Privacy policy

Privacy Policy

Last updated: 3 July 2026

1. About this privacy policy

This Privacy Policy explains how The Merch Store Ltd collects, uses, stores and shares personal information when you:

  1. Visit davidbrentstore.com;

  2. Place an order;

  3. Create a customer account;

  4. Join our mailing list;

  5. Contact us;

  6. Submit a review or other content; or

  7. Otherwise interact with David Brent Store.

The website is operated by The Merch Store Ltd, trading as David Brent Store.

For the purposes of UK data protection law, The Merch Store Ltd is the data controller responsible for the personal information described in this Privacy Policy.

Our details are:

Company name: The Merch Store Ltd
Company number: 11173811
Trading address: 35 St Johns Road, Isleworth, London, TW7 6NY
Email: sales@davidbrentstore.com

2. Personal information we collect

The personal information we collect depends on how you interact with us.

We may collect the following categories of information.

Contact and identity information

This may include:

  1. Your name;

  2. Email address;

  3. Telephone number;

  4. Billing address;

  5. Delivery address; and

  6. Any other contact details you provide.

Order and transaction information

This may include:

  1. Products ordered;

  2. Order value;

  3. Order number;

  4. Payment status;

  5. Delivery method;

  6. Delivery tracking information;

  7. Returns, exchanges and refunds;

  8. Discount codes used; and

  9. Your previous transactions with us.

Payment information

Payments are processed through Shopify and third-party payment providers.

We do not normally receive or store your complete payment-card number or security code.

We may receive limited payment information, such as:

  1. Payment method;

  2. Payment confirmation;

  3. Billing name and address;

  4. The final digits of a payment card;

  5. Transaction reference; and

  6. Fraud-screening results.

Account information

If customer accounts are enabled, we may collect:

  1. Your login details;

  2. Account preferences;

  3. Saved addresses;

  4. Order history; and

  5. Account activity.

Communications

We collect information contained in communications you send to us, including:

  1. Customer-service enquiries;

  2. Complaints;

  3. Return requests;

  4. Emails;

  5. Contact-form submissions; and

  6. Messages sent through social-media platforms.

Marketing information

Where you join our mailing list or agree to receive marketing, we may collect:

  1. Your name;

  2. Email address;

  3. Marketing preferences;

  4. Records of consent;

  5. Email engagement information; and

  6. Information about products that may interest you.

Reviews and submitted content

Where you submit a review, photograph, comment or other content, we may collect:

  1. Your name or chosen display name;

  2. Your review or comment;

  3. Photographs or other files submitted;

  4. Details of the related order or product; and

  5. Any information you choose to include.

Technical and usage information

When you visit the website, we and our service providers may collect:

  1. Internet Protocol address;

  2. Browser type and version;

  3. Device type;

  4. Operating system;

  5. Approximate location derived from your IP address;

  6. Pages viewed;

  7. Links clicked;

  8. Products viewed;

  9. Products added to your basket;

  10. Referral source;

  11. Date and time of visits;

  12. Cookie identifiers; and

  13. Information about how you interact with the website.

Some of this information is collected using cookies and similar technologies.

Please see the cookie banner and Cookie Policy for more information.

3. How we collect personal information

We collect personal information:

Directly from you

This includes information you provide when you:

  1. Place an order;

  2. Create an account;

  3. Join our mailing list;

  4. Contact us;

  5. Request a return or refund;

  6. Submit a review; or

  7. Enter information into the website.

Automatically

We may collect technical and usage information automatically through:

  1. Cookies;

  2. Pixels;

  3. Tags;

  4. Log files;

  5. Local storage; and

  6. Similar technologies.

From service providers

We may receive information from organisations that help us operate the store, including:

  1. Shopify;

  2. Payment processors;

  3. Delivery companies;

  4. Fulfilment providers;

  5. Email and marketing platforms;

  6. Fraud-prevention providers;

  7. Analytics providers; and

  8. Customer-service platforms.

From other third parties

We may receive information from:

  1. Social-media platforms;

  2. Advertising platforms;

  3. Business partners;

  4. Publicly available sources; and

  5. A person ordering a product for delivery to you.

4. How and why we use your information

UK data protection law requires us to have a lawful basis for using personal information.

The lawful bases we rely on are:

  1. Contract: where processing is necessary to provide products or services you have requested.

  2. Legal obligation: where processing is necessary to comply with the law.

  3. Legitimate interests: where processing is necessary for our legitimate business interests and those interests are not overridden by your rights.

  4. Consent: where you have given us clear permission for a specific use.

  5. Legal claims: where information is necessary to establish, exercise or defend legal claims.

Processing and fulfilling orders

We use your information to:

  1. Process payments;

  2. Confirm and fulfil orders;

  3. Deliver products;

  4. Send order and delivery updates;

  5. Process cancellations, returns and refunds;

  6. Provide customer service; and

  7. Manage pre-orders.

Our lawful basis is that this processing is necessary to perform our contract with you or to take steps at your request before entering into a contract.

Customer service

We use personal information to:

  1. Respond to questions;

  2. Investigate delivery problems;

  3. Handle complaints;

  4. Resolve product issues;

  5. Process returns; and

  6. Maintain records of our communications.

Our lawful bases are performance of our contract and our legitimate interest in providing effective customer service and maintaining appropriate business records.

Fraud prevention and security

We may use personal information to:

  1. Verify transactions;

  2. Detect and prevent fraud;

  3. Protect customer accounts;

  4. Investigate suspicious activity;

  5. Protect the website;

  6. Enforce our Terms and Conditions; and

  7. Protect our customers, business and rights holders.

Our lawful bases are our legitimate interests in preventing fraud and protecting our business, customers and systems, and compliance with legal obligations where applicable.

Legal and accounting obligations

We may use and retain information to:

  1. Maintain financial and tax records;

  2. Respond to lawful requests from authorities;

  3. Comply with consumer-protection requirements;

  4. Handle legal disputes;

  5. Establish, exercise or defend legal claims; and

  6. Meet our regulatory obligations.

Our lawful bases are compliance with legal obligations, legitimate interests and the establishment, exercise or defence of legal claims.

Improving the website and services

We may use information to:

  1. Understand how customers use the website;

  2. Monitor website performance;

  3. Identify errors;

  4. Improve navigation and checkout;

  5. Analyse product performance;

  6. Develop new products and services; and

  7. Improve our customer communications.

Where this involves essential website information, our lawful basis is our legitimate interest in operating and improving the store.

Where this involves non-essential analytics cookies or similar technologies, we rely on consent where required.

Email marketing

Where you have subscribed, we may use your name, email address and interests to send you:

  1. Product launches;

  2. Merchandise updates;

  3. Offers and promotions;

  4. Store news;

  5. Tour-related merchandise news; and

  6. Other relevant marketing communications.

We generally rely on your consent.

In limited circumstances, we may contact existing customers about similar products where permitted by applicable direct-marketing law and where an opportunity to opt out was provided.

You can unsubscribe at any time by:

  1. Selecting the unsubscribe link in a marketing email; or

  2. Contacting sales@davidbrentstore.com.

Unsubscribing from marketing will not stop essential messages about your orders, account, returns or customer-service enquiries.

Personalised advertising

Where you consent to advertising cookies or similar technologies, we and our advertising partners may use information about your activity to:

  1. Measure advertising performance;

  2. Show advertisements that may be more relevant to you;

  3. Limit how frequently advertisements are shown; and

  4. Create advertising audiences.

The lawful basis is consent where required.

You can change your choices through our cookie settings.

Reviews and customer content

We may use submitted reviews, photographs and comments to:

  1. Display customer feedback;

  2. Operate and promote the store;

  3. Respond to reviews;

  4. Investigate authenticity; and

  5. Moderate inappropriate content.

Our lawful bases are your consent, where applicable, and our legitimate interests in operating, improving and promoting the store.

5. Cookies and similar technologies

The website uses cookies and similar technologies.

Some cookies are necessary for the website to operate. These may be used to:

  1. Keep products in your basket;

  2. Remember checkout information;

  3. Maintain website security;

  4. Process payments;

  5. Remember privacy choices; and

  6. Provide essential website functionality.

Other cookies may be used for:

  1. Analytics;

  2. Advertising;

  3. Personalisation;

  4. Social-media features; and

  5. Measuring marketing performance.

Where required, non-essential cookies will not be used until you have provided consent.

You can accept, reject or manage non-essential cookies through the cookie banner or privacy settings available on the website.

You can also manage cookies through your browser settings. Blocking some cookies may affect how the website functions.

6. Who we share information with

We may share personal information with the following categories of recipients where necessary.

Shopify

Our online store is hosted and supported by Shopify.

Shopify may process personal information to:

  1. Host the website;

  2. Provide checkout functionality;

  3. Process orders;

  4. Maintain security;

  5. Prevent fraud;

  6. Provide analytics;

  7. Support customer accounts; and

  8. Provide other ecommerce services.

Shopify may also process certain information for its own purposes, as explained in Shopify’s privacy documentation.

Payment providers

Payment providers process information to:

  1. Authorise transactions;

  2. Process payments and refunds;

  3. Prevent fraud; and

  4. Comply with financial regulations.

Fulfilment and delivery providers

We may share names, addresses, contact details and order information with:

  1. Warehousing providers;

  2. Fulfilment providers;

  3. Postal operators;

  4. Couriers;

  5. Customs authorities; and

  6. Delivery-management platforms.

This information is used to prepare, dispatch and deliver orders.

Technology and professional service providers

We may share information with organisations that provide:

  1. Website hosting and support;

  2. Email systems;

  3. Marketing services;

  4. Customer support;

  5. Data storage;

  6. Analytics;

  7. Fraud prevention;

  8. Cybersecurity;

  9. Accounting;

  10. Legal advice;

  11. Insurance; and

  12. Business administration.

These providers may only use personal information for the services they provide to us or as otherwise permitted by law.

Advertising and social-media platforms

Where you consent to relevant cookies or tracking, information may be shared with advertising and social-media platforms to measure campaigns and provide personalised advertising.

Authorities and legal recipients

We may disclose information where reasonably necessary to:

  1. Comply with the law;

  2. Respond to a court order or lawful request;

  3. Protect our legal rights;

  4. Prevent or investigate fraud;

  5. Protect customers or members of the public; or

  6. Establish, exercise or defend legal claims.

Business transfers

If some or all of our business or assets are sold, reorganised or transferred, personal information may be disclosed to prospective purchasers, advisers or the organisation acquiring the business.

Any recipient must use the information in accordance with applicable data protection law.

7. Shopify’s role

Shopify provides the ecommerce platform used by David Brent Store.

Information submitted through the website may be transmitted to and processed by Shopify and Shopify’s service providers.

Shopify may process information both:

  1. On our behalf as a service provider; and

  2. For its own purposes where Shopify independently determines how and why information is used.

Further information about Shopify’s processing and privacy rights is available in Shopify’s Consumer Privacy Policy and privacy portal.

8. International transfers

Some of our service providers may process personal information outside the United Kingdom.

This may include processing in countries such as members of the European Economic Area, Canada and the United States.

Where personal information is transferred outside the United Kingdom, we will take appropriate steps to protect it.

These steps may include:

  1. Transferring information to a country recognised by the UK as providing adequate protection;

  2. Using the UK International Data Transfer Agreement;

  3. Using an approved UK addendum to standard contractual clauses;

  4. Relying on another lawful transfer mechanism; or

  5. Requiring appropriate contractual, organisational and technical protections.

You may contact us for further information about the safeguards used for relevant transfers.

9. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, tax, fraud-prevention and dispute-resolution requirements.

Our usual retention approach is:

Order and transaction records

We generally retain order, payment, invoice and tax records for up to seven years after the end of the relevant financial period.

Customer-service communications

We generally retain customer-service correspondence for up to three years after the enquiry or complaint is resolved, unless it relates to an order, dispute or legal requirement requiring longer retention.

Customer accounts

We retain account information while the account remains active.

Where an account becomes inactive, we may retain limited information for a reasonable period before deleting or anonymising it.

Marketing information

We retain marketing information while you remain subscribed.

If you unsubscribe, we may retain limited information on a suppression list so that we can respect your request not to receive further marketing.

Website and analytics information

Retention periods for cookie and analytics information vary according to the technology used.

Further details may be available through our cookie settings or Cookie Policy.

Legal disputes and fraud

We may retain relevant information for longer where necessary to investigate fraud, handle a dispute, enforce an agreement or establish, exercise or defend legal claims.

When information is no longer required, we will delete, anonymise or securely dispose of it.

10. Security

We use reasonable technical and organisational measures designed to protect personal information.

These may include:

  1. Access controls;

  2. Password protection;

  3. Encryption where appropriate;

  4. Secure payment processing;

  5. Staff access restrictions;

  6. System monitoring;

  7. Data backups; and

  8. Use of reputable service providers.

No method of electronic transmission or storage is completely secure.

You should not send payment-card details or other sensitive information through ordinary email.

Where customer accounts are available, you are responsible for keeping your password secure and should not share it with anyone.

11. Your data protection rights

Depending on the circumstances, you may have the following rights.

Right of access

You may request confirmation of whether we process your personal information and request a copy of that information.

Right to rectification

You may ask us to correct inaccurate or incomplete personal information.

Right to erasure

You may ask us to delete personal information in certain circumstances.

This right does not apply where we need to retain information to comply with the law, fulfil an ongoing contract or establish, exercise or defend legal claims.

Right to restrict processing

You may ask us to restrict how we use personal information in certain circumstances.

Right to object

You may object to processing based on our legitimate interests.

You have an absolute right to object to the use of your personal information for direct marketing.

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request relevant information in a structured, commonly used and machine-readable format.

Right to withdraw consent

Where we rely on consent, you may withdraw it at any time.

Withdrawal will not affect processing that took place before consent was withdrawn.

Rights relating to automated decision-making

You may have rights relating to decisions made solely through automated processing where those decisions produce legal or similarly significant effects.

We do not ordinarily make significant customer decisions solely through automated processing.

Fraud-prevention systems may flag or delay transactions for further review.

Making a request

To exercise your rights, contact:

sales@davidbrentstore.com

Please include enough information for us to identify you and understand your request.

We may ask for reasonable evidence of identity before responding.

We will normally respond within one month, although the law allows this period to be extended for particularly complex requests. We will tell you if an extension is required.

You will not normally be charged for exercising your rights. We may charge a reasonable fee or refuse a request where it is manifestly unfounded or excessive, as permitted by law.

12. Direct-marketing choices

You can opt out of email marketing at any time by:

  1. Selecting the unsubscribe link in a marketing email; or

  2. Contacting sales@davidbrentstore.com.

You can manage advertising and analytics choices through the cookie settings available on the website.

Changing marketing or cookie preferences will not affect essential processing required to fulfil orders or provide customer service.

13. Children’s information

The website is intended for general audiences and is not designed to collect personal information directly from children.

Orders must be placed by someone legally capable of entering into a contract.

We do not knowingly collect personal information directly from children in circumstances requiring parental consent.

If you believe a child has provided personal information to us without appropriate permission, contact sales@davidbrentstore.com.

We will investigate and delete the information where appropriate.

14. Third-party websites

The website may contain links to websites, platforms or services operated by third parties.

We are not responsible for the privacy practices, security or contents of third-party websites.

You should read the privacy information provided by the relevant third party before submitting personal information.

15. Complaints

Please contact us first if you have concerns about how we handle personal information.

Email: sales@davidbrentstore.com

Post:
The Merch Store Ltd
35 St Johns Road
Isleworth
London
TW7 6NY
United Kingdom

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
United Kingdom

Telephone: 0303 123 1113

16. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to:

  1. Our business;

  2. The website;

  3. Our service providers;

  4. Our use of personal information; or

  5. Legal and regulatory requirements.

The latest version will be published on this page with an updated revision date.

Where a change materially affects how we use personal information, we will provide additional notice where required.

17. Contact us

Questions, requests or complaints relating to this Privacy Policy should be sent to:

The Merch Store Ltd

Email: sales@davidbrentstore.com

Trading address:
35 St Johns Road
Isleworth
London
TW7 6NY