Privacy Policy

01.Who we are and our role

STRATMETA LTD, trading as StratMeta, is a company registered in England and Wales under company number 16354896.

For most of the personal data described in this policy, StratMeta is the data controller. This means we decide why and how that personal data is used.

When we process personal data solely on the instructions of a business client while building, maintaining or supporting their website or software, that client will normally be the controller and StratMeta will act as a processor under the relevant service agreement. In those circumstances, the client’s privacy policy will apply to the people whose data is being processed.

For privacy enquiries or requests relating to your rights, email privacy@stratmeta.co.uk or use our contact form.

02.Who this policy applies to

This policy applies to:

• Visitors to the StratMeta website
• Customers purchasing from us online or in person
• Customers purchasing digital products, where offered
• People who join the StratMeta newsletter
• Clients and prospective clients seeking web, UX/UI, software or consulting services
• People who contact us through email, forms, customer support or social media

03.Personal data we collect

Depending on how you interact with StratMeta, we may collect:

• Identity and contact information: your name, email address, telephone number, billing address and delivery address.
• Order and fulfilment information: products, sizes, colours and print options ordered, order history, recipient details required by production or delivery partners, shipping information, tracking events, returns and customer notes you choose to provide.
• Service and project information: project enquiries, briefs, requirements, quotations, deliverables, communications and meeting notes.
• Payment and transaction information: payment status, amount, currency, transaction reference and relevant fraud-prevention results. We do not store your full payment-card number or card security code.
• Communications: emails, messages, contact-form submissions, support requests and our responses.
• Technical and usage information: IP address, browser, device type, pages visited, approximate location derived from IP address, diagnostic information and security logs.
• Cookie and analytics information: cookie preferences and, where you have consented, Google Analytics identifiers and events such as pages viewed, interactions, session information and referring source. Separately, Cloudflare Web Analytics provides aggregate statistics about page views, referrals, devices and website performance without identifying individual visitors.
• Marketing information: newsletter subscription status, consent records and communication preferences.

We do not normally request sensitive or special-category personal data through our shop or general contact forms. Please do not provide this type of information unless it is necessary and has been specifically requested or agreed.

04.Where we obtain personal data

We may obtain personal data:

• Directly from you when you place an order, join the newsletter, submit a form, send us a message or begin a project
• Automatically from your device through technical logs and, where applicable, cookies and analytics tools. Google Analytics is not activated unless you consent to analytics
• From payment providers through payment confirmations, transaction references and fraud-prevention results
• From delivery providers through tracking and delivery updates
• From social-media platforms when you contact or interact with us through those platforms

05.How we use personal data and our lawful bases

UK data-protection law requires us to have a lawful basis for each way we use personal data. We use personal data:

• To process purchases, made-to-order fulfilment, payments, deliveries, returns and refunds — necessary to perform our contract with you.
• To provide services and manage client projects — necessary to perform a contract or take requested steps before entering into one.
• To respond to enquiries and provide customer support — necessary to perform a contract or for our legitimate interest in providing effective support and operating our business.
• To operate, maintain and improve our website and services — our legitimate interest in providing reliable and effective services.
• To prevent fraud, protect accounts, secure our systems and manage misuse — our legitimate interests in protecting StratMeta, our customers and our services.
• To maintain financial, tax and accounting records — necessary to comply with our legal obligations.
• To establish, exercise or defend legal claims — our legitimate interests in protecting our legal rights.
• To send marketing emails — your consent, where you have actively chosen to receive them.
• To run optional website analytics and performance measurement — your consent, where we ask you to allow analytics.
• To understand aggregate website traffic and improve the website using Cloudflare Web Analytics — legitimate interests in improving StratMeta's website, insofar as any personal data is processed. Visitors can object using the control in the Cookie Policy.
• To measure advertising activity using Meta Pixel— consent to marketing tracking, where enabled.

Where we rely on legitimate interests, we consider whether the use of your data is necessary and balance our interests against your rights, expectations and possible impact on you.

06.When you must provide personal data

Some information is required to enter into or fulfil a contract. For example, we cannot deliver an order without the necessary delivery details or provide a service without sufficient contact and project information.

If you do not provide information that is reasonably required, we may be unable to accept or fulfil your order, respond fully to your request or provide the requested service.

07.Payments

Online payments may be processed by Stripe (card payments) or PayPal, depending on the payment method you choose. In-person card payments may be processed through Zettle where offered.

Payment providers receive the information necessary to process the transaction, prevent fraud and meet their own legal obligations. They may act as independent controllers for some of these activities and process information under their own privacy policies.

StratMeta receives payment confirmation and transaction information but does not store your full card number or card security code on its systems.

You can review the relevant payment provider’s privacy information when choosing a payment method. Some transaction and fraud-related data may be retained by those providers independently of StratMeta.

08.Who we share personal data with

We share personal data only where reasonably necessary to operate our business, provide services, fulfil orders, meet legal obligations or protect our rights.

• Website hosting and infrastructure providers, including Vercel
• Database services, including MongoDB Atlas
• Cloud file storage, including Amazon Web Services
• Email and communication services, including Namecheap Private Email
• Payment providers, including Stripe, PayPal and Zettle
• Production and fulfilment partners who print, embroider, pack or prepare made-to-order goods, and delivery and logistics providers. They receive the order details and recipient information needed to fulfil the relevant purchase
• Google Analytics, provided by Google, where you have consented to analytics
• Cloudflare Web Analytics, for aggregate website-usage and performance measurement
• Meta, where you consent to Meta Pixel marketing measurement
• Professional advisers, including accountants, insurers and legal advisers, where necessary
• Courts, regulators, law-enforcement bodies or public authorities where disclosure is required or permitted by law
• Social-media platforms when you communicate with us through their services

Some recipients act as processors under our instructions. Others act as independent controllers because they determine how they use personal data for their own regulatory, security or operational purposes.

For made-to-order items, we may share your name, delivery address, contact information, product selections and delivery instructions with our production and fulfilment partners. We share only the details reasonably necessary to manufacture and deliver your order.

We do not sell or rent your personal data. We remain responsible for selecting appropriate partners and for our own obligations under data-protection law.

09.International data transfers

Some service providers may store or process personal data outside the United Kingdom.

Where this constitutes a restricted international transfer, we use a lawful transfer mechanism as applicable. This may include UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.

You may contact privacy@stratmeta.co.uk to request further information about the safeguards used for relevant transfers or how to obtain a copy.

10.How long we retain personal data

We retain personal data only for as long as it is reasonably needed for the purpose for which it was collected, including legal, accounting, security and reporting requirements.

Our typical retention periods are:

• Order, payment and financial records — generally six years after the relevant accounting period, or longer where required by law or needed for an outstanding claim
• Service and project records — up to six years after the project or client relationship ends
• General enquiries and support messages — normally up to 12 months, unless they become part of an order, project or dispute
• Marketing subscription records — until you unsubscribe or withdraw consent
• Marketing suppression records — minimal information may be retained after an opt-out to ensure we do not contact you again
• Google Analytics information — according to the retention settings configured in our analytics property. Some analytics cookies can persist for up to two years unless removed or restricted earlier; you can withdraw consent at any time
• Cloudflare Web Analytics statistics — according to Cloudflare's data retention and aggregation arrangements; these statistics are used to understand and improve website performance
• Security and technical logs — for a limited period determined by security needs, risk, provider configuration and legal requirements

We may retain information for longer where required by law or where it is reasonably necessary to investigate a dispute, prevent fraud or establish, exercise or defend a legal claim.

11.Cookies and website analytics

We use essential cookies and similar technologies where they are required to operate features such as the shopping basket, checkout, security, authentication and privacy preferences. Essential technologies do not require consent where they are strictly necessary to provide a service you have requested.

We use Google Analytics 4 to understand how visitors use the website. It may collect information including online identifiers, device and browser information, approximate location, pages viewed, interactions and referring source. Google Analytics may use cookies such as _ga and cookies beginning with _ga_.

Google Analytics is optional. We do not activate Google Analytics or allow it to set analytics cookies unless you actively consent to analytics through our cookie banner or settings tool. If you reject analytics, Google Analytics remains disabled. You may withdraw your consent at any time; this stops future optional analytics collection but does not affect processing carried out before consent was withdrawn.

Cloudflare Web Analytics provides aggregate information about page views, referrals, browser and device types, approximate locations and website performance. Cloudflare states that this service does not use cookies or fingerprinting to identify visitors. StratMeta uses the information to understand traffic and improve its website, not to identify or profile individual visitors.

This aggregate measurement is separate from Google Analytics and marketing tracking. Where the statistical purposes exception under UK cookie rules applies, prior consent is not required, but visitors can object free of charge using the visitor statistics control in the Cookie Policy. The choice applies to the browser where it is saved.

Meta Pixel, where enabled, is used for advertising measurement only after the visitor has given marketing consent through the cookie settings tool. It is not part of Cloudflare's aggregate statistics.

Any non-essential cookie or storage technology that requires consent will not be activated before consent is given. You can review or change your choices at any time using the cookie settings tool on our website. You can also remove existing cookies through your browser settings.

Our Cookie Policy explains the cookies and similar technologies we use, their purposes, providers and typical duration.

12.Data security

We use technical and organisational measures appropriate to the nature and risk of the personal data we process. These measures include access restrictions, authentication controls, encrypted network connections, secure hosting and carefully selected service providers.

No internet transmission or storage system can be guaranteed to be completely secure. We review our measures and take reasonable steps to prevent unauthorised access, loss, misuse, alteration or disclosure.

13.Automated decision-making

StratMeta does not currently use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Payment providers may use automated systems to assess transactions, detect fraud or decide whether to authorise a payment. Those providers explain their processing and available rights in their own privacy policies.

14.Children’s personal data

Our website is not designed specifically for children. A person under 18 may purchase ordinary, non-age-restricted products only with permission from a parent or guardian and by using a payment method they are authorised to use. Professional services are not available for direct purchase through the shop and may only be agreed with an adult or an authorised business representative.

Where a customer under 18 places a permitted product order, we may process the limited personal data needed to accept payment, fulfil the order, provide support and meet our legal obligations. We do not knowingly use children’s personal data for behavioural advertising or solely automated decisions that have legal or similarly significant effects.

If you believe a child has provided personal data to us without appropriate involvement from a parent or guardian, please contact us so we can investigate and take appropriate action.

15.Your data-protection rights

Depending on the circumstances and the lawful basis being used, UK data-protection law gives you rights that may include:

• The right to request access to your personal data
• The right to have inaccurate or incomplete data corrected
• The right to request deletion of your personal data
• The right to request restriction of processing
• The right to object to certain processing
• The right to receive or transfer certain data in a portable format
• The right to withdraw consent at any time where processing is based on consent

These rights are not all absolute, and an exemption may apply in some circumstances. If we cannot fulfil a request, we will explain why.

You can withdraw marketing consent by using the unsubscribe link in an email. To exercise another right, email privacy@stratmeta.co.uk or use our contact form.

We may need to request information to confirm your identity. We normally respond to valid requests without undue delay and within one month.