Privacy Policy | STItems

1. Who we are

ST Items ("we", "us", "our") operates the website stitems.co.uk and its associated services. We are a UK-based custom-print business specialising in DTF transfers, UV-printed products, custom stickers and 3D-printed goods.

For questions about this policy or to exercise your rights, contact us at shop@stitems.co.uk.

2. What data we collect

We collect only the data needed to run our service:

Account data — name and email address when you register.
Order data — delivery address, items ordered, payment reference and order history.
Design files — artwork you upload for custom products, retained only as long as needed to fulfil and support your order.
Contact messages — name, email address and the content of any message you send us through the contact form.
Technical data — IP address and standard server logs, retained for security purposes for up to 90 days.

We do not store payment card details. All card processing is handled by Stripe (see section 5).

3. How we use your data

Order fulfilment — processing and dispatching your order and sending you order status updates.
Customer support — responding to contact form submissions and resolving issues.
Account management — allowing you to log in, view past orders and update your details.
Security and fraud prevention — protecting the site and our customers from abuse.
Legal obligations — retaining records as required by UK law (e.g. tax records for 6 years).

We rely on contract performance as the legal basis for processing order-related data, and on legitimate interests for security and fraud prevention. Where we have asked for your consent (e.g. marketing emails), you may withdraw it at any time.

4. Who we share data with

We share data only with trusted processors necessary to run the service:

Stripe — payment processing. See stripe.com/gb/privacy.
Cloudflare — bot protection (Turnstile) and DNS. See section 7 for the Turnstile-specific addendum, and cloudflare.com/privacypolicy.
Apple iCloud Mail (SMTP) — used to send transactional emails (order confirmations, contact form replies).
Hosting provider — our server is hosted on Oracle Cloud (UK region). Oracle's privacy policy is available at oracle.com/legal/privacy.

We do not sell your data or share it with third parties for marketing purposes.

5. Stripe

Payments are processed by Stripe, Inc. When you check out, your card details are entered directly into Stripe's secure fields and never touch our servers. Stripe may store a tokenised reference to your payment method. Stripe is PCI-DSS Level 1 certified. For full details see stripe.com/gb/privacy.

6. Cookies and local storage

We use session cookies and browser localStorage to keep you logged in and to maintain your shopping cart. No advertising or analytics tracking cookies are set. If you clear your browser storage your session and cart will be lost.

7. Cloudflare Turnstile — Privacy Addendum

Our contact form is protected by Cloudflare Turnstile, a CAPTCHA alternative provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Turnstile is used to distinguish human visitors from automated bots and to prevent spam, without showing intrusive image puzzles.

When you load or submit the contact form, Turnstile may collect and process:

Your IP address
Browser type, version and language settings
Device screen resolution and timezone
Behavioural signals (mouse movements, keypress timing) used solely for bot detection
A short-lived challenge token that proves a successful human verification

This data is processed by Cloudflare on their infrastructure. Cloudflare does not use Turnstile data for advertising or profiling. The challenge token is verified server-side by us and then discarded; we do not store it alongside your message.

The legal basis for this processing is our legitimate interest in protecting our service from automated abuse and spam (Article 6(1)(f) UK GDPR).

Because Cloudflare is a US company, data may be transferred to the United States. Cloudflare participates in the EU-US Data Privacy Framework and has entered into Standard Contractual Clauses for transfers from the UK. For full details see cloudflare.com/privacypolicy.

You may contact Cloudflare directly about their data practices at privacyquestions@cloudflare.com.

8. Data retention

Order records — kept for 6 years to comply with UK tax law.
Account data — kept until you request deletion.
Design uploads — deleted within 30 days of order completion unless you contact us to request earlier deletion.
Contact form messages — kept for up to 2 years for support reference, then permanently deleted.
Server logs — retained for up to 90 days.

9. Your rights under UK GDPR

You have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — ask us to correct inaccurate or incomplete data.
Erasure — ask us to delete your data where there is no lawful reason to retain it.
Restriction — ask us to limit how we use your data in certain circumstances.
Portability — receive your data in a machine-readable format.
Object — object to processing based on legitimate interests.
Withdraw consent — where processing relies on consent, withdraw it at any time.

To exercise any of these rights, email us at shop@stitems.co.uk. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO).

10. Security

We use HTTPS (TLS) for all data in transit, hashed passwords (bcrypt), and access controls to limit who can view customer data internally. No system is perfectly secure; if you believe your data has been compromised please contact us immediately.

11. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top will always reflect the most recent version. Significant changes will be communicated by email to registered customers.