Privacy Policy
This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, or enter information on this Site.
Contact
After reviewing this policy, if you have additional questions, want more information about my privacy practices, or would like to make a complaint, please contact me by email at em@overstorymending.co.uk.
What information we collect, use, and why
We collect or use the following information to provide and improve services for customers:
Names and contact email
Addresses
Usage data (including information about how you interact with and use our website, products and services)
Payment details
We collect or use the following personal information for information updates via newsletter sign up, which also helps assess future service offers:
Names and contact email
Usage data (including information about how you interact with emails sent, and the date you signed up)
IP address
We collect or use the following personal information for dealing with queries, complaints or claims:
Names and contact details
Addresses
Lawful bases
Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interests are:
For you to access our services, arrange shipping and provide you with an invoice.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Our lawful bases for collecting or using personal information for information updates via newsletter sign up are:
Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. You do have the right to withdraw your consent at any time.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
Legal obligation – we have to collect or use your information so we can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object and the right to data portability.
Where we get personal information from
Directly from you
Analytics via Squarespace and Mailerlite (details in ‘Who we share information with’)
Who we share information with
Squarespace - our website hosting provider
When you submit information to this website via a webform ie the Repair Intake Form, we collect the data requested in the webform in order to track and respond to your submissions. We provide this information to Squarespace so that they can provide website services to us, store that information and help us manage our relationship with you.
As a visitor to this website, we collect personal information to power our site analytics in order to optimise our site and learn about site traffic and activity, including:
information about your browser, network, and device; web pages you visited prior to coming to this website (how you were directed to us); your IP address.
information may also include details about your use of this website, including clicks, internal links, pages visited, scrolling and timestamps.
This website uses cookies and similar technologies, which are small files or pieces of text that download to a device when a visitor accesses a website or app. For information about viewing the cookies dropped on your device, visit The cookies Squarespace uses.
These analytics and performance cookies are used on this website, as described in the link, only when you acknowledge our cookie banner. This website uses analytics and performance cookies to view site traffic, activity, and other data.
All Squarespace data is transferred and stored in the United States.
Squarespace uses the European Commission Standard Contractual Clauses (also known as Model Contractual Clauses) and the UK’s International Data Transfer Addendum (UK Addendum) as the legal basis for transferring personal data to third countries, including the United States.
To learn more, visit their Security Measures page.
Stripe - our payment processor
Any payments taken via this site (not invoices sent via email) are processed through Stripe. They collect and process transaction data at checkout, including your name, email, billing address and payment details.
They also use personal data about your identity to perform verification services to prevent fraud, and to enhance security, and to detect and prevent losses for us, and their business users, and financial partners.
Stripe is a global company and may transfer data outside the UK, to comply with GDPR they use the addendum to the EU Standard Contractual Clauses (SCCs).
Mailerlite - our newsletter distributor
When you submit information to sign up for email updates, we share this information with Mailerlite in order to distribute updates and marketing information to you. We may also collect information about your interactions with sent emails, IP address and date of sign up, in order to learn about usage and manage future newsletters and service offers.
All Mailerlite data is transferred and stored in Germany in compliance with EU data protection laws and GDPR requirements.
Protonmail - our email provider
When you submit information to contact us, whether directly or via the Repair Intake Form, this information is sent to Protonmail for all future communications.
All Protonmail data is transferred and stored in either Switzerland, Germany, or Norway in compliance with EU data protection laws and GDPR requirements. Data is always stored in encrypted format, and Proton cannot decrypt user content on either production servers or backups.
Royal Mail - our shipping provider
When you submit information to the Repair Intake Form, this information is used to create shipping labels in order to post items back to you and to provide tracking for your package via the Royal Mail website.
How long we keep information
We will retain your personal information for our records unless and until you ask us to erase this information. For more information on your right of erasure, please see Lawful bases and data protection rights section below.
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information (as listed previously). There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy policy.
How to complain
If you have any concerns about our use of your personal information, you can make a data protection complaint to us via email at em@overstorymending.co.uk.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Helpline number: 0303 123 1113