Privacy Policy

How we handle your data, in line with UK GDPR.

Last updated: February 2026

1. Introduction

MEGA Caps ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and other applicable data protection laws.

2. What Data We Collect

We collect personal data in the following ways:

  • Order data: name, email, phone number, delivery address, and payment information (processed securely by Stripe)
  • Account data: username, password, preferences (if you create an account)
  • Marketing data: email address if you sign up for newsletters or notifications
  • Communications: any messages you send us, including support emails and form submissions (handled by Formspree)
  • Analytics data: aggregate usage statistics via Plausible Analytics, which is privacy-focused and uses no cookies

3. Legal Basis for Processing

We process your data on one or more of the following lawful bases:

  • Contract performance: to fulfil your order and provide customer service
  • Consent: for marketing emails and newsletters (you can opt out anytime)
  • Legal obligation: tax, accounting, and fraud prevention requirements
  • Legitimate interests: security, analytics, and improving our service

4. How We Use Your Data

We use personal data for:

  • Processing and fulfilling orders
  • Sending order confirmations, shipping, and delivery updates
  • Customer support and handling enquiries
  • Preventing fraud and securing our website
  • Marketing communications (only with your consent)
  • Analysing usage trends (anonymised via Plausible)
  • Complying with legal obligations

5. Data Sharing and Processors

We share data with the following processors, only so far as needed to run the shop:

  • Stripe (payments, when used): processes card payments on a secure checkout page. Your card details go to Stripe, not to us. Stripe's privacy policy applies at checkout
  • Formspree (forms): handles email signup and contact form submissions on our behalf
  • Plausible (analytics): provides anonymised, cookie-free website analytics
  • Shipping providers (Royal Mail, DHL, etc.): receive your name and address to deliver your order

We do not sell or rent your personal data to third parties. We only share data with service providers who process data on our behalf and are bound by data protection obligations.

6. Your Rights under UK GDPR

You have the right to:

  • Access: request a copy of the personal data we hold about you
  • Rectification: correct inaccurate or incomplete data
  • Erasure: request deletion of your data ("right to be forgotten") where permitted
  • Restrict processing: limit how we use your data
  • Portability: receive your data in a portable format
  • Withdraw consent: opt out of marketing communications anytime
  • Object: oppose certain processing activities

To exercise these rights, email hello@megacaps.co.uk with your request. We will respond within 30 days.

7. Data Retention

We retain your data for as long as necessary to:

  • Fulfil orders and provide customer service (5 years)
  • Comply with legal and tax obligations (7 years)
  • Maintain marketing preferences (until you opt out)

You can request deletion sooner by contacting us, except where retention is required by law.

8. International Transfers

If your data is transferred outside the UK/EEA (for example, to Stripe in the US), we rely on Standard Contractual Clauses (SCC) or adequacy decisions to ensure GDPR-compliant protection.

9. Cookies & Tracking

Our website uses essential browser storage for:

  • Shopping cart functionality
  • Session management
  • Security

We do not use tracking cookies. Analytics are handled by Plausible, which is privacy-focused and does not use cookies or require consent.

10. Security

We use industry-standard security measures including SSL/TLS encryption, secure payment processing via Stripe, and restricted access to data. However, no system is 100% secure. If you suspect a data breach, contact us immediately at hello@megacaps.co.uk.

11. Children's Privacy

Our website is not directed to children under 13. We do not knowingly collect data from children. If you believe we have collected data from a child, contact us immediately and we will delete it.

12. Third-Party Links

Our website may contain links to third-party sites (Instagram, X, etc.). We are not responsible for their privacy practices. Please review their privacy policies separately.

13. Changes to This Policy

We may update this Privacy Policy at any time. Changes are effective upon posting. Your continued use of the website constitutes acceptance of the updated policy.

14. Complaints

If you have concerns about how we process your data, contact us first at hello@megacaps.co.uk.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we've breached your rights.

15. Contact Us

For questions about this Privacy Policy or our data practices:

MEGA Caps
Email: hello@megacaps.co.uk
Website: megacaps.co.uk