Crevasse Clothing – Privacy Policy
Last updated: 30th Oct 2026 · Version [1.0]
This policy explains what personal information Crevasse Clothing collects when you hire clothing from us, why we use it, who we share it with, and the choices and rights you have. It follows the UK GDPR and the Data Protection Act 2018.
1. Who we are (data controller)
1.1 The controller of your personal information is Crevasse Clothing Limited, a company registered in England and Wales (company number 08514391).
| Registered office | 5 Beach Court, Hurst, Berkshire RG10 0RQ (not a postal address) |
| Postal / correspondence address | Crevasse Clothing, PO BOX 834, Redhill RH1 9NP |
| ICO registration number | ZB517346 |
| Data protection contact | Michael Winterton, michael@crevasseclothing.com, 020 3287 4740 |
1.2 We have not appointed a Data Protection Officer because we are not required to. Michael Winterton is your point of contact for any privacy question.
2. Information we collect
| Type | What it includes | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, telephone number, delivery and billing address | You, or the third party you booked through |
| Order and hire details | What you hired, your holiday dates, order history, returns, exchanges, communications with us, photographs we take of returned items showing damage | You, and us |
| Sizing information | Clothing sizes and measurements you give us (for example waist, dress size, height), and sizes for any child you are hiring for | You |
| Payment information | Payment card or method details held by Stripe (or Worldpay for third-party bookings). We see only the card type, the last four digits, expiry date and billing address, and not your full card number. Records of what was charged or refunded | You, Stripe and Worldpay |
| Fraud and security information | Signals from our payment provider about whether a payment appears genuine (for example IP address, device information and matching of billing details) | Stripe and Worldpay |
| Website and device information | IP address, browser, device type, pages visited and how you use the site, collected through cookies (see section 10) | Your device |
| Third-party booking information | Name, contact details, booking reference, dates and sizes passed to us by the tour operator, school or travel company you booked through | The third party |
2.1 We do not ask for, and you should not send us, sensitive information such as health details. Sizing information is used only to supply the right items.
2.2 If you do not give us the information we need to deliver your hire (for example your address or card), we will not be able to supply it.
3. How we use your information and why (lawful bases)
We may only use your personal information if we have a legal reason (a lawful basis). These are ours:
| What we do | Information | Legal basis |
|---|---|---|
| Take and fulfil your order: process payment, choose sizes, send, collect and clean the kit, handle exchanges and returns | Identity and contact, order and hire, sizing, payment | Performance of a contract with you |
| Keep your card details securely as a deposit, and charge for late return, loss or damage as our Terms of Hire allow | Payment, order and hire, photographs of damage | Performance of a contract; and legitimate interests (protecting our stock against loss) |
| Prevent fraud, verify identity and card details, and keep our website secure | Identity and contact, payment, fraud signals, device | Legitimate interests (preventing fraud and protecting our business and customers) |
| Contact you about your order (delivery, return reminders, damage and charges) | Identity and contact, order and hire | Performance of a contract |
| Handle complaints, claims and disputes | All relevant information | Performance of a contract |
| Keep accounting and tax records, and respond to lawful requests from authorities | Order, payment | Legal obligation |
| Understand how our website is used and improve it | Website and device information | Consent (through our cookie banner) |
| Send you marketing, if we ever introduce it | Identity and contact | Consent, or the soft opt-in rules for existing customers, always with an unsubscribe option |
3.1 We do not currently send marketing emails or texts. If that changes, we will tell you first and you can always opt out.
3.2 Legitimate interests. Where we rely on legitimate interests, we have weighed them against your rights and do not use your information in ways that would override them. You can ask us about this using the contact details above, and you have a right to object (section 9).
3.3 Automated checks. Our payment provider uses automated tools to score the fraud risk of a payment. If a payment is declined this way, you can contact us and we will review it manually.
4. Your card details and deposits
4.1 When you place an order, your card is stored by Stripe, our payment provider. We do not see or keep your full card number. Under our Terms of Hire, the stored card acts as a security deposit and we may charge it for late return, loss or severe damage, after emailing you first.
4.2 If you booked through a third party, we will email you a secure link to authorise a card through Worldpay, which is held on the same basis.
4.3 We ask the payment provider to release or remove the card details once your hire is complete and all charges (if any) are settled, unless you have asked us to keep them for future hires.
5. Who we share your information with
We do not sell your personal information. We share it only as needed with:
Royal Mail, to deliver and collect your parcel (name, address, telephone and email if requested).
Stripe, to take payments, store your card details securely, issue refunds and detect fraud.
Worldpay, for card authorisation for third-party bookings.
Squarespace, which hosts our website and online store and holds our customer and order records.
Google (Google Analytics), which provides website analytics if you accept analytics cookies.
The tour operator, school or travel company you booked through, to confirm your booking and, where needed, return and charge matters.
Professional advisers such as our accountants, lawyers and insurers [confirm].
Authorities, courts and others where required by law or to protect our rights, and a buyer if our business is sold, who must continue to protect your data.
5.1 These providers act on our instructions or, in some cases (such as payment providers and the third party you booked through), as controllers in their own right and under their own privacy notices. We do not currently use credit reference agencies. If that changes, we will update this policy.
6. How long we keep your information
| Information | How long |
|---|---|
| Customer account and order records (including payment records and correspondence) | 6 years from your last order, to meet tax and legal requirements and to deal with claims |
| Sizing profile | 24 months from your last order, or until you ask us to delete it |
| Photographs and notes about damage or loss | 6 years from the date of the related charge or claim, or 12 months from your return if there was no issue |
| Card details held by Stripe or Worldpay | Until the end of your authorisation period and once no charge can be made, then removed on request or as set in section 4.3 |
| Marketing records (if introduced) | Until you withdraw consent, or 24 months of inactivity |
| Website analytics | Up to 26 months, set by our analytics settings |
6.1 After these periods we delete or anonymise your information. If a claim or investigation is under way, we may keep information for longer.
7. International transfers
7.1 Some of our providers are based outside the UK or process data there, including Stripe, Squarespace, Google and Worldpay (for example in the United States and the EU). When your personal information is sent outside the UK, we make sure it is protected by one of the following:
the destination country being covered by UK adequacy regulations, including the UK–US data bridge for US organisations that have joined it;
the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a review of the risks where needed.
7.2 You can ask us for a copy of the safeguards that apply by contacting us.
8. Security
8.1 We use appropriate measures to protect your information, including secure payment processing (we never store full card numbers), access controls and encrypted connections. If there is a data breach that is likely to put you at risk, we will tell you and the ICO as the law requires.
9. Your rights
Under UK data protection law you have the right to:
access the personal information we hold about you and receive a copy;
have inaccurate or incomplete information corrected (rectification);
ask us to delete your information (erasure, or the right to be forgotten), where there is no good reason for us to keep it;
ask us to restrict how we use your information in certain cases;
object to us using your information based on legitimate interests, or for direct marketing;
receive your information, where it was provided by you and used under a contract or consent, in a structured and commonly used format (data portability), or have us send it to another organisation;
withdraw your consent at any time where we rely on it, without affecting what we did before; and
not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you, without safeguards.
9.1 To use any of these rights, email michael@crevasseclothing.com. We may ask you to prove your identity. We will reply within one month, which can be extended by up to two further months for complex requests, and we will not normally charge a fee.
9.2 Some rights have exceptions. For example we may need to keep order and payment records for tax and legal reasons even if you ask for erasure, and we will explain if so.
9.3 Complaints. If you are unhappy with how we use your information, please contact us first so that we can try to put it right. We will acknowledge your complaint within 30 days and respond without undue delay. You also have the right to complain at any time to the Information Commissioner’s Office (ICO): ico.org.uk, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
10. Cookies
10.1 Cookies are small files that a website puts on your device. We use:
| Type | What for | Your choice |
|---|---|---|
| Essential | Remembering your basket and order as you move between pages, secure checkout and website security | Always on, because the site cannot work without them |
| Analytics | Google Analytics shows us, in aggregated form, how many people visit the site and which pages are used, so we can improve it | Only with your consent |
10.2 We use a cookie banner to ask for your consent to analytics cookies. You can change your choice at any time or in your browser settings, although blocking essential cookies may stop the basket working.
11. Children
11.1 Our website is for adults. We only contract with people aged 18 or over. If you hire kit for a child, you give us sizing information for the child as the parent or guardian. We use it only to supply the right size and do not collect information directly from children.
12. Changes to this policy
12.1 We may update this policy. The current version is always on our website with the date at the top, and we will tell you about important changes where we have to.
12.2 Questions? Email michael@crevasseclothing.com or write to us at Crevasse Clothing Ltd, PO Box 834, Redhill RH1 9NP