Privacy Policy

Section 1

About this policy

Creator Clash is operated by I Made This Limited, a company registered in England and Wales under company number 15540039. In this policy, “we”, “us” and “our” mean that company.

This policy applies to www.creator-clash.com and the Creator Clash website and services available through it, including the shop, card database, lore pages, customer accounts, basket and checkout, contact forms and customer support.

We are the data controller for the personal information described here, unless we tell you that another organisation is acting as a separate controller for a particular processing activity. This policy should be read with our Cookie Policy, Terms & Conditions, Refund, Returns and Cancellation Policy and Acceptable Use Policy.

We aim to provide privacy information in clear language and to keep it up to date. If we introduce a new use of personal information, we will update this policy and provide any additional notice or choice required before that use begins.

Section 2

Information we collect

“Personal information” means information that identifies you or can reasonably be linked to you. The information we collect depends on how you use Creator Clash.

Information you provide

• Account information: your email address, username, password and account settings. We store passwords as protected password hashes rather than in plain text.
• Order information: the products and quantities ordered, order number, prices, discounts, delivery charge, tax, delivery name and address, telephone number where supplied, order status and refund or return details.
• Contact and support information: your name, email address, order number, message, attachments and any other information you choose to include when you contact us.
• Information you submit: feedback, reports, photographs or other material you send through a feature that invites submissions.

Information collected through use

• Session and security information: a session identifier and server-side session data used to keep the site, sign-in, basket and checkout working, including CSRF protection tokens.
• Technical information: IP address, browser and device details, request timestamps, pages or functions requested, error information and security events where these are recorded by our website or hosting providers.
• Cookie and similar-technology information: information stored or accessed by necessary website sessions and by payment technologies. See our Cookie Policy for the current inventory and choices.

Information from payment and delivery providers

When you use checkout, Stripe may provide us with your name, email address, telephone number, billing or delivery details, payment status, payment method type, Stripe customer or payment identifiers, discounts, tax and transaction totals. We do not receive or store your full card number or security code on our own checkout server.

We may receive delivery or return information from carriers and fulfilment partners, including collection or tracking information when a return collection is arranged.

Information we do not ask you to send

Please do not send passwords, full payment-card numbers, security codes, access tokens or other sensitive information through a contact form or support email. If you send information that is not needed, we may remove it from our records where practical.

Section 3

How we use information and our lawful bases

We decide why and how personal information is used for the purposes below. We choose and document a lawful basis for each purpose under the UK GDPR. Where we rely on legitimate interests, we consider whether those interests are proportionate and whether your rights and expectations override them.

• Provide the website and account features: to create and manage accounts, recognise sign-in status, maintain baskets and provide requested features. The basis is performance of a contract or taking steps at your request before a contract, and sometimes our legitimate interests in running a secure service.
• Process and fulfil orders: to confirm products, take payment, calculate totals and tax, reserve stock, deliver products, provide order updates, handle cancellations, returns and refunds. The basis is performance of the contract and compliance with legal obligations.
• Provide support: to answer questions, investigate complaints, identify orders and communicate with you. The basis is performance of a contract, steps before a contract and our legitimate interests in providing customer service.
• Keep the service safe: to authenticate users, prevent fraud, protect accounts, detect abuse, secure systems, investigate incidents and enforce our terms. The basis is our legitimate interests and, where applicable, legal obligations.
• Keep business records: to maintain accounting, tax, order, payment, complaint and legal records, respond to lawful requests and establish or defend legal claims. The basis is legal obligation and our legitimate interests.
• Optional marketing or non-essential technologies: we do not currently use optional analytics or marketing tools on the supplied website configuration. If this changes, we will provide the required notice and obtain consent where required. Marketing consent can be withdrawn at any time.

We do not sell personal information. We do not use your order information to send promotional marketing unless you have separately asked to receive it or the law otherwise permits it. Service messages such as order, payment, delivery, security and support communications are not optional marketing.

Section 4

Accounts and sign-in

If you create an account, we use your account details to authenticate you, display account features, protect against unauthorised access and keep your account available across requests. Login and checkout use server-side sessions. The browser receives a session identifier; basket data, CSRF tokens and other session values remain on the server.

We may ask you to verify account or order details before changing information, disclosing account data or arranging a refund. We do not use your password for any purpose other than authentication, and we do not store it in readable form.

You may ask us to close your account or correct its details. Closing an account does not automatically delete order, payment, complaint, fraud-prevention or accounting records that we must retain or may reasonably need for legal claims.

Section 5

Orders, payments and delivery

When you place an order, we use the information needed to create and manage the order, reserve inventory, take payment, arrange UK delivery, send a confirmation, provide support and handle returns or refunds. The shop currently accepts delivery addresses in the United Kingdom.

Stripe processes payment through Stripe Checkout and the payment methods presented to you. Stripe may create a customer record or offer saved-payment-method features when enabled and selected. We receive the transaction and payment identifiers needed to reconcile your order, but payment-card details are handled by Stripe rather than stored by us. Stripe may act as an independent controller for some of its own processing; read the Stripe Privacy Centre and Stripe's applicable notices.

We share delivery name, address, telephone number where supplied and order details with delivery or fulfilment providers where necessary to deliver products or arrange a return collection. We may share relevant information with DPD where a DPD collection is arranged under the Refund Policy.

Order emails and other service communications may be sent through our website email service or a transactional email provider. Those messages may include your order number, products, totals, delivery details and support instructions.

Section 6

Contact and support

If you contact us, we use the information in your message to answer you, verify a purchase, investigate a complaint, provide support and improve our processes. We may keep a record of the conversation so that we can follow up consistently and show how a complaint or request was handled.

Please provide only information relevant to your enquiry. Do not send full payment details, passwords or identity documents unless we specifically request a secure form for a lawful reason. If we need additional information to verify a data-rights request, we will explain what is needed.

Section 7

Cookies and similar technologies

Our Cookie Policy explains the session cookie and other cookies or similar technologies that may be used by the website and Stripe checkout. Necessary session technology helps us provide requested account, basket and checkout functions. Optional analytics, advertising and marketing technologies are not currently configured in the supplied website setup.

A cookie can contain an identifier that links a browser to server-side session data. It does not itself contain your password, full payment-card number or the contents of your basket when the basket is stored in our server-side session.

We will not treat a technology as exempt from consent merely because it is convenient. Where the law requires prior consent for a non-essential cookie or similar technology, we will ask for it before using that technology and provide a way to withdraw it.

Section 8

Who we share information with

We share personal information only when it is necessary for the purposes described in this policy, where you ask us to, or where the law allows or requires it. Categories of recipients include:

• Payment providers: Stripe and the payment methods made available through Stripe Checkout.
• Hosting, database and technology providers: providers that host, secure, maintain or back up the website, database, email systems and operational tools.
• Delivery and fulfilment providers: carriers, warehouses and return-collection providers needed to deliver or receive products.
• Professional advisers: accountants, insurers, auditors, lawyers and other advisers where they need the information to advise us.
• Authorities and other parties: courts, regulators, law enforcement, fraud-prevention services or other parties where disclosure is required or reasonably necessary to protect rights, safety or property.

Service providers acting on our instructions must use appropriate confidentiality and security measures. Some providers, including Stripe, may also act as an independent controller for their own legal, fraud-prevention or service purposes; their privacy notices explain those uses.

Section 9

International transfers

Some technology, payment, email, hosting or support providers may process personal information outside the United Kingdom. Where a transfer is subject to UK data protection law, we use an adequacy decision or another lawful safeguard, such as the UK International Data Transfer Agreement or the UK Addendum to EU standard contractual clauses, where appropriate.

Contact us if you want more information about the safeguards relevant to a particular provider. Providers may also publish their own transfer information in their privacy notices.

Section 10

How long we keep information

We keep personal information only for as long as it is needed for the purpose it was collected, to meet legal and accounting requirements, to resolve complaints, or to establish, exercise or defend legal claims. We then securely delete it or make it anonymous where practical.

• Accounts: while your account is active and for a reasonable period after closure to handle requests, security matters and legal obligations.
• Orders, payments and tax records: normally for up to six years after the end of the relevant accounting period, or longer where necessary for a legal claim or other legal obligation.
• Support and complaints: while the matter is open and for a reasonable period afterwards to evidence how it was handled and respond to related claims.
• Security and technical logs: for the shorter period needed to investigate incidents, maintain security and meet provider or legal requirements.
• Consent records: for as long as needed to demonstrate and manage the consent, objection or withdrawal concerned.
• Cookies and sessions: for the periods described in our Cookie Policy.

Section 11

Security

We use measures appropriate to the risk, including HTTPS where available, protected password hashing, session safeguards, CSRF protection, access controls and restricted access to operational systems. Payment-card details are handled by Stripe rather than stored in our own checkout database.

No website or transmission is completely secure. If we become aware of a personal-data incident that requires notification, we will follow the UK GDPR and other applicable legal requirements. Tell us promptly if you believe your account or information has been compromised.

Section 12

Your privacy rights

Subject to legal limits and exceptions, you may have the right to:

• ask for a copy of the personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information where there is no good reason for us to keep using it;
• ask us to restrict processing in certain circumstances;
• object to processing based on legitimate interests, including profiling based on them;
• object at any time to direct marketing;
• receive certain information in a portable format where the right applies;
• withdraw consent where our processing relies on your consent; and
• ask for human review of a decision where applicable data-protection law gives you that right.

We do not currently make decisions about you based solely on automated processing that produce legal or similarly significant effects. Payment and fraud-prevention providers may use automated checks under their own notices. Contact the provider and us if you need information about a decision affecting a payment or order.

To exercise a right, contact us using the details in section 14. We may ask for information reasonably needed to verify your identity and locate the relevant records. We normally respond within one month, although the law may allow more time for complex or repeated requests. We will not normally charge a fee, but may charge or refuse a manifestly unfounded or excessive request where the law permits.

You can complain to the Information Commissioner's Office (ICO), the UK supervisory authority, but we would welcome the opportunity to investigate your concern first.

Section 13

Children's information

Creator Clash is not directed at children under 13 and we do not knowingly ask children under 13 to create accounts or provide personal information. General website content may be visible to people of different ages, but account and purchase users must be able to enter into the relevant agreement or have a parent or guardian help them do so.

If you believe a child has provided personal information to us, contact us using the details below. We will consider the request and delete information where we do not have a lawful reason to retain it.

Section 14

Changes

We may update this policy when our services, technology, suppliers or legal obligations change. The date at the top of the page shows when it was last updated. Where a change materially affects how we use information, we will provide any notice or choice required by law.