Privacy Policy

This policy explains what personal data KAS FASHION LTD collects when you buy from this website, what we do with it, and the rights you have over it. It is written to meet the UK GDPR and the Data Protection Act 2018.

1. Who we are

KAS FASHION LTD is the data controller for the personal data described here. We sell original branded clothing bought as overstock and end-of-line runs from UK trade suppliers, to private customers in the United Kingdom.

• Company: KAS FASHION LTD, registered in England and Wales, company number 17143325
• Registered office: 188 School Road Walton Highway, Wisbech, Cambridgeshire, United Kingdom, PE14 7DR
• Email: ceo@kasfashion.co.uk
• Telephone: +44 7849085205, Monday to Friday, 09:00–17:00

Data protection questions can be sent to the email address above and will be handled by a director. We have not appointed a data protection officer, as we are not required to.

2. What we collect

We only collect what an order actually needs.

Order and contact details

• Your name
• Email address
• Telephone number
• Delivery address, and a billing address where it differs
• The items, sizes and prices in your order, and any notes you send with it

Payment

Card and payment details are collected and processed by our payment provider on its own systems. We never see or store your full card number, expiry date or security code. What reaches us is confirmation that a payment succeeded or failed, a transaction reference, and the last four digits and card type shown on the receipt.

Correspondence

If you email or ring us about stock, a size, a delivery or a return, we keep that correspondence so we can deal with it and refer back to it if the question comes up again.

Technical data

Our hosting provider records standard server logs, including IP address, browser type and the pages requested, for security and to keep the site running.

We do not collect special category data — nothing about health, ethnicity, religion, politics, sex life, biometrics or trade union membership — and you should not send us any. We do not buy contact lists and we do not build advertising profiles.

3. Why we use it and our legal bases

Where we rely on legitimate interests, we have considered whether our interest is outweighed by your rights and are satisfied that it is not. You can ask us to explain that assessment.

4. Who we share it with

We do not sell personal data and we do not share it for anyone else's marketing. We pass it to these categories of recipient, and only as far as they need it:

• Delivery companies. Your name, delivery address, phone number and email go to the courier so the parcel can be delivered and tracked.
• Our payment provider. It processes the payment as a controller in its own right and applies its own privacy terms.
• Website hosting and email providers. They store the site and our mailboxes on our instructions.
• Our accountant. Order and payment records are shared for bookkeeping, VAT and statutory accounts.
• Professional advisers, insurers, and public authorities. Where we are required to disclose data by law, or need advice on a dispute or claim.

Providers acting on our instructions are bound by written contracts that require them to keep the data secure and use it only for the service they provide to us.

5. International transfers

We aim to keep personal data within the United Kingdom or the European Economic Area. Some of our service providers — for example email and hosting — may store or access data outside the UK. When that happens we rely on UK adequacy regulations for the destination country, or on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, together with any extra safeguards the transfer needs. You can ask us which mechanism applies to a particular provider.

6. How long we keep it

• Order, delivery and payment records: six years from the end of the financial year in which the order was placed, to meet HMRC record-keeping requirements.
• Return and refund records: six years, for the same reason and in case of a later claim.
• General enquiries that do not lead to an order: up to 12 months.
• Marketing email records: until you withdraw consent, plus a suppression record so we do not email you again by mistake.
• Server logs: normally up to 12 months, as set by our hosting provider.

When a retention period ends the data is deleted, or anonymised so it can no longer identify you.

7. Security

The site is served over HTTPS. Access to order records and mailboxes is limited to the people who need it, protected by individual accounts and multi-factor authentication where the provider supports it. Payment data does not touch our systems. Paper records, where they exist, are kept locked at the registered office. No system is perfect, and if a breach happens that is likely to result in a risk to your rights we will report it to the Information Commissioner's Office within 72 hours and tell you where the law requires it.

8. Cookies

This site does not use analytics, advertising or tracking cookies, and there is no third-party script following you between websites. Your browser may store strictly necessary items that keep the page working — for example a session identifier during checkout — which are exempt from the consent requirement under the Privacy and Electronic Communications Regulations. Fonts are loaded from Google Fonts, which means your browser contacts a Google server and that server sees your IP address. You can block or delete cookies in your browser settings; strictly necessary ones cannot be switched off without breaking parts of the site.

9. Your rights

Under the UK GDPR you have the right to:

• Access — get a copy of the personal data we hold about you.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — ask us to delete data, where we have no overriding reason to keep it, such as our tax records.
• Restriction — ask us to pause our use of your data while a dispute about it is resolved.
• Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller.
• Objection — object to processing based on legitimate interests, and object at any time to direct marketing.
• Withdraw consent — where we rely on consent, take it back at any time.

We do not make automated decisions that produce legal or similarly significant effects, and we do not carry out profiling. To exercise any of these rights, email ceo@kasfashion.co.uk. We will reply within one month; if a request is complex we may extend that by two further months and will tell you why. There is no charge unless a request is manifestly unfounded or excessive. We may ask for information to confirm who you are.

10. Withdrawing consent

Where we process data on the basis of your consent — currently only stock update emails — you can withdraw it whenever you like, by using the unsubscribe link in the email or by emailing us. Withdrawing consent does not affect anything we did lawfully before you withdrew it, and it does not stop us sending service messages about an order you have placed.

11. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the UK supervisory authority:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
• Helpline: 0303 123 1113
• Website: ico.org.uk

12. Age of customers

This shop is intended for adults. We do not knowingly sell to, or collect personal data from, anyone under 16. If you believe a child has given us their details, email us and we will delete them.

13. Changes to this policy

We update this policy when the way we handle data changes, or when the law does. The current version always sits at this address and the date below shows when it last changed. If a change materially affects how we use data you have already given us, we will tell you by email before it takes effect.

Last updated: 8 September 2026