Who’s responsible for your data
MBLEM is the data controller for the personal data described here.
- Controller
- MBLEM
- Address
- ICO registration
- Contact
- [email protected]
What we collect
When you buy
Checkout is run by Stripe. For each order, Stripe collects and shares with us your name, email address, required phone number, billing and delivery address, the product and size you bought, the amount paid, the date and the payment status. We use these to send your order and look after it. Your card details stay with Stripe: we don’t see or store your full card number.
When you confirm the intended use at checkout
Before you continue to Stripe, you tick to confirm that you understand what MBLEM is supplied for. When you continue, your browser sends us a short record of that confirmation. It contains:
- a random reference, which is also passed to Stripe as your order’s reference so the two can be matched;
- the product and size;
- which version of the confirmation wording you saw;
- the page you were on, where the button was, and the time.
The record doesn’t contain your name, email address, delivery address, IP address or payment details. Once your order is placed, it can be linked to your order through the reference.
To stop the checkout record being flooded by automated requests, we also keep a scrambled, one-way code made from your IP address using a secret value (not the address itself) for up to a day. It’s kept apart from the record, never next to your order reference, and is used only to limit repeated requests.
When you join a waitlist
For paid orders we store your name, email, required contact phone number, shipping address, payment reference and fulfilment status in our Cloudflare D1 order database. We use your phone number to contact you about your order or delivery, not for marketing. Card details stay with Stripe.
We store your email address, the product you’re waiting for, whether you ticked the box for occasional MBLEM news, the page you signed up on, which version of the sign-up wording you saw, and when you signed up or last changed your choice. This is kept in a Cloudflare D1 database. To stop repeated automated sign-ups, we also keep a scrambled, one-way code made from your IP address (not the address itself) for up to a day.
When you email us
We receive your email address and whatever you send us, such as photos of your car’s badge. Our support inbox is run on Gmail, a Google service.
When you browse
- Google Analytics, only if you allow it. If you choose “Allow analytics”, Google Analytics records which pages you visit, roughly where you are (such as your country or city), your device and browser, how you arrived, and actions such as starting checkout or completing an order (the size, price and order reference, never your name or contact details). If you don’t allow it, it doesn’t load.
- Cloudflare Web Analytics. This counts page views without cookies and without tracking you across other sites.
- Hosting and security. Our site is hosted by Cloudflare, which processes your IP address and basic request details to deliver pages and protect the site.
- Browser storage. A few small items are kept in your own browser, such as your cookie choice. Our cookie notice lists them.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Take payment, send your order, handle cancellations and returns | Contract |
| Keep a record of your checkout confirmation of intended use, matched to your order | Legitimate interests (a clear record of what was bought and on what basis, and dealing with any question or dispute about an order) |
| Keep order and tax records | Legal obligation |
| Email you about your order | Contract |
| Email you when a product you’ve waited for is available | Consent |
| Send occasional MBLEM news, if you ticked that box | Consent |
| Answer your emails | Legitimate interests (helping you), or contract if it’s about an order |
| Google Analytics | Consent |
| Cloudflare Web Analytics, hosting security, and abuse protection for forms and checkout records | Legitimate interests (running a secure site and understanding basic use without cookies) |
You can withdraw consent at any time by emailing us, and you can change your analytics choice in cookie settings.
Who helps us
These companies process personal data for us, under contracts that require them to protect it:
- Stripe
- Checkout, payments and order details
- Cloudflare
- Website hosting, the waitlist database (D1), checkout confirmation records, and cookieless Web Analytics
- Gmail for support emails, and Google Analytics if you allow it
We don’t sell your personal data.
Data outside the UK
Some of these providers may process data outside the UK, for example in the United States. Where that happens, we rely on safeguards recognised under UK data protection law, such as the UK-US data bridge or the International Data Transfer Agreement and Addendum.
The companion app
The app you use to change MBLEM’s design is made and run by a third party under its own terms and privacy policy. MBLEM doesn’t operate it and doesn’t receive the data you give it. The app may process your data outside the UK. Please read its privacy information before you use it.
How long we keep it
| Data | How long |
|---|---|
| Orders | 6 years, for tax and accounting records |
| Checkout confirmation records | As long as the order they belong to (6 years) |
| IP code used to limit repeated checkout records (kept apart from the record) | Up to a day, then deleted |
| Waitlist sign-ups | Deleted 12 months after we send the “it’s available” email, or sooner if you ask |
| Support emails | As long as we need to answer you and deal with anything that follows, then deleted |
| Google Analytics |
Your rights
You have the right to:
- ask for a copy of your personal data;
- ask us to correct it, or to delete it;
- ask us to restrict how we use it, or object to how we use it;
- ask us to move it to another organisation, where that applies;
- withdraw your consent at any time, where we rely on consent.
Email [email protected]. We’ll reply within one month, as the law requires.
Complaints
If you’re unhappy with how we’ve used your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
Changes to this notice
If we change how we use personal data, we’ll update this page. The date at the top shows when it was last reviewed.