Privacy Policy

Who we are

This site is operated by Swazball ("Swazball", "we", "us" or "our").

For the purposes of data protection law, we are the data controller of the personal information described in this policy. That means we decide what is collected and why, and we are accountable for how it is handled.

This policy applies to our website, our online store, our email and social channels, and any customer service contact with us. It does not apply to third-party websites we link to, which have their own policies.

You can reach us about anything in this policy at privacy@swazball.com.

What personal information we collect

We collect only what we need. Depending on how you use the site, that may include:

Information you give us

• Identity and contact details — name, email address, telephone number, billing address and delivery address.
• Order information — the products you buy, order value, order history, sizes and colourways selected, and any gift message.
• Account information — username and password (stored only as a secure hash, never in readable form), saved addresses and saved preferences, if you create an account.
• Communications — the content of emails, contact form submissions, social media messages and customer service correspondence, including returns and warranty claims.
• Marketing preferences — whether you have opted in to drop announcements and what you have opted out of.

Information we collect automatically

• Device and technical data — IP address, browser type and version, operating system, device type, screen size, language and time zone settings.
• Usage data — pages viewed, products viewed, time spent, referring site, search terms used on our site, and the links you click.
• Cookie data — identifiers set by us and by our analytics and advertising partners, as described in section 10.

Information we receive from others

• Payment confirmations from our payment processors — including the outcome of a transaction, the card type and the last four digits.
• Delivery updates from our shipping carriers.
• Fraud and risk signals from our payment and fraud-prevention providers.
• Aggregated audience data from analytics and advertising platforms.

How we collect it

• Directly from you — when you place an order, create an account, join our mailing list, enter a competition, leave a review, or contact us.
• Automatically — through cookies and similar technologies as you browse, where you have consented to non-essential cookies.
• From third parties — our payment, delivery, analytics and fraud-prevention providers, as listed in section 5.

Why we use it, and our lawful basis

We only use your personal information where the law allows. In most cases that is one of the bases below.

Where we rely on legitimate interests, we have considered whether that interest is overridden by your rights, and concluded it is not. You can ask us for details of that assessment, and you can object — see section 9.

If we ever need to use your information for a new purpose that is not compatible with those above, we will tell you first and, where required, ask for your consent.

Who we share it with

We do not sell your personal information, and we never have. We share it only with the following categories of recipient, and only as far as they need it to do their job for us:

• Payment processors — to take payment securely and screen for fraud.
• Shipping and fulfilment partners — to pack and deliver your order and handle returns.
• E-commerce and hosting providers — to run the store and host the site.
• Email and marketing platforms — to send order confirmations and, where you have opted in, drop announcements.
• Analytics providers — to measure how the site performs.
• Advertising platforms — where you have consented to advertising cookies.
• Customer service tools — to manage and respond to your enquiries.
• Professional advisers — accountants, auditors, insurers and lawyers, where necessary.
• Authorities — law enforcement, regulators and courts, where we are legally required to disclose.
• A buyer or successor — if we sell, merge or restructure the business, in which case your information transfers with it and this policy continues to apply until you are told otherwise.

Every processor we use is bound by a written contract requiring them to keep your information secure, to use it only on our documented instructions, and never for their own purposes. You can request the current list of our processors by emailing us.

International transfers

Some of our providers operate outside your country, including in the United States and elsewhere. Where we transfer personal information outside the UK or the European Economic Area, we make sure it is protected to an equivalent standard by relying on one of the following:

• an adequacy decision by the relevant authority confirming the destination country offers adequate protection;
• Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with a transfer risk assessment; or
• another lawful safeguard permitted under applicable data protection law.

You can request a copy of the safeguards we rely on by contacting us.

How long we keep it

We keep personal information only for as long as we need it for the purpose we collected it, then delete or irreversibly anonymise it. In practice:

Where a legal claim is active or reasonably anticipated, we may keep relevant records until it is resolved.

How we protect it

We take appropriate technical and organisational measures to protect your personal information against loss, misuse, unauthorised access, disclosure, alteration and destruction. These include encryption of data in transit using TLS, encryption of sensitive data at rest, access controls limiting staff access to those who need it, secure password hashing, regular review of our providers, and logging and monitoring of access.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will notify you directly without undue delay where the risk is high.

You are responsible for keeping your account password confidential. Please do not share it, and tell us immediately if you believe your account has been compromised.

Your rights

Depending on where you live, you have some or all of the following rights over your personal information:

• Access — to be told whether we hold information about you and to receive a copy of it.
• Rectification — to have inaccurate or incomplete information corrected.
• Erasure — to have your information deleted where we no longer have a valid reason to keep it.
• Restriction — to have us pause our use of your information while a dispute about it is resolved.
• Portability — to receive the information you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
• Objection — to object to processing based on our legitimate interests, and an absolute right to object to direct marketing at any time.
• Withdrawal of consent — to withdraw consent at any time, without affecting processing already carried out.
• Non-discrimination — we will not deny you goods or services, charge you a different price, or give you a lower quality of service because you exercised your rights.

If you are a California resident, you also have the right to know the categories of personal information collected, the purposes for collecting it, and the categories of third parties it is disclosed to — all set out above — and the right to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA. You may use an authorised agent to submit a request on your behalf.

To exercise any right, email privacy@swazball.com. We will respond within one month (or 45 days for California requests). We may extend this by two further months for complex requests and will tell you if we do. We may need to verify your identity first, and we will not charge a fee unless a request is manifestly unfounded or excessive.

Cookies and similar technologies

Cookies are small files placed on your device. We use them in four categories:

When you first visit, our cookie banner lets you accept or reject each non-essential category. Non-essential cookies are not set until you consent. You can change your choice at any time through the cookie settings link in the footer, and you can block or delete cookies in your browser settings — though blocking strictly necessary cookies will stop parts of the site working.

We honour Global Privacy Control signals where your browser sends them, and we do not use cookies to track you across unrelated sites beyond the advertising partners listed in your cookie settings.

Marketing

We will only send you marketing email where you have opted in, or where you have bought from us and we are marketing similar products — and in both cases, only until you tell us to stop.

Every marketing email carries a one-click unsubscribe link, and we act on it immediately. You can also email us to opt out. Opting out of marketing does not stop service messages about an order you have placed, which we must send to fulfil our contract with you.

Payments

Payments are processed by third-party payment providers who are certified to PCI DSS. Your card details are collected directly by them over an encrypted connection. We receive only confirmation of the outcome, the card type and the last four digits — enough to identify the transaction and process a refund. We never see, store or transmit your full card number, expiry date or security code.

Your payment provider processes your information under its own privacy policy, and we encourage you to read it.

Children

Our site and store are intended for adults. We do not knowingly collect personal information from anyone under 16, and we do not direct marketing at them. If you believe a child has given us their information, contact us and we will delete it promptly. Purchases must be made by someone aged 18 or over, or with the consent of a parent or guardian.

Third-party links

Our site links to other sites, including social media platforms and our partners. We are not responsible for their content or their privacy practices, and this policy does not cover them. Following a link means that site's own policy applies — read it before sharing anything with them.

Automated decision-making

We use automated fraud-screening tools at checkout, which may decline a transaction or flag it for review. Beyond this, we do not make decisions that produce legal or similarly significant effects about you based solely on automated processing, and we do not carry out profiling for that purpose. If a transaction is declined automatically and you believe that was wrong, contact us — you have the right to ask for human review, to express your point of view, and to contest the decision.

Changes to this policy

We may update this policy as our business, the law or our providers change. The version and date at the top of the page always show when it was last revised. Where a change materially affects how we use your information, we will give you clear notice — by email or a prominent notice on the site — before it takes effect, and will seek fresh consent where the law requires it.

We recommend reviewing this page occasionally. Continuing to use the site after a change takes effect means you are aware of the current policy.

Contact and complaints

For any question, request or concern about your personal information — including any of the rights in section 9 — email us at privacy@swazball.com. Privacy enquiries are handled by our customer care team, and we aim to acknowledge every one within five working days.

We would like the chance to put things right ourselves, so please come to us first. You also have the right to complain to a data protection authority at any time — this is the supervisory authority for the country where you live or work, or where the issue arose. If you are in the UK, that is the Information Commissioner's Office at ico.org.uk or 0303 123 1113. If you are in the EEA, your national authority is listed at edpb.europa.eu.