Shaka Merch · Privacy policy
Privacy policy
What we collect, why we have it, who else sees it, and how long we keep it. Including your photographs, which is the part that actually matters here.
Last updated 4 September 2026
Who you are dealing with
Shaka Merch is a trading name of THESOCKSDUDES LTD, a company registered in England and Wales.
- Company number 15268433
- Registered office 4 Elswick Road, London, SE13 7SR, United Kingdom
- Email hello@shakamerch.com
We are the controller
THESOCKSDUDES LTD is the data controller for personal data collected through shakamerch.com. If you want to ask about anything in this policy, email hello@shakamerch.com.
What we collect
Only what an order needs:
- Your details — name, email address, delivery address, and for bulk orders a company name.
- Your order — what you bought, what you paid, and the design attached to it.
- Your artwork — the photographs, logos or design files you upload, and the print file we generate from them.
- Your enquiry — anything you write in a quote or contact form.
- Basic technical data — the request logs our host keeps, which include an IP address.
Why, and on what basis
Under UK GDPR we rely on:
- Performing our contract with you — making, checking and delivering your order, and dealing with a problem afterwards.
- Our legitimate interests — keeping the site working and secure, preventing abuse of the upload and quote forms, and keeping records of what we agreed with a customer.
- Legal obligation — tax and company records.
- Your consent — marketing email, if you ask for it. You can withdraw it at any time and every email has an unsubscribe link.
Your photographs, specifically
This is the part worth reading. When you upload a photo in the studio:
- It is uploaded to our storage, hosted by Supabase in the UK region (London).
- If you use the background remover, a reduced copy of that image is sent to fal.ai, in the United States, which runs the model that cuts the background out. It is processed and returned; we do not permit it to be used for training.
- The design and its images are held behind an unguessable link and deleted automatically after 90 days, unless the design belongs to an order we still need to fulfil or account for.
- We do not use face recognition, we do not identify anybody from a photo, and we do not build a profile from one. The image is artwork to us.
If you want a design and its images deleted sooner than 90 days, email us with the link and we will remove it.
Who else sees your data
Only the companies that make an order happen:
- Shopify — checkout and card payment for small orders. We never see or store your card details.
- Merchize — our print and fulfilment partner. They receive your name, delivery address and print file. They are outside the UK.
- Supabase — database and file storage, UK region.
- Vercel — website hosting.
- fal.ai — background removal, United States, as described above.
We do not sell your data, and we do not share it with advertisers.
Sending data outside the UK
Some of those providers are outside the UK — notably fal.ai in the United States and our fulfilment partner in Asia. Where data leaves the UK we rely on the transfer mechanisms UK law provides, including the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. If you want the detail for a specific provider, ask us.
How long we keep it
- Designs and uploaded images — 90 days, unless attached to a live order.
- Order and invoice records — six years, which is what tax law requires.
- Enquiries — up to two years, so we can pick up a conversation where it left off.
- Marketing consent — until you withdraw it.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to somebody else. You can object to processing we do on the basis of legitimate interests. Email hello@shakamerch.com and we will answer within one month.
If you think we have got it wrong you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but it is your right either way.
Children
This shop is not aimed at children and we do not knowingly collect data from anybody under 13. Parents order socks with their children’s faces on them all the time — that is the parent’s data to give, and the parent’s order.
Cookies
We set none. The detail is on our cookie page.