GDPR Statement

FFS Merch Ltd is committed to full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This statement sets out, in plain terms, how we meet our data protection obligations. It should be read alongside our Privacy Policy, which explains in full detail what data we collect and why.

FFS Merch Ltd, registered in England & Wales and trading from Axwell Park, Blaydon, NE21 5PB, is the data controller responsible for your personal data collected through this website.

• We collect only the personal data we need to run your account, process orders, and provide support.
• We are transparent about what we collect and why, as set out in our Privacy Policy.
• We keep your data accurate and up to date, and correct it promptly if you tell us it's wrong.
• We do not keep personal data for longer than necessary.
• We use industry-standard security measures, including encrypted connections and secure, hashed password storage, to protect your data.
• We only share your data with trusted processors (such as Stripe, Supabase, and Resend) who are contractually bound to protect it.

You can, at any time, ask us to:

• Show you the personal data we hold about you.
• Correct anything that's inaccurate.
• Delete your data, where we're not legally required to keep it.
• Stop sending you marketing emails.
• Give you a copy of your data to take elsewhere.

To make any of these requests, email hello@ffsmerch.co.uk with the subject line "Data Request". We will respond within one month, as required by UK GDPR.

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours and inform any affected customers without undue delay, in line with our legal obligations.

If you have any concerns about how we handle your personal data, please contact us first at hello@ffsmerch.co.uk so we can put things right. You also have the right to raise a complaint directly with the ICO at ico.org.uk.