Privacy
This one already applies. The wait list is collecting addresses today, and the checkout is in place for when you order.
Who is responsible
SAGHEERAH LTD is the controller of the personal data described here — the company that decides what is collected and why, and the one answerable for it.
DECISION NEEDEDThe registration number the Information Commissioner's Office gives SAGHEERAH LTD, once that registration has actually been made. The founder has said it is being seen to; until the public register holds it, this notice claims nothing about it, and this block is here rather than a sentence for exactly that reason. It is not only a question about wording: most United Kingdom organisations that process personal data are required to register and to pay the annual data protection fee, so what the house must do and what the page may say are the same question. The register is public and searchable, so a number here turns a claim into a check that takes ten seconds.
- SAGHEERAH LTD, company number 14346197
- 54 Lea Hall Green, Birmingham B20 2AW
- info@sagheerah.co.uk
What is collected, and why
The wait list. Your email address, and nothing else — no name, no address, no tracking of what you looked at. We use it for one thing: to write to you when there is a piece to sell. The lawful basis is your consent, given by typing the address and pressing the button, and you can take it back at any time. No law and no contract requires you to give us the address — joining is entirely your choice, and the only thing that follows from keeping it to yourself is that we have no way to write to you.
Requests to this site. Cloudflare serves these pages and runs the small program behind the wait-list form, and request logging is switched on. That records that a request happened, when it happened, and where it came from, which means your IP address. The basis is our legitimate interest in a site that stays up and can be debugged when it does not.
Orders. Pressing the buy button sends us five things and nothing else: which garment, which cloth, which size, which length, and how many. No name, no address, no card. Everything after that happens on Stripe's own page, and what you type there — your name, your delivery address, your card — Stripe collects, not us. Afterwards Stripe passes us the name and the delivery address, because a parcel has to be addressed, and the last four digits of the card and nothing more of it. The basis is that we cannot deal with the order you have just placed, or make the contract it asks for, without them.
Who else handles it
Resend, which turns a wait-list submission into an email to the house inbox. Resend is a United States company, so an address on the wait list leaves the United Kingdom. UK law allows that where a recognised safeguard covers the transfer, and we will name the one we rely on here once we have checked it against what Resend actually holds rather than taken it from their marketing.
Stripe, which takes the payment. The page you enter a card into is Stripe's, not ours; the card number is never sent to this site, and we could not hand it on if we were asked to. Stripe holds the name, address and payment record for the order and passes us what we need to send the parcel and to keep our own books.
Cloudflare, which hosts the site and runs the two small programs behind it — the one the wait-list form posts to, and the one that opens a Stripe checkout. Cloudflare holds the request logs described above.
Nobody else. Nothing here is sold, rented, or handed to an advertiser. No analytics, no tracking pixel, no third-party script, and the site sets no cookies of its own.
How long it is kept
The wait list: we keep your address until you ask us to delete it, or until we close the list, whichever comes first. Asking is one line to info@sagheerah.co.uk and we do not ask why.
Failing either of those, twenty-four months. If we have heard nothing from you in that time — no order, no reply — the address goes. No law sets a period for a list like this one, so that limit is ours rather than somebody else's, and it is there because an address nobody has any use for should not sit here indefinitely.
Order records are kept for six years from the end of the financial year they fall in, and then deleted. That one is not ours to choose. Company law requires a company to keep its accounting records, and tax law requires the records behind a company's tax return to be kept for six years after the end of the period they cover; six years is the longer, so six years is what governs.
It is also the one request on this page we would have to turn down. If you ask us to erase an order record before those six years are up, we cannot, and we would tell you so rather than agree and quietly not do it.
Your rights
Over the data described above, you have the right to:
- ask what we hold about you, and get a copy of it
- have anything inaccurate corrected
- have it erased
- have its use restricted while something is in dispute
- receive it in a portable form, or have it sent on
- object to what we are doing with it
- withdraw your consent to the wait list, which is as easy to take back as it was to give
Some of these apply only in certain circumstances. Portability and objection depend on which basis we are relying on for the data in question, and erasure gives way where the law requires us to keep a record — the tax and company law above is that case.
Write to info@sagheerah.co.uk. There is no charge for any of it, and you will have an answer within a month.
Email from us
The wait list is a consent list, and we treat it as one. We did not buy the addresses on it, and none of them was taken from an order — the form is the only way onto it, and consent typed into that form is the only thing holding an address there. Every email carries a way off the list, and leaving takes one line back to us at the address above.
Complaints
Come to us first if you can — info@sagheerah.co.uk. We will acknowledge it, answer it, and tell you what we did about it.
You do not have to come to us first. You can complain to the Information Commissioner's Office, the United Kingdom's data protection regulator, at ico.org.uk or on 0303 123 1113, at any point.