This policy explains how we handle personal data when you browse dylannicholasmay.uk, buy car accessories from us, use the fit finder, or email us. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
The data controller is DYLAN NICHOLAS MAY LIMITED, trading as Dylan Nicholas May, a company registered in England and Wales under company number 17485729.
- Registered address: Flat A, 64 Cwmamman Road, Glanamman, Wales, SA18 1DJ
- Email: [email protected]
- Phone: +44 7723 418569
- Website: dylannicholasmay.uk
For anything about your personal data, email us with the subject line "Privacy".
2. Data we collect
When you place an order
- Your full name, email address and phone number.
- Delivery address, town or city and postcode.
- Anything you write in the order comment, such as delivery notes.
- What you ordered, prices, the order number and the payment method you chose (card, Apple Pay, Google Pay, PayPal or Klarna).
Vehicle details for fitting
To match floor mats and bulbs, we may ask for your car's make, model and year — through the fit finder or in your order comment. We do not collect your vehicle registration number and you never need to give it to us. Make, model and year on their own do not identify you, but once attached to an order we treat them as part of your order record.
Payment details
Card numbers and wallet or account credentials are entered directly with our payment provider (or with PayPal or Klarna if you choose them). We do not see or store your full card details. We receive confirmation that payment succeeded, the amount, and limited reference data such as the last four digits of a card.
Emails and warranty claims
Our contact links open your own email app; there is no contact form on our site. When you email us we keep the message, your email address and anything you include — for example photos of a faulty product, proof of purchase and a description of the fault for a warranty or returns claim.
Technical data
Like any website, our hosting provider receives your IP address, browser type and the pages requested, kept in short-lived server logs for security. The fit finder and cart work entirely in your browser and are not saved once you close the page.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Processing and delivering your order, taking payment, sending order and dispatch emails | Contract |
| Checking a product fits your vehicle (make, model, year) | Contract — steps you ask us to take before and under the purchase |
| Handling returns, refunds and warranty claims, including your 14-day cancellation right | Contract and legal obligation (Consumer Contracts Regulations 2013, Consumer Rights Act 2015) |
| Replying to your emails | Legitimate interests — answering customer questions |
| Keeping accounting and tax records | Legal obligation (Companies Act 2006, HMRC rules) |
| Preventing fraud and keeping the website secure | Legitimate interests |
| Sending offers or seasonal kit news by email, only if you opt in | Consent |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 9).
4. Who we share data with
We never sell your personal data. We share only what each party needs:
- Payment provider — processes card and wallet payments. PayPal and Klarna act as independent controllers when you pay with them, and Klarna may run a credit check under its own privacy notice.
- Courier services (such as Royal Mail and DPD) — receive your name, delivery address, postcode, phone and email to deliver your parcel and send tracking updates.
- Email and hosting providers — store our website and mailbox on our behalf under data processing terms.
- Manufacturers or their UK distributors — only for a warranty claim, and only the details needed to assess the fault (normally the product, purchase date and photos).
- Accountants and professional advisers — for bookkeeping, tax and legal advice.
- Authorities — HMRC, the police or courts where the law requires it.
5. International transfers
Some of our providers may store or access data outside the UK. When that happens we make sure there is protection in place: a UK adequacy regulation (for example, for the EEA), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details.
6. How long we keep data
- Orders, invoices and payment records: 6 years after the end of the financial year of purchase, as required for tax and company records.
- Delivery details passed to couriers: kept by the courier under its own retention rules, normally up to 12 months.
- Warranty and returns correspondence: 6 years from the end of the claim, the period in which a contract claim can be brought.
- General emails: 2 years from our last reply, unless they relate to an order.
- Vehicle make, model and year: kept with the order it belongs to, then deleted with it.
- Marketing consent: until you withdraw it, plus a suppression record so we do not contact you again.
- Server logs: up to 30 days.
7. Security
Our website runs over HTTPS, access to order data is limited to people who need it, accounts are protected with strong passwords and two-factor authentication, and providers are chosen for their security standards. No system is perfectly secure, so if a breach is likely to put you at risk we will tell you and the ICO as the law requires.
8. Cookies
Our website does not set advertising or analytics cookies, and the cart is kept only in the page's memory — nothing is saved on your device. Fonts are loaded from Google Fonts, which receives your IP address to deliver them. If we add optional cookies in future, we will ask for your consent first and update this policy.
9. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete data we no longer need or have no lawful reason to keep.
- Restriction — ask us to pause using your data while a concern is resolved.
- Portability — receive data you gave us in a commonly used, machine-readable format, or have it sent to another organisation.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on consent, withdraw it whenever you like.
Email [email protected] to use any of these rights. We reply within one month, free of charge. We may need to confirm your identity first, usually by asking for your order number.
10. Withdrawing consent
If you have agreed to receive marketing emails, you can withdraw at any time using the unsubscribe link in any email or by writing to us. Withdrawing consent does not affect processing we carried out before, and it does not affect your orders.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO): ico.org.uk, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Children
Our shop is for adults. You must be 18 or over to place an order, and we do not knowingly collect personal data from children. If you believe a child has given us their details, email us and we will delete them.
13. Changes to this policy
We may update this policy when our services or the law change. The date at the top shows when it was last revised. If a change significantly affects how we use data you have already given us, we will tell you by email before it takes effect.