Privacy Policy — The Brand Masters LDN Limited (thebrandmasters.co.uk)

Effective date / Last updated: 5 October 2026

Who we are

This privacy policy explains how The Brand Masters LDN Limited collects and uses personal data through thebrandmasters.co.uk and when you contact us about branded merchandise, promotional products or related services.

The Brand Masters LDN Limited is registered in England and Wales under company number 17330288. We are the website owner and data controller for the personal data covered by this policy.

Registered office: 96 Red Clover Gardens, Lions Green Lane, Coulsdon, Surrey, CR5 2FS, United Kingdom

Contact details:

Email: info@thebrandmasters.co.uk
Telephone: 020 8713 3000
Website: thebrandmasters.co.uk

We are registered with the Information Commissioner’s Office (ICO) as a data controller.

[ICO registration number: ZA000000]

This policy is based on the UK General Data Protection Regulation (the UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR).

The personal data we collect

We collect personal data that you choose to provide to us, including when you submit an enquiry through the website or contact us by email, telephone or another linked communication channel.

The enquiry form may collect:

Your name
Your email address
Your telephone number
Your company name
Details you provide about your brand, project, requirements or proposed merchandise

We may also collect information contained in correspondence, quotations, purchase orders, delivery details and other business communications.

When you browse the website, we may collect limited technical and usage information, such as pageviews and basic traffic statistics, through PostHog. Please see the section on analytics below.

We do not operate user accounts, logins, customer dashboards or saved submissions through the website.

We generally collect personal data directly from you. We may also receive relevant business contact details from your organisation or someone acting on its behalf.

Please avoid including unnecessary sensitive personal data in an enquiry. If you provide information about another person, you should ensure that you have a lawful basis for doing so and that they are aware their information may be shared with us.

How we use personal data

We use personal data for the following purposes:

To receive and respond to business enquiries
To understand your brand, project and merchandise requirements
To prepare quotations and proposals
To take steps towards entering into a contract
To supply, produce, print, personalise, fulfil and deliver branded merchandise and promotional products
To communicate with you about an enquiry or resulting project
To manage supplier, customer and business records
To operate, maintain and secure our website and systems
To monitor basic website traffic and improve the website
To comply with legal, accounting, tax and regulatory obligations
To establish, exercise or defend legal claims

We do not currently send marketing emails or operate a newsletter sign-up. If this changes, we will only send electronic marketing where permitted by PECR and applicable data protection law, including obtaining consent where required.

Our lawful bases for processing

We rely on one or more of the following lawful bases under the UK GDPR.

Legitimate interests

We rely on legitimate interests where processing is necessary for purposes including:

Responding to business enquiries
Managing communications with prospective and existing business contacts
Running, maintaining and securing the website and our systems
Preventing misuse, fraud or security incidents
Carrying out limited business analytics and improving website performance
Managing ordinary business administration and relationships

Before relying on legitimate interests, we consider the purpose of the processing, whether it is necessary and proportionate, and whether your interests, rights or freedoms override our interests. We do not use legitimate interests to override your rights where the impact on you would be disproportionate or where another lawful basis is required.

You may object to processing based on legitimate interests. See Your rights below.

We rely on consent where it is required by law, including for:

Optional cookies or similar analytics technologies where prior consent is required under PECR
Marketing emails where consent is required
Any other optional processing for which we ask you to provide a clear choice

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Performance of a contract or steps preparatory to a contract

We rely on this basis when processing is necessary to:

Discuss and scope a potential project
Prepare a quotation or proposal
Agree project requirements
Supply, produce, print, personalise, fulfil or deliver branded merchandise and promotional products
Manage an agreement or resulting business relationship

Legal obligation

We process personal data where necessary to comply with legal obligations, including obligations relating to tax, accounting, company records, financial records and legal reporting.

Analytics and PostHog

We use PostHog, configured in the EU region, to understand pageviews and basic website traffic statistics.

Our PostHog use is limited to basic analytics. We do not use it for:

Session recordings
Surveys
Advertising
Marketing campaigns
Cross-site advertising profiles
Behavioural advertising
Sale or sharing of personal data for marketing

Our analytics configuration is intended to be limited and proportionate. Depending on the technical method used, cookies or similar technologies used for analytics may require prior consent under PECR. Where consent is required, we will obtain it before using the relevant optional analytics technology and will provide a way to withdraw or change that choice.

At present, the website does not have a cookie banner. We will not rely on continued browsing as consent. Any optional analytics cookies or similar technologies that require consent must be controlled through an appropriate consent mechanism.

For UK GDPR purposes, our lawful basis for basic business analytics is legitimate interests where this is permitted. Where PECR requires consent for the relevant storage or access technology, consent will also be required.

Enquiry forms and communications

When you submit an enquiry through the website, the information you provide is sent to info@thebrandmasters.co.uk.

We use that information to respond to you, understand your requirements, prepare quotations and, where appropriate, take steps towards supplying products or services.

The website does not create an account, customer dashboard or saved submission for you. We may retain the information in our email, business administration and project-management systems where necessary for the purposes described in this policy.

The website includes a click-through link to WhatsApp. Using that link is optional.

If you choose to contact us through WhatsApp, the message and associated metadata will be handled through WhatsApp and its related companies. WhatsApp is a separate third-party service, and its own terms and privacy policy apply to the information it processes.

We do not control how WhatsApp processes information on its platform. You should review WhatsApp’s privacy information before using the service.

Instagram and Facebook

The website contains links to Instagram and Facebook. Clicking those links takes you to platforms operated by Meta.

Meta may set its own cookies, collect technical information or process personal data when you visit or use those platforms. We do not control Meta’s processing, cookies or privacy practices.

Meta’s own terms and privacy policies apply when you use those platforms.

We may share personal data where necessary for the purposes described in this policy.

Suppliers, manufacturers and fulfilment partners

We may share enquiry and project details with trusted suppliers, manufacturers and fulfilment partners so that they can:

Provide product availability and pricing
Prepare or support a quotation
Produce, print or personalise merchandise
Package, fulfil or deliver products
Provide related services needed for a project

Where these organisations process personal data on our behalf, we require them to act under contract, follow our instructions, use the information only for the agreed purpose and apply appropriate confidentiality and security measures.

Professional and operational service providers

We may share personal data with service providers that support our business, including:

Accountants and other professional advisers
Insurers
IT, email and hosting providers
Website and platform providers
Analytics providers, including PostHog
Legal advisers and other specialist service providers

These providers may process personal data only as necessary to provide their services to us and, where applicable, under our instructions and contractual safeguards.

Legal and regulatory disclosures

We may disclose personal data where required by law, regulation, court order or a lawful request from a public authority.

We may also disclose information where reasonably necessary to establish, exercise or defend legal claims, protect our rights or property, or prevent fraud, crime or security threats.

We do not sell or rent personal data.

International transfers

We aim to keep personal data hosted in the UK or European Union where possible. PostHog is configured in the EU region.

Some service providers or suppliers may process personal data outside the UK or the European Economic Area. Where a transfer is a restricted transfer under UK data protection law, we will use an appropriate safeguard, such as:

A UK adequacy regulation or other recognised adequacy decision
The UK International Data Transfer Agreement
The UK Addendum to the EU Standard Contractual Clauses
Any other lawful transfer mechanism available under the UK GDPR

Where required, we will also carry out a transfer risk assessment and implement appropriate supplementary measures.

You can contact us using the details above if you want further information about the safeguards used for a particular international transfer.

How long we keep personal data

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, tax, contractual and dispute-resolution requirements.

Our usual retention periods are:

Enquiries that do not lead to work: normally up to 12 months after the enquiry is closed or our last meaningful communication with you
Enquiries that lead to a project: normally for the duration of the project and up to 6 years after completion or the end of the relevant business relationship
Customer, supplier and project records: normally up to 6 years after the end of the relevant relationship or the latest transaction
Financial, tax and accounting records: normally at least 6 years after the end of the relevant accounting period, or longer where legally required
Legal claims and disputes: until the matter is resolved and for any further period reasonably necessary to protect our legal position
Analytics data: limited-use analytics data is normally retained for up to 24 months before being deleted or aggregated where practicable. Fully anonymised statistics may be retained for longer because they no longer identify an individual

We may retain information for longer where necessary to comply with a legal obligation, establish or defend legal claims, investigate fraud or security incidents, or comply with a regulator’s requirements.

Security

We use appropriate technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

No method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to create a risk to individuals, we will assess and handle it in accordance with applicable data protection law.

Your rights

Subject to certain legal conditions and exemptions, you have the following rights under the UK GDPR.

Right of access

You can ask for confirmation that we process your personal data and request a copy of that data, together with information about how we use it.

Right to rectification

You can ask us to correct inaccurate or incomplete personal data.

Right to erasure

You can ask us to delete your personal data in certain circumstances, for example where it is no longer needed for the purpose for which it was collected.

This right is not absolute. We may need to retain information where required by law or where it is necessary to establish, exercise or defend legal claims.

Right to restriction

You can ask us to restrict the use of your personal data in certain circumstances, including while we consider a dispute about its accuracy or lawfulness.

Right to object

You can object to processing based on our legitimate interests.

You can also object at any time to processing for direct marketing purposes. We do not currently send marketing emails or operate a newsletter, but this right would apply if that changes.

Where you object to processing based on legitimate interests, we will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless we need to continue processing for legal claims.

Right to data portability

Where applicable, you can ask us to provide personal data that you have provided to us in a structured, commonly used and machine-readable format, or ask us to transmit it to another organisation.

This right generally applies where processing is automated and based on your consent or necessary for a contract.

Where we rely on consent, you can withdraw it at any time. Withdrawal will not affect processing carried out before you withdrew consent.

Rights relating to automated decision-making

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects or similarly significant effects.

We do not carry out solely automated decision-making, including profiling, that produces legal or similarly significant effects.

How to exercise your rights

To exercise a right, contact us at:

Email: info@thebrandmasters.co.uk
Telephone: 020 8713 3000
Post: The Brand Masters LDN Limited, 96 Red Clover Gardens, Lions Green Lane, Coulsdon, Surrey, CR5 2FS, United Kingdom

Please provide enough information to help us identify you and understand your request. We may need to verify your identity before releasing or changing personal data.

We will normally respond to a valid request within one month. If a request is complex or we receive multiple requests, we may extend the response period by up to a further two months where permitted by law. If this applies, we will tell you within the first month and explain why.

There is normally no charge for exercising your rights. We may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive, as permitted by law.

Children

The website is intended for business use. We do not knowingly collect personal data from children.

If you believe that a child has provided personal data to us, please contact us so that we can assess and delete it where appropriate.

Complaints

We encourage you to contact us first so that we can try to resolve your concern.

You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113
Website: ico.org.uk

Changes to this policy

We may update this policy from time to time to reflect changes in our services, technology, suppliers, legal obligations or data-processing practices.

When we make changes, we will update the effective date and last-updated date shown on this page. We encourage you to review this policy periodically.