Privacy Policy

1. Who we are and our role

STRATMETA LTD, trading as StratMeta, is a company registered in England and Wales under company number 16354896.

For most of the personal data described in this policy, StratMeta is the data controller. This means we decide why and how that personal data is used.

When we process personal data solely on the instructions of a business client while building, maintaining or supporting their website or software, that client will normally be the controller and StratMeta will act as a processor under the relevant service agreement. In those circumstances, the client’s privacy policy will apply to the people whose data is being processed.

For privacy enquiries or requests relating to your rights, email privacy@stratmeta.co.uk or use our contact form.

2. Who this policy applies to

This policy applies to:

• Visitors to the StratMeta website
• Customers purchasing from us online or in person
• Customers purchasing digital products, where offered
• People who join the StratMeta newsletter
• Clients and prospective clients seeking web, UX/UI, software or consulting services
• People who contact us through email, forms, customer support or social media

3. Personal data we collect

Depending on how you interact with StratMeta, we may collect:

• Identity and contact information: your name, email address, telephone number, billing address and delivery address.
• Order and fulfilment information: products, sizes, colours and print options ordered, order history, delivery information, tracking events, returns and customer notes you choose to provide.
• Service and project information: project enquiries, briefs, requirements, quotations, deliverables, communications and meeting notes.
• Payment and transaction information: payment status, amount, currency, transaction reference and relevant fraud-prevention results. We do not store your full payment-card number or card security code.
• Communications: emails, messages, contact-form submissions, support requests and our responses.
• Technical and usage information: IP address, browser, device type, pages visited, approximate location derived from IP address, diagnostic information and security logs.
• Cookie and analytics information: cookie preferences and, where you have consented, Google Analytics identifiers and events such as pages viewed, interactions, session information and referring source. We also receive aggregated website-usage information through Vercel Web Analytics.
• Marketing information: newsletter subscription status, consent records and communication preferences.

We do not normally request sensitive or special-category personal data through our shop or general contact forms. Please do not provide this type of information unless it is necessary and has been specifically requested or agreed.

4. Where we obtain personal data

We may obtain personal data:

• Directly from you when you place an order, join the newsletter, submit a form, send us a message or begin a project
• Automatically from your device through technical logs and, where applicable, cookies and analytics tools. Google Analytics is not activated unless you consent to analytics
• From payment providers through payment confirmations, transaction references and fraud-prevention results
• From delivery providers through tracking and delivery updates
• From social-media platforms when you contact or interact with us through those platforms

5. How we use personal data and our lawful bases

UK data-protection law requires us to have a lawful basis for each way we use personal data. We use personal data:

• To process purchases, preorders, payments, deliveries, returns and refunds — necessary to perform our contract with you.
• To provide services and manage client projects — necessary to perform a contract or take requested steps before entering into one.
• To respond to enquiries and provide customer support — necessary to perform a contract or for our legitimate interest in providing effective support and operating our business.
• To operate, maintain and improve our website and services — our legitimate interest in providing reliable and effective services.
• To prevent fraud, protect accounts, secure our systems and manage misuse — our legitimate interests in protecting StratMeta, our customers and our services.
• To maintain financial, tax and accounting records — necessary to comply with our legal obligations.
• To establish, exercise or defend legal claims — our legitimate interests in protecting our legal rights.
• To send marketing emails — your consent, where you have actively chosen to receive them.
• To run optional website analytics and performance measurement — your consent, where we ask you to allow analytics.

Where we rely on legitimate interests, we consider whether the use of your data is necessary and balance our interests against your rights, expectations and possible impact on you.

6. When you must provide personal data

Some information is required to enter into or fulfil a contract. For example, we cannot deliver an order without the necessary delivery details or provide a service without sufficient contact and project information.

If you do not provide information that is reasonably required, we may be unable to accept or fulfil your order, respond fully to your request or provide the requested service.

7. Payments

Online card payments are processed by Stripe. In-person card payments may be processed through Zettle where that payment option is offered.

Payment providers receive the information necessary to process the transaction, prevent fraud and meet their own legal obligations. They may act as independent controllers for some of these activities and process information under their own privacy policies.

StratMeta receives payment confirmation and transaction information but does not store your full card number or card security code on its systems.

8. Who we share personal data with

We share personal data only where reasonably necessary to operate our business, provide services, fulfil orders, meet legal obligations or protect our rights.

• Website hosting and infrastructure providers, including Vercel
• Database services, including MongoDB Atlas
• Cloud file storage, including Amazon Web Services
• Email and communication services, including Namecheap Private Email
• Payment providers, including Stripe and Zettle
• Delivery and logistics providers for physical orders
• Google Analytics, provided by Google, where you have consented to analytics
• Vercel Web Analytics, which provides cookieless, aggregated website-usage information
• Professional advisers, including accountants, insurers and legal advisers, where necessary
• Courts, regulators, law-enforcement bodies or public authorities where disclosure is required or permitted by law
• Social-media platforms when you communicate with us through their services

Some recipients act as processors under our instructions. Others act as independent controllers because they determine how they use personal data for their own regulatory, security or operational purposes.

We do not sell or rent your personal data.

9. International data transfers

Some service providers may store or process personal data outside the United Kingdom.

Where this constitutes a restricted international transfer, we use a lawful transfer mechanism as applicable. This may include UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.

You may contact privacy@stratmeta.co.uk to request further information about the safeguards used for relevant transfers or how to obtain a copy.

10. How long we retain personal data

We retain personal data only for as long as it is reasonably needed for the purpose for which it was collected, including legal, accounting, security and reporting requirements.

Our typical retention periods are:

• Order, payment and financial records — up to six years after the relevant transaction or accounting period
• Service and project records — up to six years after the project or client relationship ends
• General enquiries and support messages — normally up to 12 months, unless they become part of an order, project or dispute
• Marketing subscription records — until you unsubscribe or withdraw consent
• Marketing suppression records — minimal information may be retained after an opt-out to ensure we do not contact you again
• Google Analytics user-level and event-level data — for the period configured in our Google Analytics 4 property, up to 14 months. Google Analytics cookies may remain on your device for up to two years unless removed sooner
• Vercel Web Analytics information — for the period made available under our applicable Vercel plan and configuration
• Security and technical logs — for a limited period determined by security needs, risk, provider configuration and legal requirements

We may retain information for longer where required by law or where it is reasonably necessary to investigate a dispute, prevent fraud or establish, exercise or defend a legal claim.

11. Cookies and website analytics

We use essential cookies and similar technologies where they are required to operate features such as the shopping basket, checkout, security, authentication and privacy preferences. Essential technologies do not require consent where they are strictly necessary to provide a service you have requested.

We use Google Analytics 4 to understand how visitors use the website. It may collect information including online identifiers, device and browser information, approximate location, pages viewed, interactions and referring source. Google Analytics may use cookies such as _ga and cookies beginning with _ga_.

Google Analytics is optional. We do not activate Google Analytics or allow it to set analytics cookies unless you actively consent to analytics through our cookie banner or settings tool. If you reject analytics, Google Analytics remains disabled. You may withdraw your consent at any time; this stops future optional analytics collection but does not affect processing carried out before consent was withdrawn.

We also use Vercel Web Analytics to understand general website usage and performance. Vercel Web Analytics does not use third-party analytics cookies and provides aggregated, anonymised website statistics.

Any non-essential cookie or storage technology that requires consent will not be activated before consent is given. You can review or change your choices at any time using the cookie settings tool on our website. You can also remove existing cookies through your browser settings.

Our Cookie Policy explains the cookies and similar technologies we use, their purposes, providers and typical duration.

12. Data security

We use technical and organisational measures appropriate to the nature and risk of the personal data we process. These measures include access restrictions, authentication controls, encrypted network connections, secure hosting and carefully selected service providers.

No internet transmission or storage system can be guaranteed to be completely secure. We review our measures and take reasonable steps to prevent unauthorised access, loss, misuse, alteration or disclosure.

13. Automated decision-making

StratMeta does not currently use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Payment providers may use automated systems to assess transactions, detect fraud or decide whether to authorise a payment. Those providers explain their processing and available rights in their own privacy policies.

14. Children’s personal data

Our website is not designed specifically for children. A person under 18 may purchase ordinary, non-age-restricted products only with permission from a parent or guardian and by using a payment method they are authorised to use. Professional services are not available for direct purchase through the shop and may only be agreed with an adult or an authorised business representative.

Where a customer under 18 places a permitted product order, we may process the limited personal data needed to accept payment, fulfil the order, provide support and meet our legal obligations. We do not knowingly use children’s personal data for behavioural advertising or solely automated decisions that have legal or similarly significant effects.

If you believe a child has provided personal data to us without appropriate involvement from a parent or guardian, please contact us so we can investigate and take appropriate action.

15. Your data-protection rights

Depending on the circumstances and the lawful basis being used, UK data-protection law gives you rights that may include:

• The right to request access to your personal data
• The right to have inaccurate or incomplete data corrected
• The right to request deletion of your personal data
• The right to request restriction of processing
• The right to object to certain processing
• The right to receive or transfer certain data in a portable format
• The right to withdraw consent at any time where processing is based on consent

These rights are not all absolute, and an exemption may apply in some circumstances. If we cannot fulfil a request, we will explain why.

You can withdraw marketing consent by using the unsubscribe link in an email. To exercise another right, email privacy@stratmeta.co.uk or use our contact form.

We may need to request information to confirm your identity. We normally respond to valid requests without undue delay and within one month.