Privacy Policy

Last Updated: October 2, 2026

This Privacy Policy explains what personal data we collect when you visit UW Hockey Shop or buy from us, why we collect it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who We Are

The data controller is {COMPANY_NAME}, company number {COMPANY_NUMBER}, {COMPANY_ADDRESS}. For any privacy question or request, email orders@waterwayfins.eu.

2. Data We Collect

• Order data: your name, email, phone number, shipping and billing address, the products you order, your sizing details and any order notes.
• Foot tracings and photos: if you upload them after purchase so we can make your fins to measure.
• Payment data: card and wallet payments are handled by our payment provider. We never see or store your full card number. For bank transfers we receive the payer name and reference.
• Support messages: emails, contact-form messages and chat conversations with our support assistant.
• Usage data: pages visited, clicks, device and browser type, approximate location from your IP address, and, only with your consent, session recordings (see section 5).
• Technical error data: details of errors on the site, without your name or contact details.

3. Why We Use Your Data and Our Legal Basis

• To make, ship and support your order, including order and payment emails, reminders about an unpaid bank transfer, and requests for your foot tracing. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep accounting and tax records. Legal basis: legal obligation (Art. 6(1)(c)).
• To remind you about items left in your cart, and to ask you for a review after delivery. Legal basis: our legitimate interest (Art. 6(1)(f)). Every such email has an unsubscribe link.
• To send newsletters and offers, only if you ticked the newsletter box. Legal basis: consent (Art. 6(1)(a)). You can withdraw it at any time.
• To count visits anonymously, prevent fraud and fix errors. Legal basis: our legitimate interest in running a secure, working shop.
• To use analytics cookies, session recordings, heatmaps and Google tags. Legal basis: consent, given through our cookie banner.

4. Who We Share Data With

We do not sell your personal data. We share it only with the service providers we need to run the shop, under data processing agreements:

• Revolut: card, Apple Pay and Google Pay payments, and bank transfers.
• Our manufacturer: your order details, sizing and foot tracing, so your fins can be made.
• Shipping carriers: your name, address and phone number, for delivery.
• Supabase: database hosting.
• Vercel: website hosting.
• Resend: sending our emails.
• OpenAI: powers our support chat assistant and helps draft replies to support emails. It receives the content of your messages.
• Trustpilot: review invitations after delivery.
• PostHog (EU hosting, Frankfurt): website analytics, and session recordings and heatmaps with your consent.
• DataFast: website visit statistics.
• Google (Analytics and Tag Manager): website analytics, only with your consent.
• Sentry: error monitoring.

5. Analytics and Session Recordings

Until you accept cookies, PostHog counts visits without cookies or any storage on your device, and nothing links your visits together. If you accept, PostHog may also record anonymised sessions (how the page moves, scrolls and is clicked) and build heatmaps. Everything you type into forms is masked, and uploaded photos are never recorded. You can withdraw consent at any time through the Cookie settings link at the bottom of every page. For details see our Cookie Policy.

6. Transfers Outside the EU

We are based in the United Kingdom, which the European Commission recognises as giving adequate protection to personal data. Some providers above (for example OpenAI, Vercel, Resend, Sentry and Google) may process data in the United States. These transfers are protected by the EU–US Data Privacy Framework (and its UK extension) or by Standard Contractual Clauses.

7. How Long We Keep Data

• Order, invoice and payment records: 6 years after the end of the financial year, as required by UK tax law.
• Foot tracings and sizing details: for as long as you may need a replacement or warranty repair, and then deleted. You can ask us to delete them sooner.
• Support conversations: up to 3 years after your last message.
• Abandoned-cart data: up to 90 days.
• Newsletter data: until you unsubscribe.
• Analytics data and session recordings: according to each provider's retention settings, no longer than 12 months.

8. Your Rights

You have the right to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Where we rely on consent, you can withdraw it at any time; this does not affect what we did before. To use any of these rights, email orders@waterwayfins.eu. We reply within one month.

You also have the right to complain to the data protection authority in the EU country where you live, work or think your rights were breached. In the UK, the authority is the Information Commissioner's Office (ico.org.uk).

9. Security

Data is sent over encrypted connections (HTTPS) and stored with access controls. Only staff and providers who need it can access it.

10. Changes to This Policy

We may update this policy when our services or the law change. The date at the top always shows the latest version.