Legal
Privacy Policy
Last updated: [DATE]
Contents
1. Who we are
Hattrick Club ("we", "us") operates hattrickclub.com and sells football jerseys and related products.
For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy. You can reach us at support@hattrickclub.com.
2. What data we collect
We collect only what we need to run the shop:
- Order data — name, email, billing and delivery address, phone number, items ordered, order value.
- Payment data — handled entirely by our payment provider. We never see or store your full card number.
- Account data — if you create an account: email, password (hashed), order history, saved addresses, wishlist.
- Communications — messages you send us through the contact form or by email, and our replies.
- Marketing data — your email address and preferences if you subscribe to our newsletter.
- Reviews — the name, rating, text and any photos you choose to submit with a product review.
- Technical data — IP address, browser and device type, pages visited, referring site. Collected via cookies and similar technologies (see section 4).
3. Why we use it and our legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Processing and delivering your order | Performance of a contract |
| Customer support and handling returns | Performance of a contract |
| Fraud prevention and site security | Legitimate interests |
| Tax, accounting and legal records | Legal obligation |
| Newsletter and marketing emails | Consent (withdraw any time) |
| Abandoned cart reminder emails | Legitimate interests / consent |
| Analytics and advertising cookies | Consent |
| Publishing product reviews | Consent |
Where we rely on consent, you can withdraw it at any time — that doesn't affect anything we did before you withdrew it.
4. Cookies and tracking
We use cookies to keep the site working and, with your consent, to understand how it's used.
- Strictly necessary — cart contents, login session, checkout, security. These can't be switched off.
- Functional — remembering preferences such as recently viewed items and wishlist.
- Analytics — anonymous statistics about traffic and behaviour, so we can improve the store.
- Marketing — measuring campaigns and showing relevant ads, where enabled.
You can change your choices at any time through the cookie banner, and you can block or delete cookies in your browser settings. Blocking necessary cookies will break checkout.
5. Who we share data with
We don't sell your data. We share it only with service providers who help us run the shop, and only with what they need:
| Provider | What they do |
|---|---|
| Stripe | Payment processing |
| MailerLite | Newsletter and marketing emails |
| FunnelKit | Checkout and cart recovery emails |
| TrackShip | Shipment tracking and delivery updates |
| CusRev | Collecting and displaying product reviews |
| Hostinger | Website hosting and backups |
| Analytics and tag management (with consent) | |
| [Carriers] | Delivering your parcel |
We may also disclose data where we're legally required to — for example to tax authorities or in response to a lawful request.
6. International transfers
Some of the providers above are based outside the European Economic Area, which means your data may be transferred and processed there.
Where that happens, the transfer is covered by appropriate safeguards — normally the European Commission's Standard Contractual Clauses or an adequacy decision. You can request a copy of the safeguards in place by emailing us.
7. How long we keep it
- Order and invoice records — [10] years, as required by [Latvian] accounting and tax law.
- Account data — until you ask us to delete the account.
- Newsletter subscription — until you unsubscribe.
- Support emails — [24] months after the conversation ends.
- Abandoned cart data — [30] days, then deleted.
- Analytics data — [14] months.
8. Your rights
Under GDPR you have the right to:
- Access — get a copy of the data we hold about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted, where we're not legally required to keep it.
- Restriction — limit how we use your data.
- Portability — receive your data in a machine-readable format.
- Objection — object to processing based on legitimate interests, including direct marketing.
- Withdraw consent — at any time, for anything based on consent.
- Complain — to your national data protection authority.
To exercise any of these, email support@hattrickclub.com. We respond within one month, as required by law. There's no charge unless a request is clearly excessive.
9. Security
The site runs over encrypted HTTPS, payment data is handled directly by our payment provider, and access to order data is limited to people who need it to do their job.
No system is perfectly secure. If a breach ever affects your rights, we'll notify you and the supervisory authority as the law requires.
10. Children
This shop isn't aimed at children and we don't knowingly collect data from anyone under 16. If you believe a child has given us personal data, contact us and we'll delete it.
11. Changes to this policy
If we change how we handle personal data, we'll update this page and change the "last updated" date at the top. Significant changes will be flagged on the site or by email.
12. Contact
Questions about this policy or your data: support@hattrickclub.com.