1. Who we are
This website, cowannjc.uk, is run by COWANN JC LIMITED, a company registered in England and Wales under company number 17510866. We sell hats, caps and related accessories online under the name Cowann JC. For the personal data described in this policy we are the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
COWANN JC LIMITEDCompany number: 17510866
Registered address: 292468 Office Suite 29a, 3/F 23 Wharf Street, London, England, SE8 3GG
E-mail: [email protected]
Phone: +44 7723 418905
We have not appointed a Data Protection Officer, as we are not required to. Any privacy question can be sent to the e-mail address above.
2. Data we collect
When you place an order
- Identity and contact details: full name, e-mail address and phone number.
- Delivery details: delivery address, town or city and postcode.
- Order details: the products, colours and quantities you choose, prices, order number, the payment method you select (for example card, Apple Pay, Google Pay, PayPal or Klarna) and any order comment you add.
- Head size: if you give us your head circumference, we use it to pick the right size and to handle exchanges if the fit is not right.
- Gift card message: if you send an order as a present, the text you want written on the gift card, and any recipient name and address you give us. Please only share a recipient's details if you are entitled to do so.
Payment data
Payments are taken by our payment provider. Your card number, security code and wallet or Klarna account credentials are entered with and processed by that provider; we never see or store them. We receive only a confirmation that payment succeeded, the amount, the method used and, in some cases, a partial card reference (such as the last four digits) for refunds and reconciliation.
When you e-mail or call us
Our site has no contact form: contact buttons open your own e-mail app. If you write to us or phone us, we receive your name, e-mail address or phone number and whatever you choose to tell us — for example photographs of a hat, a measurement, or details of a return.
Returns and exchanges
If you cancel or return an order we keep a record of the items, the reason you give (if any), the condition on arrival and the refund or replacement made.
Technical data
Like any website, our hosting provider automatically receives standard technical information when pages load — IP address, browser type, device and time of request — in server logs used to keep the site secure and working.
We do not collect special category data (such as health information) and ask that you do not send it to us.
3. Purposes and legal bases
| What we do | Legal basis |
|---|---|
| Process your order, take payment, pack and deliver it, send order and delivery updates | Contract |
| Use your head size to choose a size and handle exchanges; write your gift card message | Contract |
| Handle cancellations, returns and refunds under the Consumer Contracts Regulations 2013 | Contract; legal obligation |
| Answer questions you send by e-mail or phone | Legitimate interests (helping customers) or contract, if it relates to an order |
| Keep accounting and tax records | Legal obligation |
| Prevent fraud and keep the website and our systems secure | Legitimate interests |
| Send occasional news about new collections, only if you ask us to | Consent |
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment.
5. International transfers
We aim to keep data in the UK. Some of our providers, such as payment, e-mail or hosting services, may process data in the European Economic Area or other countries. Where data leaves the UK, we make sure it is protected by UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or another safeguard recognised under UK GDPR. You can ask us for a copy of the relevant safeguard.
6. How long we keep data
| Data | Retention |
|---|---|
| Order, payment confirmation and invoice records | 6 years from the end of the financial year of the order, as required for tax and accounting |
| Delivery address and phone number | Kept with the order record; removed from courier systems by the courier under its own policy |
| Head size | Until the 14-day cancellation period and any exchange are complete, then deleted — or up to 2 years if you ask us to keep it for future orders |
| Gift card message | 90 days after delivery, in case the parcel needs to be resent |
| E-mail correspondence | 2 years from the last message, or longer if it relates to an order record above |
| Return and refund records | 6 years, with the related order |
| Marketing consent | Until you unsubscribe or withdraw consent |
| Server logs | Up to 30 days |
When data is no longer needed we delete it or anonymise it securely.
7. Security
Our site is served over an encrypted HTTPS connection. Access to order and customer data is limited to people who need it, protected by strong passwords and two-factor authentication where available. Card data never reaches our systems. No method of transmission is perfectly secure, but if a breach that is likely to put you at risk ever happens, we will tell you and the ICO as the law requires.
The basket and checkout on our site run in your browser's memory: they are not saved in cookies, local storage or anywhere else on your device, and are cleared when you close or reload the page.
9. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data where there is no good reason for us to keep it.
- Restriction — ask us to pause the use of your data, for example while a correction is checked.
- Portability — receive data you gave us under contract or consent in a machine-readable format, or have it sent to another organisation.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on your consent, withdraw it at any time.
To use any of these rights, e-mail [email protected]. We may ask you to confirm your identity. We reply within one month, free of charge, unless a request is manifestly unfounded or excessive. Some rights have exceptions — for example, we must keep order records for tax purposes even if you ask for erasure.
10. Withdrawing consent
If you have agreed to receive news from us, you can withdraw at any time by using the unsubscribe link in any message or by e-mailing [email protected]. Withdrawal does not affect anything we did with your consent before you withdrew it, and it does not affect order-related messages we must send to fulfil a purchase.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection: ico.org.uk, telephone 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Children
Our shop is intended for adults. You must be 18 or over to place an order. We do not knowingly collect personal data from children under 13; if you believe a child has given us their data, contact us and we will delete it.
13. Changes to this policy
We may update this policy when our services, providers or the law change. The latest version will always be on this page with the date it was last updated. If a change materially affects how we use data you have already given us, we will tell you by e-mail before it takes effect.
Last updated: 13 October 2026.