Last updated: 15.07.2026

This Privacy Policy explains how M8RCH LTD collects, uses, stores, protects and shares personal data when you access or use the M8RCH website, available at m8rch.com.

The M8RCH website is owned and operated by M8RCH LTD, Reg. Number: 17296644, located at 239 Kensington High Street, London, England, W8 6SN.

By using the M8RCH website, creating an account, placing an order, uploading a design or contacting us, you acknowledge that your personal data will be handled as described in this Privacy Policy.

1. Who We Are

For the purposes of applicable data protection laws, including the UK General Data Protection Regulation and the Data Protection Act 2018, M8RCH LTD is the data controller for the personal data collected through the M8RCH website.

This means that M8RCH LTD determines why and how your personal data is processed.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data collected when you:

• visit or browse the M8RCH website;
• create or use a registered user account;
• upload designs, logos, artwork, text or other files;
• personalise products;
• place or manage an order;
• use the cart, wishlist or checkout functionality;
• contact customer support;
• subscribe to communications, where available;
• interact with website features, cookies or analytics tools.

This Privacy Policy does not apply to third-party websites, platforms, payment providers, courier companies or external services that may have their own privacy policies.

3. Personal Data We May Collect

We may collect and process the following types of personal data.

3.1 Account Data

When you create an account, we may collect:

• full name;
• email address;
• account login details;
• account preferences;
• order history;
• wishlist or saved product information;
• customer support history.

3.2 Order and Delivery Data

When you place an order, we may collect:

• full name;
• email address;
• phone number, where required for delivery;
• billing address;
• shipping address;
• order number;
• selected products;
• sizes, colours, quantities and product options;
• customisation details;
• uploaded artwork, logos, graphics, text or files;
• delivery method;
• order status and delivery information.

3.3 Uploaded Design and Customisation Data

When you use the website’s personalisation tools, we may process:

• uploaded images;
• logos;
• artwork;
• graphics;
• text;
• design placement details;
• product mockups;
• custom print instructions.

You are responsible for ensuring that any content you upload is lawful and that you have the right to use it.

3.4 Communication Data

When you contact us, we may collect:

• your name;
• email address;
• message content;
• attachments or photos you send to us;
• support request details;
• communication history.

3.5 Technical and Usage Data

When you use the website, we may collect certain technical data, such as:

• IP address;
• browser type and version;
• device type;
• operating system;
• time zone setting;
• pages viewed;
• referring website;
• website activity;
• cookie identifiers;
• approximate location based on technical data;
• error logs and security logs.

3.6 Payment-Related Data

M8RCH does not collect, process or store your full payment card details.

All payments are processed by third-party payment providers. During checkout, the payment provider may collect and process your payment card details, authentication information and transaction data under its own terms and privacy policy.

M8RCH may receive limited payment-related information, such as:

• payment status;
• transaction reference;
• payment method type;
• fraud screening result;
• refund status;
• chargeback or dispute status.

We use this limited information to process your order, confirm payment, handle refunds, prevent fraud and manage payment disputes.

4. We Do Not Store Payment Card Data

M8RCH does not store full card numbers, CVV codes, bank login details or complete payment authentication details.

Payment data is submitted directly to the relevant third-party payment provider through secure payment processing systems.

The payment provider is responsible for processing your payment data and applying payment security checks, including Strong Customer Authentication where required.

5. How We Use Your Personal Data

We may use your personal data for the following purposes:

• to create and manage your user account;
• to allow registered users to place orders;
• to provide website functionality;
• to process custom product orders;
• to produce personalised clothing and merch;
• to process uploaded artwork and design files;
• to confirm payment status;
• to arrange shipping and delivery;
• to provide order confirmations and order updates;
• to respond to customer support requests;
• to manage returns, refunds and replacements;
• to investigate delivery issues;
• to detect and prevent fraud, abuse, security incidents and chargebacks;
• to maintain website security;
• to improve website performance and user experience;
• to comply with legal, tax, accounting and regulatory obligations;
• to enforce our Terms and Conditions and other policies.

We do not sell your personal data.

6. Lawful Bases for Processing

We process personal data only where we have a lawful basis to do so.

Depending on the situation, we may rely on the following lawful bases:

6.1 Contract

We process personal data where necessary to provide our services, manage your account, process your order, produce custom products, arrange delivery, handle refunds or provide customer support.

6.2 Legal Obligation

We may process personal data where required to comply with legal obligations, including tax, accounting, consumer protection, fraud prevention, sanctions compliance and regulatory requirements.

6.3 Legitimate Interests

• We may process personal data where necessary for our legitimate business interests, provided your rights and freedoms do not override those interests.
• This may include:
• website security;
• fraud prevention;
• chargeback management;
• customer service;
• business administration;
• website improvement;
• record keeping;
• protecting our legal rights.

6.4 Consent

Where required, we may rely on your consent for specific processing activities, such as optional marketing communications or non-essential cookies.

You can withdraw consent at any time where consent is the lawful basis for processing.

7. Registered Users and Account Data

Purchases on the M8RCH website are available only to registered users.

When you create an account, we process your account data to:

• identify you as a registered user;
• allow you to place and manage orders;
• store order history;
• support customer service;
• prevent misuse of the website;
• protect account security.

You are responsible for keeping your account information accurate and up to date.

You are also responsible for maintaining the confidentiality of your login details.

8. User Responsibility for Personal Data

You are responsible for ensuring that all personal data you provide to us is accurate, complete and current.

• This includes:
• your name;
• email address;
• billing details;
• shipping address;
• phone number;
• uploaded artwork;
• custom text;
• order instructions;
• any other information submitted through the website.

M8RCH is not responsible for failed delivery, order delays, production issues, incorrect personalisation or inability to contact you where such issues are caused by incorrect, incomplete or outdated information provided by you.

9. Uploaded Content and Third-Party Personal Data

If you upload artwork, images, logos, names, photos, text or other content that includes personal data of another person, you confirm that you have the legal right to upload and use that content.

You must not upload personal data, images or materials relating to another person unless you have obtained all necessary permissions.

M8RCH may process uploaded content only as necessary to provide the requested customisation, produce the order, manage support and keep order records.

10. Payment Processing, SCA and PSD2

All payments on the M8RCH website are made through third-party payment providers.

M8RCH does not collect or store full payment card details.

Where required, third-party payment providers may apply Strong Customer Authentication, 3D Secure or similar verification checks. In the UK, SCA rules are designed to enhance payment security and reduce fraud during authentication. (FCA)

Strong Customer Authentication may require two or more verification elements, such as:

• something you know, for example a password or code;
• something you have, for example a phone or authentication device;
• something you are, for example biometric verification.

PSD2 and related payment security rules may require additional authentication before an online payment can be completed. These checks are handled by the payment provider, bank, card issuer or other authorised payment service provider, not by M8RCH.

If authentication fails or payment is declined, your order may not be processed.

11. Cookies and Similar Technologies

The M8RCH website may use cookies and similar technologies to:

• operate essential website functions;
• remember user preferences;
• support cart, login and checkout functionality;
• improve website performance;
• measure website usage;
• support security and fraud prevention;
• provide analytics or marketing features, where applicable.

Some cookies are necessary for the website to function. Other cookies may require your consent, depending on applicable law.

More information may be available in our Cookies Policy.

12. Sharing Personal Data

We may share personal data only where necessary and lawful.

Personal data may be shared with:

• payment providers;
• fulfilment and printing partners;
• shipping and courier companies;
• IT, hosting and website service providers;
• email and communication providers;
• analytics and security service providers;
• professional advisers, such as accountants or legal advisers;
• banks, card issuers and payment dispute processors;
• fraud prevention or identity verification providers;
• law enforcement, courts, regulators or public authorities, where required by law.

We require service providers to process personal data only for authorised purposes and to apply appropriate safeguards.

13. Fulfilment, Printing and Delivery Partners

To produce and deliver your order, we may share necessary order data with printing, fulfilment and delivery partners.

This may include:

• your name;
• shipping address;
• phone number or email where required for delivery;
• product details;
• custom design files;
• order number;
• delivery instructions.

These partners use the information only as required to fulfil and deliver your order.

14. Chargebacks, Fraud Prevention and Legal Protection

We may process and share relevant personal data where necessary to prevent fraud, investigate suspicious activity, respond to chargebacks, defend legal claims or enforce our rights.

This may include sharing order records, delivery details, transaction references, communication history, user account data and uploaded design details with payment providers, banks, card issuers, dispute processors, legal advisers or relevant authorities.

15. International Transfers of Personal Data

Your personal data may be transferred to or processed in countries outside the United Kingdom, the European Economic Area or your country of residence.

This may happen where we use international service providers, fulfilment partners, payment providers, hosting services, analytics tools or customer support systems.

Where personal data is transferred internationally, we take steps designed to ensure that the transfer complies with applicable data protection laws.

These safeguards may include adequacy regulations, contractual protections, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or other lawful transfer mechanisms. The ICO identifies the UK IDTA and the UK Addendum as standard data protection clauses that can be used for restricted transfers under the UK GDPR.

16. Data Security

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure or destruction.

These measures may include:

• secure website connections;
• encryption where appropriate;
• access controls;
• restricted access to personal data;
• account security measures;
• security monitoring;
• backup and recovery procedures;
• staff confidentiality requirements;
• supplier security checks;

ongoing review of security practices.

No online system is completely secure. However, we take reasonable steps to protect personal data and reduce the risk of security incidents.

17. GDPR and Data Protection Compliance

M8RCH processes personal data in line with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.

We apply data protection principles such as:

• lawfulness, fairness and transparency;
• purpose limitation;
• data minimisation;
• accuracy;
• storage limitation;
• integrity and confidentiality;
• accountability.

We use technical and organisational measures to support data protection compliance, including access control, security review, staff awareness and appropriate handling of personal data.

18. Data Retention

We keep personal data only for as long as necessary for the purposes described in this Privacy Policy.

Retention periods may depend on:

• the type of data;
• the purpose of processing;
• order status;
• account status;
• legal and tax requirements;
• accounting obligations;
• fraud prevention needs;
• chargeback or dispute records;
• customer support history;
• legal claims or regulatory requirements.

Examples:

• account data may be kept while your account remains active;
• order records may be kept for legal, tax and accounting purposes;
• support messages may be kept to manage customer service and disputes;
• uploaded design files may be kept for production, support, reprint, dispute and record-keeping purposes;
• security logs may be kept for a limited period to protect the website.

When personal data is no longer needed, we will delete it, anonymise it or securely archive it where appropriate.

19. Your Data Protection Rights

Depending on your location and applicable law, you may have rights in relation to your personal data.

These may include the right to:

• access your personal data;
• request correction of inaccurate data;
• request deletion of your personal data;
• object to certain processing;
• request restriction of processing;
• request data portability;
• withdraw consent where processing is based on consent;
• complain to a data protection authority.

The ICO explains that privacy notices should include information about individuals’ rights, including the right to withdraw consent where consent is the lawful basis. 

20. Third-Party Links

The M8RCH website may contain links to third-party websites or services.

We are not responsible for the privacy practices, content or security of third-party websites.

You should review the privacy policy of any third-party website or service before providing personal data.

21. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our website, business operations, legal requirements, payment systems, security practices or data processing activities.

The updated version will be posted on this page with a revised “Last updated” date.

Your continued use of the website after the updated Privacy Policy is posted means that you acknowledge the updated terms.

22. Governing Law

This Privacy Policy is governed by the laws of England and Wales.

Any disputes relating to this Privacy Policy, personal data processing or the use of the M8RCH website shall be subject to the jurisdiction of the courts of England and Wales, unless mandatory law provides otherwise.

25. Contact Information

If you have any questions about this Privacy Policy or how your personal data is handled, please contact us:

M8RCH LTD
Reg. Number: 17296644
Address: 239 Kensington High Street, London, England, W8 6SN
Email: [email protected]