Privacy Policy

1. Who we are

ProjectBriefs ("we", "us", "our") is a trading name registered in the United Kingdom. We operate the website projectbriefs.com and sell underwear and clothing products online.

For any questions about this policy or how we handle your data, contact us at [email protected].

2. What data we collect

We collect the following categories of personal data when you use our website or place an order:

Information you provide

• Order information: name, email address, shipping address, billing address, phone number
• Payment information: processed securely via Stripe — we never see or store your full card details
• Account information: email address and password if you create an account
• Communications: any messages you send us via email or contact forms

Information collected automatically

• Device information: browser type, operating system, screen resolution
• Usage data: pages visited, time spent on pages, referral source
• Location data: country-level location derived from your IP address (used to display the correct currency and calculate shipping)
• Cookies: see our Cookie Policy for full details

3. How we use your data

We use your personal data for the following purposes:

Purpose	Legal basis (GDPR)
Fulfilling your orders and processing payments	Performance of a contract
Sending order confirmation and shipping updates	Performance of a contract
Detecting and preventing fraud	Legitimate interest
Displaying prices in your local currency	Legitimate interest
Improving our website and services	Legitimate interest
Sending marketing emails (only with your consent)	Consent
Complying with legal obligations (e.g. tax records)	Legal obligation

4. Who we share your data with

We share your personal data only with the third parties necessary to operate our business:

• Printful (order fulfillment) — receives your name, shipping address, and order details to print and ship your products. Printful operates facilities in the US, UK, and EU and processes data under their own privacy policy.
• Stripe (payment processing) — processes your payment securely. We never have access to your full card number.
• Cloudflare (CDN and security) — provides website performance and security services. Processes IP addresses and request data.

We do not sell your personal data to third parties. We do not share your data with advertisers.

5. International transfers

Your order may be fulfilled from a facility outside the UK or EEA (for example, Printful's US facilities). Where personal data is transferred outside the UK/EEA, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK ICO or European Commission.

6. How long we keep your data

• Order records: 6 years from the date of purchase (required for tax and accounting purposes under UK law)
• Account data: until you request deletion of your account
• Marketing preferences: until you unsubscribe
• Website analytics: 26 months

7. Your rights

Under UK GDPR and the Data Protection Act 2018, you have the following rights:

• Access: request a copy of the personal data we hold about you
• Rectification: ask us to correct inaccurate data
• Erasure: ask us to delete your data (subject to legal retention requirements)
• Restriction: ask us to limit how we use your data
• Portability: request your data in a machine-readable format
• Objection: object to processing based on legitimate interest
• Withdraw consent: where processing is based on consent, you can withdraw it at any time

To exercise any of these rights, email us at [email protected]. We will respond within 30 days.

8. Security

We take reasonable technical and organisational measures to protect your personal data, including:

• HTTPS encryption on all pages
• Payment processing handled entirely by Stripe (PCI DSS Level 1 certified)
• Cloudflare DDoS protection and Web Application Firewall
• Access to personal data restricted to authorised personnel only

9. Children

Our website is not directed at children under 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this privacy policy from time to time. We will notify you of material changes by posting a notice on our website or emailing you if you have an account. The "Last updated" date at the top of this page indicates when the policy was last revised.

11. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113