Privacy policy

For a full articulation of our Merchandise Shop Policies & Privacy Notices, please visit: https://www.fightingforafreefuture.com/shop-policy/.

Merchandise Shop Privacy Policy & Legal Notices

Baker Strategy Ltd is registered with the Information Commissioner’s Office under registration number ZB754112. You can verify our registration on the ICO’s public register at https://ico.org.uk/ESDWebPages/Entry/ZB754112.

Baker Strategy Ltd trading as Fighting for a Free Future is the data controller for all customer information collected through our Shopify store. While Shopify processes payments and stores customer data on our behalf as our data processor, we remain fully responsible for compliance with UK GDPR, data protection law, and all other customer rights.

Customer data processed includes but is not limited to names, email addresses, shipping/billing addresses, phone numbers, order history, and payment information (processed securely via Shopify Payments).

The privacy arrangements described in this document apply to use of and interaction with our Shopify/Printful merchandise shop. Please note that Baker Strategy Ltd operates additional business activities under separate privacy arrangements. For a full description of your rights under GDPR and information about data processing related to other Baker Strategy Ltd services, please see our corporate privacy policy at https://www.stevebaker.info/contact/privacy-policy/.

We may update this privacy notice from time to time. Any changes will be posted on this page with the date of revision. Where appropriate, significant changes will be notified via email or on the store front page.

Third-Party Data Processing

Shopify acts as our data processor for payment processing, order management, and customer data storage under their Data Processing Addendum. Printful acts as a data processor (including of customer names and mailing addresses) for the purposes of production and delivery.

Under UK GDPR, we are required to inform you when your personal data is transferred outside the UK. Customer data is transferred outside the UK to our service providers: Shopify (Canada/US) for payment processing and order management, and Printful (Latvia/US) for production and fulfillment.

These transfers are made on the basis that Canada has received a partial adequacy decision under UK GDPR, and Latvia is within the EEA. For US transfers, we rely on appropriate safeguards including standard contractual clauses and/or adequacy frameworks where applicable.

Written Data Processing Agreements compliant with UK GDPR Article 28 are in place with both Shopify (https://www.shopify.com/uk/legal/dpa) and Printful (https://www.printful.com/policies/download/data-processing-terms).

Baker Strategy remains the data controller responsible for compliance with all necessary UK GDPR and data protection law. You can request access, correction, or deletion of your personal data by contacting commerce@stevebaker.info or +44 (0)20 3980 8064.

Shopify Cookie Policy

fightingforafreefuture.com deploys cookies throughout this website in accordance with our separate Cookie Policy, available at  https://www.fightingforafreefuture.com/compliance. For detailed information about the specific cookies used on our website, including their purpose, duration, and whether they are essential or optional, please refer to our compliance statement. This policy is regularly updated to reflect the types of cookies deployed directly to this site.

The Shopify platform deploys further cookies to ensure the proper functioning of the site and for other purposes. These are outside our control and we advise customers to read Shopify’s cookie policy, which includes complete technical details regarding these cookies. This can be found in full at https://www.shopify.com/uk/legal/cookies#merchant-storefronts.

What information we collect, use, and why

We do not collect special category information as defined by GDPR. We do not use personal information for purposes beyond the functioning of our Shopify/Printful store.

We collect or use the following information for the purposes of order fulfillment & contractual necessity:

  • Name
  • Shipping address
  • Billing address
  • Email address
  • Phone number
  • Order and transaction history
  • Product choices, size, and customization details

We collect or use the following information for the purposes of payment processing & fraud prevention:

  • Payment method and billing info (handled securely via Shopify Payments/third-party gateways)
  • Transaction identifiers and order numbers
  • IP address and device/browser info (for fraud checks)

We collect or use the following information for the purposes of customer service & communication:

  • Name and contact info (email, phone, order number)
  • Communication history (emails, messages, phone calls)
  • Records of support enquiries or complaints

We collect or use the following information for the purposes of account management and personalisation:

  • Account username/login
  • Saved addresses
  • Preferences (e.g., preferred size, favorite styles)
  • Wishlist and loyalty program participation
  • Survey and quiz responses

We collect or use the following information for the purposes of marketing & consent-based communications:

  • Email address (for newsletters or marketing emails, if you’ve opted in)
  • Interaction data with marketing messages (opened, clicked, unsubscribed)
  • Responses to promotional offers, reviews, or competitions

In accordance with PECR, marketing communications are only sent where you have explicitly opted in (e.g., via tick-box or newsletter signup). You can withdraw consent or unsubscribe at any time by using the unsubscribe link or contacting us directly.

We collect the following information for the purposes of analytics, business intelligence, and site improvement:

  • Browsing history (pages and products viewed on the Shopify store)
  • Cart/add-to-cart/abandonment events
  • Device and browser data (type, OS, location by IP)
  • Demographic and psychographic data (age, gender, interests, if voluntarily given)
  • Engagement data (traffic source, referral URLs, dwell time)

We collect all of the above categories of information where necessary for the purposes of legal compliance and statutory recordkeeping.

We do not use your personal data to make decisions based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you. Should this position change, we will update this privacy notice and provide you with the right to object or seek human intervention.

We do not knowingly collect or process personal data relating to individuals under the age of 16. If we become aware that information has been provided by or collected about a child under 16, we will take prompt steps to delete such data.

Lawful bases and data protection rights

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

  • Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this at https://ico.org.uk/your-data-matters/your-right-of-access/.
  • Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this at https://ico.org.uk/your-data-matters/your-right-to-get-your-data-corrected/.
  • Your right to erasure – You have the right to ask us to delete your personal information. You can read more about this right here at https://ico.org.uk/your-data-matters/your-right-to-get-your-data-deleted/.
  • Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. You can read more about this at https://ico.org.uk/your-data-matters/your-right-to-limit-how-organisations-use-your-data/.
  • Your right to object to processing – You have the right to object to the processing of your personal data. You can read more about this at https://ico.org.uk/your-data-matters/the-right-to-object-to-the-use-of-your-data/.
  • Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this at https://ico.org.uk/for-organisations/advice-for-small-organisations/create-your-own-privacy-notice/your-data-protection-rights/#rtwc.
  • Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this at https://ico.org.uk/for-organisations/advice-for-small-organisations/create-your-own-privacy-notice/your-data-protection-rights/#rtwc.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us at commerce@stevebaker.info or +44 (0)20 3980 8064.

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information for the purposes of order fulfillment & contractual necessity are:

  • Contract, in accordance with GDPR Article 6(1)(b): this data is necessary to fulfil a contract with the customer including but not limited to name, address, and contact details.

Our lawful bases for collecting or using personal information for the purposes of payment processing & fraud prevention are:

  • Contract, in accordance with GDPR Article 6(1)(b): this data is necessary to process payment information in order to fulfil the sale contract.
  • Legitimate Interests, in accordance with GDPR Article 6(1)(f): some fraud checks and risk assessments (including IP and device checks) are required to protect both customer and business interest.

Our lawful bases for collecting or using personal information for the purposes of customer service & communication are:

  • Contract, in accordance with GDPR Article 6(1)(b): this data is necessary to perform the sale contract, including order updates and problem resolution.
  • Legal Obligation, in accordance with GDPR Article 6(1)(c): record keeping and documentation for certain complaints may be a statutory requirement.

Our lawful bases for collecting or using personal information for the purposes of account management & personalisation are:

  • Contract, in accordance with GDPR Article 6(1)(b): managing customer accounts, preferences, and loyalty is necessary for ongoing service provision under the contract.
  • Legitimate interests, in accordance with GDPR Article 6(1)(f): personalisation of the user experience, such as product recommendations, to align with customer expectations.

Our lawful basis for collecting or using personal information for the purposes of marketing & consent-based communications are:

  • Consent, in accordance with GDPR Article 6(1)(a): information will only be used for this purpose in the event specific opt-in consent is granted. In accordance with PECR, marketing communications are only sent where you have explicitly opted in (e.g., via tick-box or newsletter signup). You can withdraw consent or unsubscribe at any time by using the unsubscribe link or contacting us directly.

Our lawful basis for collecting or using personal information for the purposes of analytics, business intelligence, and site improvement.

  • Consent, in accordance with GDPR Article 6(1)(a): information will only be used for this purpose in the event specific opt-in consent is granted.
  • Legitimate interests, in accordance with GDPR Article 6(1)(f): personalisation of the user experience, such as product recommendations, to align with customer expectations and improve the shop.

Our lawful basis for collecting or using personal information for the purposes of legal compliance and statutory recordkeeping are:

  • Legal obligation, in accordance with GDPR Article 6(1)(c): data (including but not limited to order history and VAT records) must be retained for accounting, taxation, and consumer law compliance.

Where we get personal information from

  • Directly from you
  • Publicly available sources

How long we keep information

We will retain your information for 5 years after the conclusion of any contract or contact to provide for repeat business or engagement. Any information required for HMRC’s purposes are retained for 6 years, in accordance with UK tax law.

Any electronic information will be deleted from our systems and any hard copy destroyed irretrievably as confidential waste. We make all reasonable efforts to ensure that deletion of personal data is comprehensive, including removal from active systems and secure destruction of physical records, within the limits of applicable law and technical feasibility. If personal data exists in system backups, deletion will occur when the backup is cycled or replaced in the ordinary course of business.

Who we share information with

Information is shared with our data processors – namely Printful and Shopify. We will also, when necessary, share held data with organisations we’re legally obliged to share personal information with.

If you have any concerns about our use of your personal data, you can make a complaint to Baker Strategy Ltd (Company Registration: 15950556) trading as Fighting for a Free Future, registered office: The Old Studio, High Street, West Wycombe, HP14 3AB. VAT number: GB 477056173 VAT at commerce@stevebaker.info or +44 (0)20 3980 8064.

If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.

The ICO’s address:           

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Contact for Data Protection Queries

For all data protection requests, security concerns, or to exercise your rights under UK GDPR:

Email: commerce@stevebaker.info

Phone: +44 (0)20 3980 8064

Post: The Old Studio, High Street, West Wycombe, HP14 3AB

We take the security of your data seriously and will take reasonable steps to verify your identity before responding to any data subject access request. This may include contacting you via your registered email address, asking security questions, or requesting information relating to your previous transactions with us. We will only request additional information where necessary, and only to the extent proportionate to the nature and sensitivity of the data requested in accordance with UK GDPR.

If you make a request, we must respond to you without undue delay and in any event within one month.

If your data protection concerns are not resolved, you may contact the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.

Legal Disclaimer

Nothing in this notice excludes or limits our liability where it would be unlawful to do so, including liability for death or personal injury caused by negligence, fraud, or fraudulent misrepresentation. Our liability for data protection breaches is limited to the extent permitted by law and our insurance coverage.

Fighting for a Free Future is a project from Baker Strategy Ltd whose registered address is:

The Old Studio
High Street
West Wycombe
HP14 3AB
UNITED KINGDOM

Registered in UNITED KINGDOM, Number 15950556

Fighting for a Free Future is a non-partisan project in public policy, ideas and strategy. We do not promote political candidates.