Legal
Privacy Policy
This notice explains what personal data 5 Roles Clothing collects through this website, why we collect it, who we share it with, and the rights you have over it. We have written it in plain English because that is what UK GDPR Article 12 requires — “concise, transparent, intelligible and easily accessible, using clear and plain language”.
Last updated: 29 August 2026
01 — Who we are
The data controller for this website is 5 Roles Clothing. We decide what personal data is collected and what it is used for, which is what makes us the controller under UK GDPR.
Website: https://www.5rolesclothing.com
02 — What we collect
We collect personal data through three routes only.
Project brief — /your-project
- Data collected
- Brand stage, brand name, your name, email address, optional phone number, optional postal address, services wanted, and a free-text project description.
- Why we collect it
- To assess your project and provide a quote. We cannot respond to a brief without at minimum a name and a way to reach you.
Wholesale / trade enquiry — /wholesale
- Data collected
- Company name, contact name, email address, phone number, order volume band, product categories of interest, and a free-text message.
- Why we collect it
- To understand your trade requirements and reply with relevant pricing and lead times.
Newsletter sign-up
- Data collected
- Email address only.
- Why we collect it
- To send you updates, new collections and occasional offers. You can unsubscribe at any time using the link in every email.
03 — Our lawful basis for processing
UK GDPR requires us to identify a lawful basis for every processing activity. Here is ours.
Project briefs & wholesale enquiries
Basis: Article 6(1)(b) — processing necessary for steps taken at your request prior to entering into a contract.
You are asking us for a quote. Responding to that request requires us to read and retain what you have sent. We do not ask for consent because consent would be withdrawable at will — including mid-quote — and consent that is effectively a condition of the service is not freely given and therefore not valid under UK GDPR.
Newsletter
Basis: Article 6(1)(a) — your consent.
Signing up is entirely optional. You can withdraw consent and unsubscribe at any time using the link in every email, with no effect on any project or order.
Record-keeping & preventing misuse
Basis: Article 6(1)(f) — our legitimate interests.
We have a legitimate interest in retaining records related to completed transactions for accounting and legal compliance, and in keeping enough information to prevent repeated misuse of our forms. This is limited, proportionate and does not override your rights.
06 — How long we keep it
Enquiries that do not become work are kept only as long as is reasonably necessary to follow up and determine that no project will proceed, after which they are deleted.
Records tied to an order are kept as long as required by our tax, accounting and legal obligations, which vary depending on the nature of the transaction.
Newsletter subscribers are retained on the mailing list until they unsubscribe or request deletion.
A specific retention schedule is available on request. To ask, contact us at the address in section 10.
07 — International transfers
Our providers (Supabase and Vercel) may process data in countries outside the United Kingdom. Where they do, those transfers are covered by appropriate safeguards, such as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, which the UK Government has approved as providing adequate protection.
If you would like details of the specific safeguards in place for any transfer, please contact us at the address in section 10.
08 — Your rights
Under UK GDPR you have the following rights. They are not absolute — each has conditions and exceptions — but we will respond to every request and explain our position if we are unable to comply fully.
- Right of access
- You can ask for a copy of the personal data we hold about you.
- Right to rectification
- If any data we hold is inaccurate or incomplete, you can ask us to correct it.
- Right to erasure
- In certain circumstances you can ask us to delete your data — for example, if the processing was based on consent and you withdraw it, or if there is no longer a legitimate reason to hold it.
- Right to restriction
- You can ask us to pause processing your data while, for example, an accuracy dispute is resolved.
- Right to data portability
- Where processing is based on consent or contract and carried out by automated means, you can ask for your data in a structured, machine-readable format.
- Right to object
- You can object to processing based on legitimate interests. We will consider your objection and stop unless we have compelling legitimate grounds that override your interests.
- Rights related to automated decision-making
- We do not make automated decisions about individuals — all enquiries are reviewed by a person.
- Right to withdraw consent
- Where processing is based on your consent (newsletter only), you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.
To exercise any right, contact us at the address in section 10. We will respond within one calendar month, as required by UK GDPR Article 12.
09 — Complaints
If you are unhappy with how we have handled your data, please contact us first and we will try to resolve it.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection:
ico.org.uk/make-a-complaint10 — Contact & rights requests
To exercise a right, withdraw consent, ask a question about this notice, or request your retention schedule, email us at:
hello@5rolesclothing.comWe will acknowledge your request promptly and respond within one calendar month. Complex or numerous requests may take longer; if so, we will let you know within the first month.
11 — Changes to this notice
We may update this notice when our practices change or when the law requires it. The “Last updated” date at the top of this page reflects the date of the most recent substantive change. We will not silently update the date without changing the content.
If we make a change that materially affects how we process your data, we will make reasonable efforts to notify you — for example, by email if we hold your address.
This notice has been prepared in good faith as a starting point and should be reviewed by a qualified solicitor before the business relies on it. The business should also confirm its ICO registration status before launch.