system.
- Fasthosts Internet Ltd provides our email, which we use to send order emails and reply to you.
- GitHub, Inc. (United States) stores encrypted backups of our order database. They are encrypted on our server before upload, and GitHub does not hold the key, so it cannot read them.
We do not sell your data or share it for anyone else's marketing. We may disclose data where the law requires it, or to protect our rights.
International transfers
Hetzner stores our data in the EU, which the UK recognises as giving adequate protection. Stripe may process data in the United States, and our encrypted backups are stored by GitHub in the United States. Where data leaves the UK, it is protected by UK adequacy regulations or by safeguards approved under UK law, such as the International Data Transfer Addendum.
Keeping it safe
The site and checkout use encrypted HTTPS connections. Our order system runs on a locked-down server that only we can reach, using key-based logins. Access keys for payment and printing are stored separately from the website code, and only the details needed to print and deliver an order are passed on.
How long we keep it
- Order and payment records: 6 years from the end of the financial year of the order, because tax law requires it.
- Print files of your design: 90 days after the order, in case of misprints or delivery problems, then deleted.
- Emails with you: up to 2 years after the last message, unless they relate to an order, in which case as for orders.
- Newsletter sign-ups that are never confirmed: deleted after 30 days.
- Newsletter: until you unsubscribe. We then keep only a record that you unsubscribed, so we don't email you again.
- Server logs: up to 14 days.
- Encrypted backups of the order database: the last 30 days, each overwritten as a new one is made.
- Anonymous daily visitor counts: kept indefinitely, as they contain no personal data.
Your rights
You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time. Every newsletter has an unsubscribe link, or just email us. Some rights have limits, for example we must keep order records for tax purposes. We will reply within one month.
If you are unhappy with how we use your data, please tell us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.
Adults only
This site is for people aged 18 and over. We do not knowingly collect data from anyone younger.
Changes
We will update this page if anything changes, and change the date at the top.