Privacy Policy

Effective date: 17 August 2026 (supersedes the version dated 4 March 2025)

This Privacy Policy explains how Maiden Cricket Clothing Ltd ("we", "us", or "our") collects, uses, shares, and protects your personal data. We process your data in compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, and we are committed to ensuring the privacy and security of your personal information.

By using our services, you acknowledge that you have read and understood this policy.

1. Who We Are

1.1 Data controller

The data controller responsible for your personal data is:

Company: Maiden Cricket Clothing Ltd

Company number: 14534752

Registered address: Sabella House, Crosshills, Keighley, BD20 7BW, United Kingdom

Email: hello@maiden-cricket.co.uk

2. Personal Data We Collect

2.1 What we collect

We collect and process the following types of personal data:

Name and contact information (email address, phone number, postal address)

Date of birth

Payment information

Cricket-related preferences and history

Website usage data and cookies

IP address and device information

2.2 Special category data

We do not collect any special category data about you. This includes details about race or ethnicity, religious or philosophical beliefs, sexual orientation, political opinions, trade union membership, health, or genetic and biometric data. We also do not collect information about criminal convictions or offences.

3. How We Collect Your Data

We collect personal data through:

Direct interactions — for example, when you create an account or make a purchase

Automated technologies — for example, cookies and similar technologies on our website

Third parties — for example, social media platforms, if you choose to connect your account

4. Legal Basis and Purpose for Processing

4.1 Our legal grounds

We process your personal data based on the following legal grounds:

Contractual necessity — to provide our services and fulfil our contractual obligations

Legitimate interests — to improve our services, prevent fraud, and understand website usage

Consent — for email and SMS marketing communications, and for non-essential cookies

Legal obligation — to comply with legal requirements, including tax and accounting rules

4.2 Specific purposes

We use your data for the following purposes:

Managing your account and providing customer support

Processing payments and orders

Sending service-related communications

Personalising your experience and sending marketing communications (with your express opt-in consent)

Analysing website usage to improve our services

Ensuring the security of our website and services

4.3 Marketing consent

We will only contact you for marketing purposes if you have given us your express opt-in consent to do so. You will always be given a clear opportunity to refuse or opt out — both when we first collect your details, and in every marketing message you receive after that.

4.4 Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider we need to use it for another reason that is compatible with the original purpose. If we need to use your personal data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

5. Data Sharing

5.1 Who we may share your data with

We may share your personal data with:

Named service providers who help us run our business (see 5.2 below)

Delivery and courier partners

Our professional advisers, including our accountant, bank, auditors, and insurers, where necessary for their services to us

Marketing and advertising partners (with your consent) — see sections 6 and 7 below

Legal authorities when required by law

Any third party to whom we may sell, transfer, or merge parts of our business — if this happens, the new owner may use your data in the same way as set out in this policy

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our service providers to use your personal data for their own purposes and only permit them to process it for the specific purposes we instruct.

5.2 Our service providers

Shopify — website and hosting platform; processes order, payment, and account data to run the store

Shopify Payments — payment provider; processes payment and financial data to take payment

Royal Mail, DPD, and Yodel (InPost) — our courier partners; process name, address, and contact details to deliver orders

Klaviyo — email and SMS marketing platform; processes contact and marketing-preference data to send communications

WhatsApp — used to run the Ambassador community channel; message data is processed by WhatsApp/Meta under their own privacy policy

Shopify and Shopify Payments are themselves data controllers for certain personal data they process on our behalf. Further detail is available in Shopify's own privacy policy.

6. Business Partners

6.1 Sharing with Business Partners

We may share your personal information with third parties for their own purposes ("Business Partners", or their service providers) — for example, partner organisations involved in programmes such as the Maiden × Gateley Schools Programme, or club and ambassador partnerships. In many cases this sharing relates to the operation of our website — for example, sharing your details with a Business Partner when you purchase that Business Partner's merchandise from us, or when you take part in a joint programme with them.

You may contact us to opt out of such sharing in some cases. However, we do not control how Business Partners use and share your information once they receive it — you will need to contact them directly for information about their own privacy practices, or to exercise rights you may have with them, including opting out of receiving future emails from a Business Partner.

6.2 Analytics and modelling agencies

We may also share your name, address, email address, and transaction history with data selection analysts, data segmentation and ranking agencies, email marketing agencies, and prospect modelling agencies. This helps us analyse our customer base, identify potential new customers, and target our marketing in a way that's most relevant to our customers. In all instances, we provide these agencies with only the information they need to perform their function.

7. Advertising & Targeted Marketing

7.1 Advertising partners

We use advertising partners, including Meta (Facebook/Instagram), Google (Google Ads and Google Analytics), and TikTok, to help us reach customers and measure the effectiveness of our advertising. This involves sharing information such as an encrypted (hashed) version of your email address or phone number with these platforms, so that they can show you relevant Maiden adverts when you browse their platforms or other websites, or exclude you from certain adverts if you're already a customer.

7.2 Custom and lookalike audiences

We use Custom Audiences and lookalike (or "similar") audiences with these platforms — meaning we may upload hashed contact data to match against existing platform users for retargeting, and to help us find new customers who share characteristics with our existing customers, without identifying those new customers individually to us. If a match is found, you may receive relevant promotional content in your feed or search engine; if no match is found, your data is securely destroyed.

Your personal data is shared in a secure manner using a technique called hashing, which scrambles your data so it's unreadable to anyone other than the recipient, for the specific purpose given. Each advertising partner is responsible for their own part of this processing as a controller in their own right, including for any transfers of personal data outside the UK.

7.3 Your right to object

You can object to this use of your data at any time by contacting us, or by adjusting your ad-preference settings directly within Meta, Google, or TikTok's own privacy tools.

8. SMS & Text Marketing

8.1 Marketing texts

If you opt in to receive text messages from us — for example by entering your phone number at checkout, subscribing via a sign-up form, or texting a keyword — we may send you order and delivery notifications and marketing offers by SMS. These messages are sent using our marketing platform, Klaviyo.

8.2 Ambassador WhatsApp channel

Ambassadors who join our Ambassador programme may additionally be invited to a WhatsApp channel or group for programme updates and community communications. Joining this channel is optional and separate from general customer SMS marketing, and is managed directly through WhatsApp.

Consent to receive marketing texts or to join a WhatsApp channel is never a condition of purchase or Ambassador participation. Your phone number and related order/marketing data will be shared with Klaviyo (for SMS) or WhatsApp (for the Ambassador channel) in order to send these messages.

8.3 Opting out

You can opt out of marketing texts at any time by replying STOP to any message or using the unsubscribe link provided. You can leave or mute a WhatsApp channel at any time using WhatsApp's own controls, or by contacting us directly.

9. International Transfers

Where we transfer your personal data outside the UK, we ensure an adequate level of protection is in place through one or more of the following safeguards:

Transferring to a country covered by UK "adequacy regulations"

Using the UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU Standard Contractual Clauses

For transfers involving the United States, relying on a certified recipient under the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge)

10. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. Specific retention periods are:

Account information: for the duration of your account plus 2 years after closure

Transaction data: 7 years, for tax and accounting purposes

Marketing data: until you unsubscribe or withdraw consent

11. Your Rights

11.1 Rights under UK GDPR

Under UK GDPR, you have the following rights:

Right to access your personal data

Right to rectification of inaccurate data

Right to erasure ("right to be forgotten")

Right to restrict processing

Right to data portability

Right to object to processing, including direct marketing

Right to withdraw consent at any time

Right not to be subject to automated decision-making

Right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent supervisory authority for data protection

11.2 Exercising your rights

To exercise these rights, please contact us at hello@maiden-cricket.co.uk.

No fee is usually required to exercise these rights, though we may charge a reasonable fee, or refuse the request, if it is clearly unfounded, repetitive, or excessive.

We may need to request specific information from you to confirm your identity before actioning a request — this is a security measure to ensure personal data isn't disclosed to the wrong person.

We try to respond to all requests within one month. Occasionally this may take longer if a request is particularly complex, in which case we will notify you and keep you updated.

12. Data Security

We have implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

Encryption of personal data

Regular testing and evaluation of our security measures

Staff training on data protection

Access controls and authentication procedures

13. Cookies and Similar Technologies

We use cookies and similar technologies on our website. For detailed information, please see our separate Cookie Policy at maiden-cricket.co.uk/pages/cookie-policy.

14. Children's Privacy

14.1 Data relating to under-18s

Some of our products and community features (including our Ambassador programme) are aimed at, or may be used by, children and young people under 18, and we may collect personal data (including date of birth) from a minor in connection with an order, account, or Ambassador application.

14.2 Under-13s and parental consent

Where a purchase, account, or Ambassador application involves someone under 13, we require the involvement and consent of a parent or guardian before collecting their personal data.

14.3 How we handle children's data

We collect only the personal data reasonably necessary for the purpose (e.g. fulfilling an order, verifying kit sizing, administering the Ambassador programme) and do not use children's data for profiling or targeted advertising.

A parent or guardian can exercise any of the rights in section 11 on behalf of a child, and can contact us at any time to review, amend, or request deletion of a child's data.

15. Third-Party Links

Our website may include links to third-party websites, plug-ins, and applications. Clicking those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy practices. We encourage you to read the privacy policy of every website you visit after leaving ours.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on our website and updating the "Effective date" at the top of this policy. We encourage you to review this policy periodically.

17. Our Data Protection Practices

17.1 Data Protection Impact Assessments

We conduct Data Protection Impact Assessments (DPIAs) for any new high-risk processing activities to ensure we adequately address privacy risks.

17.2 Data minimisation

We adhere to the principle of data minimisation by collecting and processing only the personal data that is necessary for the specified purposes. We regularly review our data collection practices to ensure we do not collect excessive information.

17.3 Privacy by design

We implement privacy by design principles in our data processing activities. This includes considering data protection implications at the early stages of product or service development and integrating necessary safeguards throughout the entire data lifecycle.

17.4 Data breach notification

In the event of a personal data breach, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms. If the breach is likely to result in a high risk to individuals, we will also inform affected data subjects without undue delay.

17.5 Automated decision-making and profiling

We do not currently engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals. If we introduce such practices in the future, we will provide clear information about the logic involved and the significance and consequences of the processing for the data subject.

18. How to Complain

If you have concerns about our data processing practices, please contact us first at hello@maiden-cricket.co.uk so we can try to resolve it directly.

You also have the right to complain to the ICO at any time — via ico.org.uk/make-a-complaint, or by calling 0303 123 1113.

19. Contact Us

If you have a question about your personal data or wish to exercise any of your rights, please contact us:

Email: hello@maiden-cricket.co.uk

Website: maiden-cricket.co.uk

This policy was last reviewed in August 2026. Maiden Cricket reserves the right to update this policy at any time. The version published on our website at the time of processing will apply.