Orders shipped to Europe || Dispatched from UK warehouse
- About this privacy policy
This Privacy Policy sets out how www.winterbasely.com (operating under the brand name Winterbasely) collects, uses, stores, and protects your personal data when you visit our website, communicate with us, or purchase thermal apparel and related garments from our store.
We are committed to protecting your privacy and handling your personal data in an open, transparent, and legally compliant manner. This policy is formulated in accordance with the United Kingdom General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the European Union General Data Protection Regulation (EU GDPR) (Regulation (EU) 2016/679), and the Privacy and Electronic Communications Regulations (PECR).
- Data controller
For the purposes of applicable data protection legislation in the United Kingdom and the European Economic Area (EEA), the legal entity responsible for determining the purposes and means of processing your personal data (the Data Controller) is:
Data Controller / Website: www.winterbasely.com (“Winterbasely”, “we”, “us”, or “our”)
Registered Address: Wigston Business Centre, North Street, Wigston, Leicestershire, LE18 1PS, United Kingdom
Telephone Number: +44 116 262 2261
Email Address: base@winterbasely.com
- The personal data we collect
We collect personal data directly from you during your interactions with our website and checkout process. The categories of personal data collected include:
Identity Data: Full name, title, and preferred salutation.
Contact Data: Billing address, shipping address, email address, and telephone number.
Transaction Data: Details regarding products purchased, order reference numbers, delivery choices, and order history.
Technical Data: IP address, browser type and version, time zone setting, operating system, and standard website navigation logs collected automatically via essential technical cookies.
Communications Data: Records of customer service inquiries, contact form correspondence, and direct email communications.
We do not collect sensitive categories of personal data (special category data), such as medical data, biometrics, or political affiliations.
- Payment processing & third-party processors
Payment Processing:
All financial transactions conducted on www.winterbasely.com are processed securely through our dedicated third-party payment infrastructure provider, Stripe (Stripe Payments UK Ltd / Stripe Technology Europe, Limited).
When you place an order, your payment card details (such as credit card number, expiration date, and security code) are transmitted directly to Stripe via encrypted channels using Transport Layer Security (TLS/SSL). Winterbasely does not store, host, or view full payment card details or sensitive authentication credentials on our own servers.
Stripe acts as a data processor on our behalf to facilitate transaction verification, fraud assessment, and payment authorization, and as an independent controller where strictly required for regulatory compliance and anti-money laundering obligations under UK and EU law.
- Lawful bases for processing
We only process your personal data when applicable UK and EU laws permit us to do so. Most commonly, we process data under the following lawful bases:
Performance of a Contract (Article 6(1)(b) UK/EU GDPR): Processing is necessary to fulfill order requirements, manage deliveries, process payments, and render customer service.
Legal Obligation (Article 6(1)(c) UK/EU GDPR): Processing is necessary to comply with legal, tax, accounting, and consumer protection requirements.
Legitimate Interests (Article 6(1)(f) UK/EU GDPR): Processing is necessary for legitimate commercial interests, such as operating our website efficiently, preventing fraud, and securing network infrastructure.
Consent (Article 6(1)(a) UK/EU GDPR): Where explicit consent has been provided, such as subscription to non-essential website functionality or direct promotional news.
- How we use your personal data
Your personal data is strictly used for legitimate operational purposes, including:
Processing, packaging, and delivering your orders.
Communicating order updates, shipping notifications, and customer service responses.
Verification of transactions and preventing fraudulent site activities.
Fulfilling statutory accounting, audit, tax, and record-keeping duties.
Maintaining network security and operating our website infrastructure.
- Data retention periods
In accordance with UK and EU data protection principles, we do not retain personal data longer than necessary for the purposes for which it was collected. Specific retention periods include:
Order & Financial Records: Retained for 6 years from the end of the financial year in which the transaction occurred, to comply with legal requirements imposed by HM Revenue & Customs (HMRC) and statutory accounting standards in the UK and European Union.
Customer Communications: Retained for 2 years following the resolution of the relevant query or order inquiry, after which records are archived or permanently deleted.
Marketing Records: Retained until you withdraw consent or request unsubscription.
Technical Logs: Retained for up to 12 months for network security, diagnostic, and server performance monitoring.
Upon expiration of the applicable retention period, personal data is securely deleted or anonymized in accordance with statutory procedures.
- Data transfers & disclosures
We do not sell, rent, or trade your personal data. We disclose personal data only to trustworthy third-party service providers acting on our strict instructions (Data Processors) for operational purposes, including:
Payment processing providers (Stripe).
Courier, postal, and logistics partners handling direct physical parcel dispatch.
IT hosting, domain administration, and website security infrastructure partners.
Where personal data is transferred outside the United Kingdom or European Economic Area (EEA), we ensure appropriate statutory safeguards are applied, such as Standard Contractual Clauses (SCCs) approved by the European Commission or the UK International Data Transfer Agreement (IDTA).
- Your statutory rights
Under the UK GDPR and EU GDPR, you have the following rights regarding your personal data:
Right of Access: Request a copy of the personal data held about you.
Right to Rectification: Request correction of inaccurate or incomplete personal data.
Right to Erasure: Request deletion of your personal data where processing is no longer required by law.
Right to Restrict Processing: Request temporary suspension of personal data processing under specific conditions.
Right to Data Portability: Request transfer of your data to yourself or another service provider in a structured, machine-readable format.
Right to Object: Object to processing carried out under legitimate interest grounds.
Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent.
To exercise any of these rights, please contact our Data Controller at base@winterbasely.com. We respond to statutory access requests within one calendar month.
- Data security measures
We implement robust technical and organizational security measures to safeguard your personal data against unauthorized access, loss, alteration, or disclosure. These measures include encrypted communication protocols (TLS/SSL), restricted administrative access, administrative firewalls, and regular security reviews.
While we apply rigorous security protocols meeting recognized standards, no automated transmission across the Internet or electronic storage system can be categorized as completely impervious.
- Cookies and tracking
Our website uses essential technical cookies necessary for site performance, shopping cart functionality, and checkout completion. Non-essential cookies, such as analytics or preference cookies, are only placed on your device with your explicit opt-in consent gathered via our cookie consent interface. You can adjust your browser settings to reject cookies at any time.