Who we are

William Marshall, trading as The Marshall Mafia ("we", "us"), 57 Parklawn Avenue, Epsom, Surrey, KT18 7SJ, United Kingdom. We are the controller of personal data collected through themarshallmafia.com and when you buy from us.

Contact for anything privacy-related: info@themarshallmafia.com.

What we collect and why

• Orders — name, email address, delivery and billing address, phone number if given, and what you bought. Used to process, deliver and support your order. Lawful basis: performance of a contract.
• Payments — handled entirely by Stripe. We never see or store your full card details. Stripe also uses your data to prevent fraud, as an independent controller under Stripe's privacy policy.
• Records — order and payment records we must keep for tax and accounting. Lawful basis: legal obligation.
• Messages — anything you send us by email, or through our cancellation or review forms (hosted by Google Forms). Used to reply, handle returns and refunds, and run the business. Lawful basis: contract, legal obligation, or our legitimate interest in looking after customers.
• Reviews — if you submit a review, we may publish your first name, last initial, age, rating, words and any photos you include on our site. Lawful basis: consent, which you can withdraw at any time and we'll take it down.
• Analytics — only if you accept analytics cookies: pages viewed, device and browser type, approximate location (country/city), and how you arrived. See our Cookie Policy. Lawful basis: consent.
• Security logs — our host Vercel processes your IP address and browser details to deliver the site and block attacks and bots. Lawful basis: legitimate interests (keeping the site and its visitors safe).
• Marketing — we only send marketing emails if you've asked to receive them, and every email has an unsubscribe link. Lawful basis: consent (or, for existing customers in the UK, the soft opt-in, which you can refuse at any time).

Who we share it with

We only share what each provider needs, and never sell your data.

• Stripe — payments and checkout (Ireland / USA).
• Vercel — website hosting and security (USA).
• Google — Analytics (with consent) and Forms (Ireland / USA).
• Delivery partners such as Royal Mail — to get your order to you.
• Our accountant, professional advisers, and authorities such as HMRC where the law requires it.

International transfers

Some of these providers process data outside the UK and EEA, mainly in the USA. Where they do, transfers are protected by an adequacy decision (such as the UK-US Data Bridge or the EU-US Data Privacy Framework) or by approved contractual safeguards (the UK International Data Transfer Addendum or the EU Standard Contractual Clauses).

How long we keep it

• Order and payment records — 6 years from the end of the tax year of the sale, as UK tax law requires.
• Emails and form submissions — up to 2 years after the matter is closed, unless they form part of an order record.
• Published reviews — until you ask us to remove them.
• Analytics data — 2 months (Google Analytics' shortest retention setting), after which Google deletes it.
• Security logs — as set by Vercel, typically a matter of days.

Keeping it safe

We use reputable providers with strong security, keep access to personal data to a minimum, and protect our accounts with strong passwords and two-factor authentication. No website is completely secure, but if something ever goes wrong we'll act quickly and tell you and the regulator where the law requires.

Your rights (UK and EU)

Under the UK GDPR and EU GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased, where there's no legal reason for us to keep it;
• restrict or object to how we use it, including objecting to direct marketing at any time;
• receive your data in a portable format;
• withdraw consent at any time, without affecting anything done before.

To use any of these rights, email info@themarshallmafia.com. We'll reply within one month. It's free unless a request is clearly unfounded or excessive.

Complaints (UK)

If you're unhappy with how we've handled your data, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Children

Our site is designed for a general audience, not for children. We don't knowingly collect personal data from children under 13 (or under 16 in some EU countries). If you're a parent or guardian and think your child has given us their details, email us and we'll delete them. Reviews from players under 18 are only published with a parent or guardian's permission.

Changes

We'll update this policy when the way we use data changes. The date at the top shows the latest version, and we'll tell customers directly about any significant changes.