Privacy Policy

This site — jameslord.uk and jamesjacklord.com — is run by James Lord, based in England. For the purposes of UK data protection law, James Lord is the controller of any personal data collected through it. The quickest way to reach me about anything in this policy is the contact form.

It applies to the site itself, its shop, and the messages you send through it. It does not cover third-party sites you leave for — notably zellerfeld.com and Stripe’s hosted checkout — which have their own policies, linked below.

The site collects the minimum it needs to do the thing you asked it to do. Specifically:

• Contact form. Your name, email address, subject and message — because you can’t get a reply without them. Your IP address is also passed to Cloudflare Turnstile to confirm you’re a person and not a script. Legal basis: legitimate interest in answering you and keeping spam out.
• Shop orders. When you check out, Stripe collects your name, email, shipping address and payment details on its own hosted page. Card numbers never touch this site’s servers. Stripe then sends back the order details (what you bought, where it’s going, your email) so the order can be fulfilled and you can be contacted about it. Legal basis: performance of a contract, and legal obligation for the records that follow.
• Your bag. Items you add are stored in your own browser (localStorage) so they survive a refresh. Nothing about the bag is sent anywhere until you press Checkout. Clearing your browser data empties it.
• Analytics. Cloudflare Web Analytics measures page views and load performance in aggregate. It sets no cookies, stores nothing on your device, and does not fingerprint or track you across sites. Legal basis: legitimate interest in knowing whether the site works.
• Server logs. Like every website, the servers (Cloudflare) record requests — IP address, browser type, the page requested and when — for security and to keep the site running. These are held briefly and are not used to identify you.

There is no account system, no newsletter, no retargeting, and no data is sold or rented to anyone. Ever.

The site sets no advertising or tracking cookies, which is why you weren’t asked to click through a banner. Two things are stored on your device, both strictly necessary:

• localStorage · jl_cart — the contents of your bag. Removed automatically when the bag is emptied or your order completes.
• Cloudflare security cookies — Cloudflare, which hosts the site and runs the Turnstile bot check, may set short-lived cookies purely to tell people from bots and to protect the site from abuse. They carry no personal information.

Stripe’s checkout page and zellerfeld.com set their own cookies under their own policies once you’re on their domains.

A handful of services do specific jobs. Each only receives what it needs for that job:

• Stripe — payments and checkout. Stripe Privacy Policy.
• Cloudflare — hosting, the Turnstile bot check, and cookieless analytics. Cloudflare Privacy Policy.
• Resend — delivers contact-form messages and order notifications as email. Resend Privacy Policy.
• Zellerfeld — sells and fulfils LEVALLOIS. The Shop-now button hands you to zellerfeld.com; from that moment Zellerfeld is the seller and the controller of your order data. This site receives nothing about that purchase. Zellerfeld Privacy Policy.

Some of these providers process data in the United States. Where they do, transfers rest on the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, which each provider publishes.

• Contact messages — kept in the inbox for as long as the conversation is live, then deleted when it’s no longer needed.
• Order records — kept for six years from the end of the tax year in which the order was placed, because HMRC requires business records to be retained for that long.
• Analytics — aggregate only; there is no per-person record to delete.
• Server logs — retained by Cloudflare for a short rolling window, then discarded.

Under UK GDPR and the Data Protection Act 2018 you can ask to access the personal data held about you, correct it, delete it, restrict how it’s used, object to processing based on legitimate interests, and receive a portable copy of anything you provided. None of these cost anything, and you’ll get a response within one month.

To exercise any of them, use the contact form. If you’re unhappy with how a request is handled you can complain to the Information Commissioner’s Office at ico.org.uk.

The site isn’t aimed at anyone under 16 and doesn’t knowingly collect their data. If you believe a child has sent a message or placed an order, get in touch and it will be removed.

If the site starts doing something new with your data, this page changes first and the date at the top moves. Material changes to how orders are handled will also be noted on the shop.