Privacy Policy

Last updated: 5 October 2026

This Privacy Policy explains how Pitville 2023 Limited, trading as The Union Project (“The Union Project”, “we”, “us” or “our”), collects, uses, stores and shares personal information when you visit theunionproject.com, make a purchase from us, create an account, join our loyalty programme, contact us, subscribe to marketing, interact with our advertising or otherwise use our services.

Pitville 2023 Limited is the data controller responsible for the personal information described in this policy.

Company: Pitville 2023 Limited t/a The Union Project
Company number: 14766639
Correspondence address: 49 Station Road, Polegate, BN26 6EA
Email: info@theunionproject.co.uk

We process personal information in accordance with applicable UK data protection and privacy law, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”), and the Data (Use and Access) Act 2025 where applicable.

1. Personal information we collect

The information we collect depends on how you interact with us.

Information you provide to us

This may include:

• your name;

• email address;

• telephone number;

• billing and delivery addresses;

• account login and customer account information;

• order and transaction information;

• products you purchase, return or exchange;

• gift card and loyalty programme information;

• marketing preferences;

• messages, enquiries and customer service correspondence;

• return and refund information;

• information you provide when entering a promotion, competition or survey; and

• any other information you choose to provide to us.

When you make a payment, payment information is processed by our payment service providers. We do not normally receive or store your complete payment card details.

Information collected automatically

When you use our website, we and our technology providers may automatically collect information including:

• IP address;

• device type and identifiers;

• browser and operating system information;

• approximate location derived from your IP address;

• pages and products viewed;

• searches performed;

• referring websites or advertising;

• interactions with our website;

• shopping basket activity;

• checkout activity;

• purchase activity;

• dates and times of visits;

• cookie and similar technology identifiers; and

• information about your interaction with our emails and advertising.

Some of this information is collected using cookies, pixels, tags, software development kits and similar technologies.

2. How we use your information

We use personal information for the following purposes.

Processing and fulfilling orders

We use your information to:

• process purchases;

• take or arrange payment;

• confirm your order;

• pick, pack and dispatch goods;

• arrange delivery;

• process returns, refunds and exchanges;

• issue invoices and receipts;

• administer gift cards; and

• communicate with you about your order.

Our principal lawful basis for this processing is that it is necessary to perform our contract with you or take steps at your request before entering into a contract.

We may also retain transaction information where necessary to comply with our legal, accounting and tax obligations.

Customer service

We use your information to respond to questions, resolve problems, manage complaints, investigate delivery or return issues and otherwise provide customer support.

Depending on the circumstances, our lawful basis is performance of our contract with you and/or our legitimate interests in providing effective customer service and operating our business.

Customer accounts and loyalty programmes

If you create an account or participate in a rewards or loyalty programme, we may use information about your account, purchases, points, rewards and redemptions to administer that service.

We process this information where necessary to provide the service you have requested and for our legitimate interests in operating and improving our customer programme.

Fraud prevention and security

We may use order, payment, account, device and network information to:

• detect and prevent fraud;

• identify suspicious transactions;

• prevent misuse of our website;

• protect customer accounts;

• investigate security incidents; and

• protect our legal rights and those of our customers.

Our lawful basis is our legitimate interests in protecting our business and customers, and where applicable compliance with legal obligations.

Our ecommerce, payment and fraud-prevention providers may also use automated systems to assess transactions for fraud or security risk.

Website analytics and improvement

We use information about how visitors interact with our website to understand:

• how our website is used;

• which products and pages are popular;

• where visitors arrive from;

• how customers move through the website and checkout;

• whether technical problems occur;

• the effectiveness of changes to our website; and

• the effectiveness of our marketing campaigns.

Where analytics technology requires consent under applicable cookie or electronic communications law, we rely on your consent.

Where the law permits particular low-risk technologies to be used without consent, we may rely on our legitimate interests or another permitted basis.

Personalisation

We may use information about your browsing, purchase history and interactions with us to personalise the products, content or communications you see.

Depending on the technology involved, we rely on your consent and/or our legitimate interests in making our services more relevant and useful.

Marketing communications

Where permitted by law, we may send you information about:

• new products;

• new brands;

• restocks;

• promotions;

• offers;

• sales;

• events; and

• other news from The Union Project.

We may send electronic marketing where:

• you have given us consent; or

• the law allows us to market similar products and services to an existing customer under the electronic marketing “soft opt-in”.

Where we rely on the soft opt-in, the relevant legal conditions must be satisfied, including giving you an opportunity to opt out when your details are collected and in subsequent marketing messages.

You can unsubscribe from marketing emails at any time by using the unsubscribe link contained in our emails or by contacting us.

Withdrawing from marketing does not affect transactional communications such as order confirmations, dispatch updates, returns information or service messages.

We may retain a limited record of your opt-out so that we can make sure we continue to respect your preference.

Advertising and retargeting

Subject to your cookie choices and applicable law, we may use advertising technologies supplied by companies such as Meta and Google to:

• measure advertising performance;

• understand whether advertisements result in visits or purchases;

• show advertisements to people who have previously visited our website;

• create or use advertising audiences;

• exclude existing customers from particular advertising;

• understand the effectiveness of campaigns; and

• improve how advertising budget is used.

This may involve sharing identifiers and information about website or purchase activity with advertising platforms.

Where required, we rely on your consent for the use of advertising cookies, pixels and similar technologies.

Advertising platforms may separately process information in accordance with their own privacy policies.

3. Cookies and similar technologies

Our website uses cookies and similar technologies.

These may include:

Strictly necessary cookies

These are required for functions such as:

• shopping baskets;

• checkout;

• security;

• customer accounts;

• payment processing; and

• remembering essential website settings.

These generally do not require consent where they are necessary to provide a service you have requested.

Analytics cookies

These help us understand how visitors use our website and measure website performance.

Advertising cookies and pixels

These may be used to measure advertising, understand conversions, build advertising audiences and show relevant advertisements on other websites or platforms.

Functional cookies

These may remember choices or provide enhanced functionality.

Where consent is required, non-essential technologies are not intended to be activated until the appropriate consent has been obtained.

You can change your choices using the cookie or privacy settings available on our website.

Changes to UK law mean that certain limited, low-risk cookies may be permitted without consent in some circumstances. Where we use such technologies, we will do so only where the legal requirements are met.

4. The services and organisations we use

We share personal information only where reasonably necessary for the purposes described in this policy.

Recipients may include:

Shopify

Our online store is hosted and operated using Shopify. Shopify processes information required to provide our storefront, checkout, customer accounts, ecommerce infrastructure and related services.

Payment providers

Payment providers process payments, perform security checks and may carry out fraud-prevention activities.

Depending on the payment option you choose, this may include Shopify Payments or other payment methods made available at checkout.

Klaviyo and marketing providers

We use marketing technology, including Klaviyo, to manage email communications, customer segments, marketing preferences and the performance of our marketing activity.

Google

We may use Google services including Google Analytics and advertising services to measure use of our website and advertising performance.

Meta

We may use Meta technologies, including advertising and measurement tools associated with Facebook and Instagram, to measure campaigns and, where permitted, provide targeted advertising.

Loyalty and customer-engagement providers

Where you use our rewards or loyalty services, relevant information may be processed by the technology providers that operate those services on our behalf.

Delivery and logistics providers

We provide appropriate order and contact information to couriers, postal operators, fulfilment partners and logistics companies where necessary to deliver or return your order.

Returns providers

We may share relevant order and customer information with providers used to operate our online returns and exchange processes.

Professional advisers and service providers

We may share information with organisations such as:

• accountants;

• legal advisers;

• insurers;

• IT and hosting providers;

• security providers;

• fraud-prevention providers;

• customer support providers; and

• other suppliers that help us operate our business.

These organisations are only provided with information where there is an appropriate reason for doing so.

5. Legal disclosures

We may disclose personal information where reasonably necessary to:

• comply with applicable law;

• comply with a court order or other legally enforceable request;

• cooperate with law enforcement or regulatory authorities;

• establish, exercise or defend legal claims;

• investigate suspected fraud or unlawful activity;

• protect our customers, staff or business; or

• enforce our contractual rights.

We may also transfer personal information as part of a sale, restructuring, merger or transfer of all or part of our business, subject to appropriate protections.

6. International transfers

Some of the technology companies and service providers we use operate internationally, which means personal information may be processed outside the United Kingdom.

Where UK data protection law treats this as a restricted international transfer, we take steps designed to ensure that an appropriate level of protection applies.

Depending on the destination and provider, this may include:

• UK adequacy regulations;

• participation in an approved international data-transfer framework;

• the UK International Data Transfer Agreement;

• the UK Addendum to approved contractual clauses; or

• another lawful transfer mechanism.

Additional safeguards may be applied where required.

7. How long we keep personal information

We do not keep personal information for longer than is reasonably necessary for the purposes for which it was collected, including legal, tax, accounting, fraud-prevention and dispute-resolution requirements.

Retention periods vary according to the type of information.

For example:

• order and transaction records are normally retained for the period required for accounting, tax and legal purposes, which may be at least six years;

• customer service and returns records may be retained for a reasonable period after the matter is resolved in case of subsequent enquiries or disputes;

• account information may be retained while your account remains active and for a reasonable period afterwards;

• marketing information may be retained while you remain subscribed or while we otherwise have a lawful reason to process it;

• marketing suppression information may be retained after you unsubscribe so we can continue to honour your request;

• fraud and security records may be retained where reasonably necessary to protect our business and customers; and

• cookie and analytics information is retained according to the type of technology used and the configuration of the relevant provider.

Where information is no longer required, we will delete, anonymise or otherwise securely dispose of it where appropriate.

8. Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

Access

Ask for confirmation that we process your personal information and obtain a copy of it.

Rectification

Ask us to correct inaccurate or incomplete personal information.

Erasure

Ask us to delete your personal information in certain circumstances.

This right is not absolute. For example, we may need to retain information to comply with legal obligations or establish or defend legal claims.

Restriction

Ask us to restrict how we process your information in certain circumstances.

Data portability

Receive certain personal information you provided to us in a structured, commonly used and machine-readable format and, where applicable, ask us to transfer it elsewhere.

Object

Object to processing based on legitimate interests in certain circumstances.

You have an absolute right to object to the use of your personal information for direct marketing.

Withdraw consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not make processing carried out before withdrawal unlawful.

Rights relating to automated decision-making

Where applicable, you may have rights in relation to decisions made solely by automated means that have legal or similarly significant effects on you.

9. Exercising your rights

You can make a data protection request by contacting:

Email: info@theunionproject.co.uk

Post:
The Union Project
Pitville 2023 Limited
49 Station Road, Polegate, BN26 6EA

Please describe what you are requesting and provide enough information for us to identify the relevant records.

We may need to ask for reasonable evidence of identity before disclosing or changing personal information.

We will normally respond within the period required by applicable data protection law.

10. Complaints about our use of personal information

If you are concerned about how we have handled your personal information, please contact us first so that we have an opportunity to investigate.

You can contact us at:

info@theunionproject.co.uk

or by post at:

The Union Project
Pitville 2023 Limited
Pitville 2023 Ltd, 49 Station Road, Polegate, BN26 6EA

We will handle data protection complaints in accordance with our obligations under applicable law, including acknowledging qualifying complaints within the legally required period and responding without undue delay.

You also have the right to complain to the UK data protection regulator, the Information Commissioner’s Office (ICO).

Information about making a complaint is available at ico.org.uk.

You do not have to contact us before raising a concern with the ICO, although the ICO may recommend that you give us an opportunity to address the issue first.

11. Children

Our website and products are not specifically directed at children.

We do not knowingly seek to collect personal information from children where doing so would be inappropriate.

Where we know that a user is a child, we will take account of the additional protections required by data protection law.

12. Security

We use reasonable organisational and technical measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

No internet transmission or information-storage system can be guaranteed to be completely secure.

13. Third-party websites

Our website may contain links to websites or services operated by other organisations.

We are not responsible for the privacy practices of those organisations. You should review their privacy information when using their services.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to:

• our business;

• the services and technology we use;

• how we process personal information; or

• legal and regulatory requirements.

Where a change materially affects how we use personal information, we will take reasonable steps to bring that change to the attention of affected individuals where required.

The date at the top of this policy shows when it was last updated.

15. Contact us

If you have questions about this Privacy Policy, our use of personal information or your data protection rights, please contact:

Pitville 2023 Limited t/a The Union Project
Company number 14766639

Email: info@theunionproject.co.uk

Correspondence address:
Pitville 2023 Ltd, 49 Station Road, Polegate, BN26 6EA
United Kingdom