Privacy policy

Privacy Policy

Last updated: 22 August 2026

This Privacy Policy explains how Outpost Workshop collects, uses, stores and shares personal data when you visit outpostworkshop.co.uk, contact us or place an order.

Who is responsible for your data

Michael Kelly, a sole trader trading as Outpost Workshop, is the controller of the personal data described in this policy.

Correspondence address: 21 Ashfield Road, Aigburth, Liverpool, L17 0BY, United Kingdom
Email: mike@outpostworkshop.co.uk

For privacy questions or to exercise your rights, contact us using the email address above.

Personal data we collect

Depending on how you use the website, we may collect:

  • identity and contact details, including your name, billing address, delivery address, email address and telephone number;

  • order and customisation details, including products, sizes, selected options, wording, additional instructions, uploaded artwork, images, sketches and correspondence about your design;

  • transaction details, including payment status, order value, refunds and limited payment information supplied by our payment providers. We do not ordinarily receive or store your complete card number;

  • account and communication details, including account credentials where applicable, customer-service messages, reviews and marketing preferences;

  • technical and usage data, including IP address, browser and device information, time zone, cookie identifiers, pages and products viewed, searches, cart activity, referring pages and interaction with the website; and

  • fraud and security information, including risk indicators supplied by Shopify, payment providers or fraud-prevention services.

We normally collect this information directly from you, automatically through the website, or from service providers involved in your visit, payment, order or delivery.

Why we use your data and our lawful bases

We use personal data only where we have a lawful basis. Depending on the activity, we use it to:

  • perform our contract with you—to configure and manufacture your order, check artwork, take payment, deliver goods, provide order updates and handle returns, refunds and support;

  • comply with legal obligations—including tax, accounting, product-safety, consumer-protection and law-enforcement requirements;

  • pursue legitimate interests—to operate and secure the website, prevent fraud, improve products and services, understand business performance, respond to enquiries and establish, exercise or defend legal claims, provided those interests are not overridden by your rights;

  • act with your consent—for non-essential cookies, certain analytics or personalised advertising, and marketing where consent is required. You may withdraw consent at any time; and

  • protect vital interests or address legal claims in the unusual circumstances where those bases apply.

If information is required to fulfil an order and you do not provide it, we may be unable to accept or complete the order.

Custom artwork

Artwork and instructions uploaded through our product-options tools are used to assess, prepare, manufacture and support your order. They may be accessible to the specialist application providers that host the upload or product-options service.

Please do not upload personal data that is unnecessary for your design. If your artwork contains another person's personal data, you are responsible for having a lawful reason to provide it to us.

Who we share data with

We share only the information reasonably needed for the relevant purpose. Recipients may include:

  • Shopify, which hosts the storefront, checkout, customer accounts and order-management systems;

  • payment providers, banks and fraud-prevention services that authorise and secure transactions;

  • Cloudlift applications, including Live Product Options and Upload-Lift, which handle product choices, uploaded artwork and related order data;

  • delivery providers, including Royal Mail and other carriers selected for an order;

  • hosting, IT, email, customer-support, analytics and advertising providers, including Google services where enabled and permitted by your cookie choices;

  • professional advisers, insurers, accountants and legal advisers where necessary; and

  • regulators, courts, law-enforcement bodies, tax authorities or other parties where disclosure is required by law, needed to protect legal rights, or connected with a sale or reorganisation of the business.

Each provider handles personal data under its own legal obligations and, where it acts as our processor, under instructions or contractual safeguards.

International transfers

Some service providers operate or store information outside the United Kingdom. This may include Shopify and other technology providers with operations in Canada, the United States, the European Economic Area or elsewhere.

Where required, we or our providers use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or another approved safeguard. You may contact us for more information about safeguards relevant to your data.

How long we keep data

We keep personal data only for as long as reasonably necessary for the purposes described above, including legal, tax, accounting, warranty, fraud-prevention and dispute-resolution requirements.

Our normal retention periods are:

  • order, billing, delivery, custom artwork and production records: up to six years after the order or last relevant transaction;

  • customer-service enquiries not connected with an order: normally up to two years after the enquiry is closed;

  • marketing records: until you unsubscribe or withdraw consent, plus a minimal suppression record so we can respect the opt-out; and

  • cookie and analytics data: for the period described by the relevant cookie or provider, subject to your consent choices.

We may keep data for longer where a legal claim, investigation or other legal requirement makes that necessary, or delete or anonymise it sooner when it is no longer needed. Where another provider controls its own retention, its published privacy information also applies.

Marketing

We send marketing emails only where you have consented or where the law permits us to contact an existing customer about similar products and we offered an opt-out when collecting the details. Every marketing message provides a simple way to unsubscribe.

You can opt out at any time. This will not stop essential service messages about an order, payment, delivery, safety notice or customer-support request.

Cookies and similar technologies

The website uses cookies and similar technologies to:

  • operate essential functions such as the basket, checkout, security, fraud prevention, customer accounts and country or currency selection;

  • remember preferences;

  • measure website use and performance; and

  • support advertising and attribution where you have consented.

Strictly necessary technologies may be used without consent because the service cannot operate properly without them. We ask for consent before using non-essential analytics or advertising technologies where consent is required. You can accept, reject or change non-essential cookie choices through the cookie-preference control on the website. You can also use browser controls, although blocking essential cookies may prevent parts of the store from working.

The specific technologies may change as Shopify and installed services are updated. For general information about Shopify's use of cookies, see Shopify's Cookie Policy.

Automated checks

Shopify, payment providers and fraud-prevention services may use automated signals to assess transaction risk. These checks help protect customers and the business from fraud. We do not ordinarily make a decision producing legal or similarly significant effects about you solely through our own automated processing. If an order is held or refused and you believe this is an error, contact us for a review.

Your data-protection rights

Subject to the law and any applicable exemptions, you may have the right to:

  • ask for access to your personal data;

  • ask us to correct inaccurate or incomplete data;

  • ask us to erase data;

  • ask us to restrict how data is used;

  • receive certain data in a portable format;

  • object to processing based on legitimate interests, including an absolute right to object to direct marketing;

  • withdraw consent at any time where processing relies on consent; and

  • complain to a supervisory authority.

To exercise a right, email mike@outpostworkshop.co.uk. We may need to verify your identity. There is normally no charge, and we will respond within the period required by law.

Children

Our products and website are not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us.

Security

We use reasonable technical and organisational measures and reputable service providers to protect personal data. No internet transmission or storage system can be guaranteed completely secure, so please avoid sending unnecessary sensitive information.

Complaints

Please contact us first so we can try to resolve a privacy concern.

You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint. If you live outside the UK, you may also be able to contact the data-protection authority where you live.

Changes to this policy

We may update this policy to reflect changes in our services, providers or legal obligations. The latest version will be posted here with a revised "Last updated" date. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to your attention.