Privacy Policy

Last updated: 7 September 2026

1. Who we are

Bad Object is a trading name of Robert Mawdsley, a sole trader.

For the purposes of UK data protection law, Robert Mawdsley trading as Bad Object is the data controller for the personal information described in this Privacy Policy.

Contact address: 195 Wood Street, Suite RA01, London, E17 3NU, UK
Email: support@badobject.co.uk

This policy explains how we collect, use, disclose and protect your personal information when you visit badobject.co.uk, purchase from us, create an account, contact us or otherwise interact with Bad Object.

Our store is hosted by Shopify. Shopify and certain other service providers also process personal information to operate the store and provide their services.

2. Personal information we collect

The information we collect depends on how you interact with us and may include:

• Contact information, such as your name, email address, telephone number, billing address and delivery address.
• Order information, such as products viewed or purchased, order value, delivery method, returns, refunds and transaction history.
• Account information, if you create an account, such as your login details, preferences and saved information.
• Payment information. Payments are processed by Shopify and the payment provider selected at checkout. Bad Object does not normally receive or store your complete payment-card details. We receive information such as payment status, method and transaction reference.
• Communications, including emails, support enquiries, feedback and information you provide when contacting us.
• Marketing preferences, including whether you have subscribed to or unsubscribed from marketing.
• Technical and usage information, such as your IP address, browser, device, cookie identifiers, pages viewed, interactions with the website and approximate location derived from your IP address.
• Fraud and security information, such as risk indicators generated when an order or payment is assessed for suspected fraud.

Please do not send us sensitive personal information unless it is genuinely necessary for us to deal with your enquiry.

3. How we collect personal information

We collect personal information:

• directly from you when you place an order, create an account, subscribe to marketing, contact us or otherwise provide information;
• automatically when you use our website, through Shopify and cookies or similar technologies;
• from organisations that help us operate the store, process payments, fulfil orders, deliver products, provide customer support or prevent fraud; and
• from marketing or social-media platforms where you have chosen to interact with us or where applicable privacy and consent settings permit this.

4. How and why we use your information

UK data protection law requires us to have a lawful basis for using personal information.

To process and fulfil orders

We use your information to accept payment, confirm your order, produce and deliver products, provide order updates, manage cancellations, returns and refunds, and respond to order-related enquiries.

Our lawful basis is that this processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.

To provide customer service

We use your information to answer questions, investigate problems, manage complaints and communicate with you about your account or purchases.

Our lawful basis is performance of our contract and our legitimate interest in providing effective customer service and managing our business.

To operate and improve the website

We use technical and usage information to operate the store, maintain security, understand performance, diagnose problems and improve the customer experience.

Our lawful basis is our legitimate interest in operating, securing and improving Bad Object. Where consent is legally required for cookies or similar technologies, we rely on your consent.

To prevent fraud and misuse

We use relevant order, payment and technical information to detect, investigate and prevent fraud, abuse, security incidents and unlawful activity.

Our lawful basis is our legitimate interest in protecting customers, Bad Object and our service providers. We may also process information where necessary to comply with a legal obligation.

To meet legal and regulatory obligations

We use and retain information where necessary for tax, accounting, consumer-protection, legal, regulatory and record-keeping purposes, or to establish, exercise or defend legal claims.

Our lawful basis is compliance with a legal obligation or our legitimate interest in protecting our legal rights.

To send marketing

We may send you marketing emails where you have consented or where the law otherwise permits us to contact an existing customer about similar products.

You can unsubscribe at any time by using the link in any marketing email or by contacting support@badobject.co.uk. Unsubscribing from marketing will not stop necessary communications about your orders or account.

Where required, our lawful basis is your consent. Where the existing-customer exception applies, we rely on our legitimate interests while complying with the Privacy and Electronic Communications Regulations.

We do not sell personal information.

5. Cookies and similar technologies

Our website uses cookies and similar technologies. Some are necessary for functions such as the shopping basket, checkout, account access, security and remembering privacy preferences.

With your permission, optional cookies may be used to understand website performance, improve the store or support advertising and marketing.

Where consent is required, optional cookies should not be used unless you accept them. You can manage your choices using the cookie banner or privacy controls available on the website. You can also adjust your browser settings, although blocking necessary cookies may prevent parts of the store from working correctly.

If we introduce new analytics or advertising services, we will update this policy and the relevant consent controls where required.

6. Who we share information with

We share personal information only where reasonably necessary for the purposes described in this policy. Recipients may include:

• Shopify, which hosts the website and provides ecommerce, checkout, account, security and related services;
• Printful and other fulfilment providers, where necessary to manufacture, package and fulfil your order;
• payment providers, to process payments, refunds and fraud checks;
• delivery companies and postal services, to deliver and track orders;
• website, email, customer-support and technology providers, where used to operate Bad Object or communicate with you;
• professional advisers, such as accountants, insurers or legal advisers;
• government bodies, regulators, courts or law-enforcement authorities, where disclosure is legally required or necessary to protect legal rights; and
• a prospective purchaser or successor if all or part of the business is sold, reorganised or transferred, subject to appropriate confidentiality and data-protection measures.

These organisations may act as processors working on our instructions or as separate controllers responsible for their own use of information.

7. Shopify

Shopify processes information about your use of our store to provide its platform, checkout, security and consumer services. In some circumstances Shopify acts on our instructions, while in others it acts as a separate data controller.

You can learn more through the Shopify Consumer Privacy Policy and manage certain Shopify privacy choices through the Shopify Privacy Portal.

We use Shopify Network Intelligence. Shopify processes information about your visits and purchases alongside information from your interactions with other merchants and Shopify to provide enhanced services, including personalisation and advertising. This involves sharing information with Shopify and service providers that may be outside the UK. Where required, we obtain your consent. You can change your cookie preferences on our website and exercise your rights regarding Shopify’s processing through the ⁠Shopify Privacy Portal. See the ⁠Shopify Consumer Privacy Policy for more information.

8. International transfers

Some service providers may process personal information outside the United Kingdom.

Where personal information is transferred to a country without an applicable UK adequacy decision, we require an appropriate safeguard where legally necessary. This may include the UK International Data Transfer Agreement, the UK Addendum to standard contractual clauses, or another lawful transfer mechanism.

9. How long we retain information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, tax, accounting and reporting requirements.

Order and accounting records will normally be retained for up to six years after the relevant transaction or accounting period, although information may be retained for longer where required by law or necessary for a dispute or legal claim.

Customer-service communications are retained for as long as reasonably necessary to deal with the matter and maintain appropriate business records.

Marketing information is retained until you unsubscribe, withdraw consent or it is no longer needed. We may retain limited suppression information so that we can respect your request not to receive further marketing.

Cookie retention periods vary according to the cookie and its purpose.

10. Security

We use reasonable technical and organisational measures, together with the security provided by Shopify and our other service providers, to protect personal information.

However, no internet transmission or storage system can be guaranteed to be completely secure. Please do not send sensitive or confidential information through insecure channels.

You are responsible for keeping any account password confidential.

11. Your rights

Depending on the circumstances, UK data protection law may give you the right to:

• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete your information;
• ask us to restrict how we use your information;
• object to processing based on legitimate interests or for direct marketing;
• receive certain information in a portable format or ask us to transfer it;
• withdraw consent where we rely on consent; and
• complain to a data-protection regulator.

These rights are not absolute and may be subject to legal exceptions.

To exercise a right, email support@badobject.co.uk. We may need to confirm your identity before completing a request. We will respond within the period required by applicable law.

You also have an absolute right to object to direct marketing. You can do this using the unsubscribe link in a marketing email.

12. Complaints

Please contact us first if you have concerns about how we use your information, and we will try to resolve them.

You also have the right to complain to the UK Information Commissioner’s Office. Information about making a complaint is available at ico.org.uk/make-a-complaint.

13. Children

Bad Object is not intended for children to use independently, and we do not knowingly collect personal information directly from children who are not legally able to provide it.

If you believe that a child has provided personal information to us without appropriate permission, contact support@badobject.co.uk so that we can investigate and, where appropriate, delete it.

14. Third-party websites

Our website may contain links to websites operated by other organisations. Their use of personal information is governed by their own privacy policies. We are not responsible for the privacy practices or content of third-party websites.

15. Changes to this policy

We may update this Privacy Policy when our services, providers or legal obligations change.

The updated version will be posted on this page with a revised “Last updated” date. We will provide additional notice where required by law.

16. Contact us

For questions, complaints or requests concerning personal information, contact:

Robert Mawdsley trading as Bad Object
195 Wood Street, Suite RA01
London
E17 3NU
United Kingdom

Email: support@badobject.co.uk

Robert Mawdsley trading as Bad Object is the data controller for the personal information described in this policy.