Privacy Policy

01Who we are

Duiok SR is an online shop for men's everyday basics. The shop is run by DUIOK SR LIMITED, a private limited company registered in England and Wales. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the controller of the personal data described in this policy.

We are a small business and have not appointed a Data Protection Officer. Any question about this policy or your personal data goes to the email address above, and it is read by the person responsible for data protection in the company.

02The data we collect

We only collect what we need to sell you clothes, deliver them and help afterwards. Most of it comes directly from you.

When you place an order

• Contact details: your full name, email address and phone number.
• Delivery details: delivery address, town or city, postcode and your chosen delivery method.
• Order details: the products, colours, sizes and quantities you order, prices, order number, order date and any comment you add at checkout, such as a safe place or gate code.
• Payment status: confirmation from our payment provider that a payment was authorised, refunded or failed, plus a transaction reference. We never receive or store your full card number, expiry date or security code.

When you ask for an exchange or return

• Your order history and the sizes you bought, so we can check what you ordered and send the right replacement size.
• The reason for the return or exchange if you choose to give one, and details of the refund we issue.

When you email or call us

• Your name, email address or phone number and the content of our correspondence, including anything you choose to tell us, for example measurements for sizing advice.

When you browse the website

• Technical data that any web server receives automatically, such as your IP address, browser type and the pages requested, which our hosting provider may record in short-lived security logs.
• The contents of your shopping bag are kept only in your browser tab's memory while the page is open. They are not sent to us and disappear when you close or reload the page.

We do not ask for, and ask you not to send us, special category data such as health information. We do not collect data from social networks or buy data from third parties.

03Why we use it and our lawful bases

UK GDPR requires a lawful basis for every use of personal data. These are ours:

Where we rely on legitimate interests, we have weighed our interests against yours and only proceed where your rights do not override them. You can ask us for details of that assessment. We do not make decisions about you based solely on automated processing, and we do not profile you.

If you do not provide the details marked as required at checkout, we cannot accept or deliver your order.

04Who we share it with

We never sell your personal data. We share it only with the categories of recipients below, and only as much as each one needs:

• Payment provider: processes card and wallet payments and refunds, and screens transactions for fraud. Your card details go directly to the provider, which acts as an independent controller for payment data under its own privacy notice.
• Courier and postal services: receive your name, delivery address, postcode, phone number and email address to deliver your parcel and send tracking updates.
• Email and IT service providers: host our email inbox, website and order records on our behalf as processors under written contracts.
• Professional advisers: our accountants, and lawyers or insurers where needed, who receive order and refund records under a duty of confidentiality.
• Authorities: HMRC, the police or other public bodies, where the law requires us to share information or it is necessary to prevent fraud or crime.

Our website loads typefaces from Google Fonts. When a page loads them, your browser sends your IP address and browser details to Google, which acts as a separate provider under its own privacy terms.

If the business or its assets were ever sold or restructured, customer records could be transferred to the new owner, who would have to respect this policy.

05International transfers

We are based in the UK and keep our order records with UK or European providers wherever we can. Some of our providers, such as payment, email or font services, may process data in the European Economic Area, the United States or other countries.

Whenever personal data leaves the UK, we make sure it is protected by one of the safeguards recognised by UK law: a country or framework covered by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework), the ICO's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for more information about the safeguard used for a specific provider.

06How long we keep it

We keep personal data only for as long as we need it for the purpose it was collected for, then delete or anonymise it.

Where a complaint or legal claim is ongoing, we may keep the relevant records until it is resolved and any limitation period has passed.

07How we keep it secure

We use technical and organisational measures appropriate to the data we hold, including:

• encrypted HTTPS connections across the website;
• card payments handled entirely by our payment provider, so card numbers never touch our systems;
• strong, unique passwords and two-factor authentication on the accounts that hold customer data;
• access limited to the people who need it to fulfil orders and answer customers;
• written data processing terms with every provider that handles personal data for us.

No online service can be completely secure. If a breach occurs that is likely to put your rights at risk, we will tell you and report it to the ICO within 72 hours where the law requires it.

08Cookies and similar technologies

Our website does not set cookies and does not use analytics, advertising or tracking tools. We do not use local storage or session storage either: your shopping bag lives only in the memory of the open page.

Because we don't use non-essential cookies, you won't see a cookie banner. If we ever add them, we will update this policy and ask for your consent first, as required by the Privacy and Electronic Communications Regulations 2003 (PECR). Our payment provider may use its own strictly necessary cookies on its payment pages to prevent fraud.

09Your rights

Under UK GDPR you have the following rights over your personal data:

• AccessAsk for a copy of the personal data we hold about you.
• RectificationAsk us to correct data that is wrong or complete data that is missing.
• ErasureAsk us to delete your data where we no longer need it or you withdraw consent, unless the law requires us to keep it.
• RestrictionAsk us to pause using your data while an accuracy issue or objection is checked.
• PortabilityReceive data you gave us under contract or consent in a structured, machine-readable format, or have it sent to another organisation.
• ObjectionObject to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consentTake back any consent you have given, without affecting processing before you withdrew it.

To use any right, email [email protected]. We may ask you to confirm your identity, for example by writing from the email address used for your order. We respond within one month, which can be extended by two further months for complex requests. Using your rights is free unless a request is clearly unfounded or excessive.

10Withdrawing consent

Where we rely on your consent — for optional information you share, such as measurements for sizing advice, or for marketing emails you have asked for — you can withdraw it at any time by emailing [email protected] or by using the unsubscribe link in any marketing email.

Withdrawing consent is as easy as giving it. It does not affect the lawfulness of what we did before, and it does not affect processing we carry out on another lawful basis, such as delivering an order you have already placed.

11Complaints and the ICO

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the UK's supervisory authority at any time:

12Age restriction

Our shop is intended for adults. You must be 18 or over to place an order. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their details, contact us and we will delete them.

13Changes to this policy

We review this policy when our services, providers or the law change. The date at the top of this page shows when it was last updated. If a change significantly affects how we use data you have already given us, we will tell you by email before it takes effect.

14How to contact us

For any question about this policy or your personal data:

Last updated: 30 September 2026.