Privacy policy

Last updated: April 1, 2026

This privacy policy applies to the Sheffield Forum Shop at shop.sheffieldforum.co.uk, operated by B Forum Ltd. trading as Sheffield Forum.

Data controller: B Forum Ltd. T/A Sheffield Forum, 22 Rutland Park, Sheffield, S10 2PB. Registered in England and Wales.

Contact for data matters: shop@sheffieldforum.co.uk

This policy explains what personal data we collect when you visit or make a purchase from our shop, how we use it, who we share it with, and what your rights are under UK GDPR and the Data Protection Act 2018.

This policy covers the shop only. If you are a Sheffield Forum community member, please also refer to the Sheffield Forum Privacy Policy at sheffieldforum.co.uk, which covers your forum membership and newsletter subscription data separately.

1. Personal Data We Collect

When you visit or purchase from the Sheffield Forum Shop, we may collect the following categories of personal data:

Identity data — your name

Contact data — email address, delivery address, billing address, phone number

Financial data — payment card details processed securely by Shopify Payments (powered by Stripe). We do not store your card details — these are handled entirely by our payment processor.

Transaction data — details of products you have purchased, order history, returns and exchanges

Technical data — IP address, browser type, device information, location data, cookies and similar tracking technologies

Usage data — how you browse and interact with the shop, products viewed, items added to cart

Marketing data — your preferences for receiving marketing communications from us, and your consent status

2. How We Collect Your Personal Data

We collect personal data:

Directly from you when you place an order, create an account, sign up for marketing emails, or contact us
Automatically through cookies and tracking technologies when you browse the shop
From third parties including Shopify (platform analytics), Google Analytics (browsing behaviour), and Meta (advertising pixel data, where applicable)

3. How We Use Your Personal Data

We use your personal data for the following purposes, relying on the lawful bases noted:

Purpose	Lawful basis
Processing and fulfilling your order	Performance of contract
Sending order confirmations and shipping updates	Performance of contract
Passing your delivery address to our fulfilment partner (Inkthreadable) and carriers	Performance of contract
Processing payment via Shopify Payments/Stripe	Performance of contract
Fraud detection and prevention	Legitimate interests
Improving our shop and understanding how customers use it	Legitimate interests
Sending marketing emails about new products and offers	Consent (you may opt out at any time)
Displaying targeted advertising (Meta Pixel)	Consent (via cookie consent)
Complying with legal and tax obligations	Legal obligation

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Who We Share Your Personal Data With

We share your personal data with the following third parties, only to the extent necessary for the purposes described above:

Shopify Inc. — our e-commerce platform provider. Shopify hosts the shop and processes personal data on our behalf, including through Shopify Messaging which we use to send automated emails (including abandoned cart reminders and welcome emails) to customers and subscribers who have opted in to marketing communications. Shopify's privacy policy is available at shopify.com/legal/privacy.

Inkthreadable (Hyper Merch T/A Inkthreadable) — our print-on-demand fulfilment partner. We pass your name, delivery address, and order details to Inkthreadable to produce and dispatch your order. Inkthreadable is based in the UK.

Shopify Payments / Stripe — payment processing. Your payment card data is processed securely by Stripe on behalf of Shopify Payments. We do not receive or store your card details.

Royal Mail, DX Courier, DPD — delivery carriers. Your name and delivery address are passed to the relevant carrier to fulfil delivery of your order.

Google (Google Analytics) — we use Google Analytics 4 to understand how visitors use our shop. Data is collected via cookies and is anonymised where possible. Google's privacy policy is available at policies.google.com/privacy.

Meta (Facebook/Instagram Pixel) — where you have consented via our cookie banner, we use the Meta Pixel to measure advertising effectiveness and build audiences for promotional campaigns. Meta's privacy policy is available at facebook.com/privacy/policy.

Judge.me — our reviews platform. If you submit a product review, your display name and review content are processed by Judge.me and displayed publicly on product pages. Judge.me's privacy policy is available at judge.me/privacy-policy.

HMRC and regulatory authorities — we may be required to share data with HMRC or other regulators to comply with our legal obligations, including VAT reporting.

We do not sell your personal data to third parties. We do not share your personal data with third parties for their own marketing purposes without your explicit consent.

5. Cookies

The Sheffield Forum Shop uses cookies and similar technologies. These include:

Strictly necessary cookies — required for the shop to function, including session management, cart functionality, and secure checkout. These cannot be disabled.

Analytics cookies — Google Analytics 4 collects anonymised data about how you use the shop to help us improve it.

Marketing cookies — the Meta Pixel collects data to help us measure and improve our advertising, where you have consented.

You can manage your cookie preferences through our cookie consent banner when you first visit the shop, or by adjusting your browser settings. Disabling analytics or marketing cookies will not affect your ability to browse or purchase.

6. International Transfers

Shopify Inc. is based in Canada and operates globally. Some of your personal data may be processed outside the UK. Where this occurs, Shopify relies on appropriate transfer safeguards including the UK's adequacy decisions and standard contractual clauses. For more information, see Shopify's privacy policy.

Stripe (payment processing) operates globally. Stripe relies on standard contractual clauses for international transfers.

Other processors listed above are primarily UK-based.

7. Data Retention

We retain your personal data for as long as necessary for the purposes set out in this policy, and in accordance with our legal obligations:

Order and transaction data — retained for 7 years to comply with HMRC accounting requirements
Marketing preferences and consent records — retained until you withdraw consent or for 3 years of inactivity, whichever is sooner
Technical and analytics data — retained in line with Google Analytics default retention settings (up to 14 months)
Account data — retained for as long as you hold an account with us, plus a reasonable period thereafter

8. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right of access — to request a copy of the personal data we hold about you
Right to rectification — to request correction of inaccurate or incomplete data
Right to erasure — to request deletion of your personal data in certain circumstances
Right to restrict processing — to request we limit how we use your data in certain circumstances
Right to data portability — to receive your personal data in a structured, machine-readable format
Right to object — to object to processing based on legitimate interests or for direct marketing
Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at shop@sheffieldforum.co.uk. We will respond within one month. We may need to verify your identity before processing your request.

You will not be charged a fee for exercising your rights unless your request is manifestly unfounded or excessive.

9. Marketing Communications

If you have opted in to marketing communications, we may send you emails about new products, offers, and Sheffield Forum news. You can unsubscribe at any time by clicking the unsubscribe link in any marketing email, or by contacting us at shop@sheffieldforum.co.uk.

Unsubscribing from marketing will not affect transactional emails relating to your orders.

10. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. Payment data is processed exclusively by Shopify Payments and Stripe — we never handle raw card data. No security measure is completely infallible, and we recommend using secure connections when accessing the shop.

In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and notify you directly where required by law.

11. Children

The Sheffield Forum Shop is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

12. Changes to This Policy

We may update this privacy policy from time to time. The updated version will be posted at shop.sheffieldforum.co.uk/policies/privacy-policy with a revised date. We will notify you of material changes where required by law.