Privacy policy
Built Different Last updated: June 2026
1. Who We Are
Built Different is a trading name of Fumoney Ltd, a company registered in England and Wales.
- Company Registration Number: 13215582
- Registered Address: The Mill, Pury Hill Business Park, Towcester, Northampton, NN12 7LS
- Data Contact: team@built-different.co
We are the data controller for the personal data we collect about you. This means we determine the purposes and means by which your personal data is processed.
We are registered with the Information Commissioner's Office (ICO) as a data controller under UK GDPR - ZC177099
2. What This Policy Covers
This Privacy Policy explains:
- What personal data we collect about you
- Why we collect it and what we use it for
- The legal basis for each type of processing
- Who we share it with
- How long we keep it
- Your rights and how to exercise them
This policy applies to all customers, website visitors and subscribers, including those based in the United Kingdom, the European Union and elsewhere.
3. The Data We Collect
When you place an order
- Full name
- Delivery and billing address
- Email address
- Phone number (if provided)
- Order details (products, quantities, prices)
- Payment information (we do not store card details — these are handled by our payment processors)
- IP address
When you browse our website
- Browser type and version
- Pages visited and time spent
- Referring URL
- Device type
- IP address
- Cookie identifiers (see Section 9)
When you sign up for marketing
- Email address
- Phone number (for SMS marketing, if you opt in)
- Marketing preferences and consent records
When you contact us
- Name and email address
- The content of your message
When you submit a data request
- Name, email address and order number (via our EU Withdrawal Form)
4. Why We Use Your Data and Our Legal Basis
Under UK GDPR and EU GDPR, we must have a lawful basis for each type of processing. Here is how that applies to what we do:
| Purpose | Legal Basis |
|---|---|
| Processing and fulfilling your order | Contract — necessary to perform the contract of sale |
| Sending order confirmation and shipping updates | Contract — necessary to perform the contract of sale |
| Fraud prevention and security | Legitimate interests — to protect our business and customers |
| Sending marketing emails (where you have subscribed) | Consent |
| Sending SMS marketing messages (where you have opted in) | Consent |
| Sending abandoned cart reminders by email or SMS | Consent (or legitimate interests where permitted) |
| Improving our website and understanding how it is used | Legitimate interests — to develop and improve our services |
| Advertising to you via Meta (Facebook/Instagram) and Google | Consent (via cookie consent) |
| Responding to customer service enquiries | Legitimate interests — to provide customer support |
| Complying with legal obligations (e.g. tax, accounting records) | Legal obligation |
| Processing data subject requests (erasure, access etc.) | Legal obligation |
5. Who We Share Your Data With
We share your personal data with carefully selected third parties who help us operate our business. All third parties who process personal data on our behalf are required to do so only in accordance with our instructions and under appropriate data protection safeguards.
Order Fulfilment
- Bleckmann UK — our third-party logistics (3PL) provider who picks, packs and dispatches your orders. Your name and delivery address are shared with them to fulfil your order.
- FedEx / DPD / Royal Mail and carrier partners — your name, delivery address and order reference are passed to our shipping carriers to deliver your parcel.
- Loop Returns (builtdifferent.loopreturns.com) — our returns management platform, used when you initiate a return or exchange.
Payments
- Shopify Payments / Stripe — payment processing. We do not store your card details. These are handled directly by our payment processor under PCI DSS compliance standards.
Marketing & CRM
- Klaviyo — our email and SMS marketing platform. Your email address, purchase history and marketing preferences are stored and processed by Klaviyo to send you marketing communications where you have given consent.
- SMSBump Inc — our SMS marketing platform (a Klaviyo company), operating under EU law from Sofia, Bulgaria. Your phone number is shared when you opt in to SMS marketing to enable delivery of text messages.
- Meta Platforms Ireland Ltd — we use the Meta Pixel on our website to measure advertising performance and serve targeted advertisements on Facebook and Instagram to users who have given cookie consent.
- Google Ireland Ltd — we use Google Analytics and Google Ads to understand website usage and serve advertisements. Processing occurs where you have given cookie consent.
Technology & Infrastructure
- Shopify Inc — our ecommerce platform provider. All order, customer and website data is stored within Shopify's systems. Shopify acts as a data processor under a signed Data Processing Agreement. See Shopify's privacy policy at shopify.com/legal/privacy.
- Revoq (consumer-withdrawal.eu) — our EU Withdrawal Form provider, used to process statutory cancellation requests from EU customers.
Legal and Compliance
We may disclose your personal data to law enforcement, regulatory bodies or other third parties where we are legally required to do so, or where it is necessary to protect the rights, property or safety of Built Different, our customers or others.
6. International Transfers
Some of our third-party processors are based outside the UK and European Economic Area (EEA). Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:
- Standard Contractual Clauses (SCCs) approved by the European Commission or the UK ICO
- Processing only with processors who participate in recognised frameworks (e.g. EU-US Data Privacy Framework)
Shopify, Meta, Google and Klaviyo all operate internationally. Their data transfer mechanisms are documented in their respective privacy policies.
7. How Long We Keep Your Data
We retain personal data only for as long as is necessary for the purposes it was collected, or as required by law.
| Data Type | Retention Period |
|---|---|
| Order and transaction records | 7 years (legal/tax obligation) |
| Customer account data | Duration of account + 2 years after last activity |
| Email marketing consent records | Until withdrawal of consent + 2 years |
| SMS marketing opt-in records | Until withdrawal of consent + 2 years |
| Website analytics data | 26 months (Google Analytics default) |
| Customer service correspondence | 3 years |
| Data subject request records | 3 years |
After these periods, data is securely deleted or anonymised.
8. Your Rights
Under UK GDPR and EU GDPR, you have the following rights in relation to your personal data:
Right of access — you can request a copy of the personal data we hold about you.
Right to rectification — you can ask us to correct inaccurate or incomplete data.
Right to erasure — you can ask us to delete your personal data in certain circumstances (also known as the "right to be forgotten"). EU customers can use our EU Withdrawal Form to submit this request.
Right to restriction — you can ask us to temporarily stop processing your data in certain circumstances.
Right to data portability — you can request a copy of your data in a structured, machine-readable format.
Right to object — you can object to processing based on legitimate interests or for direct marketing purposes.
Right to withdraw consent — where processing is based on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
Rights related to automated decision-making — you have the right not to be subject to decisions made solely by automated means that have a significant effect on you.
To exercise any of these rights, please contact us at team@built-different.co. We will respond within 30 days. We may need to verify your identity before processing your request.
If you are an EU customer wishing to cancel an order or exercise your statutory right of withdrawal, please use our EU Withdrawal Form.
9. Cookies
Our website uses cookies and similar tracking technologies. Cookies are small text files placed on your device when you visit our site.
We use the following types of cookies:
Strictly necessary cookies — essential for the website to function (e.g. your shopping cart, login session). These do not require consent.
Analytics cookies — used to understand how visitors use our website (e.g. Google Analytics). These are only placed with your consent.
Marketing cookies — used to serve you relevant advertisements on other platforms (e.g. Meta Pixel, Google Ads). These are only placed with your consent.
Preference cookies — used to remember your settings and preferences (e.g. language, currency). These may require consent.
When you first visit our website, you will be shown a cookie consent banner allowing you to accept or decline non-essential cookies. You can change your cookie preferences at any time using the cookie settings link in our website footer.
For EU/EEA visitors, we apply an opt-in standard — non-essential cookies are not set until you have actively consented.
10. Marketing Communications
Email marketing
We send marketing emails only to customers who have subscribed to our mailing list or, where permitted under applicable law, to existing customers who have not opted out. You can unsubscribe at any time using the unsubscribe link in any of our emails or by contacting us at team@built-different.co.
SMS marketing
We send SMS marketing messages only where you have explicitly opted in. To opt out, reply STOP to any message from us.
We use Klaviyo and SMSBump to manage these communications. Your consent preferences and opt-out requests are recorded and actioned promptly.
11. EU Customers — Statutory Right of Withdrawal
If you are an EU consumer, you have a statutory right to withdraw from your purchase within 14 days of receiving your order, without giving any reason. This is separate from our standard returns policy.
To exercise your right of withdrawal, please complete our EU Withdrawal Form. You will receive a confirmation email with a reference number. We will process eligible refunds within 14 days of receiving the returned goods.
12. Children
Our website and products are not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us at team@built-different.co and we will delete it promptly.
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology or legal requirements. When we make significant changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.
14. Complaints
If you have concerns about how we handle your personal data, please contact us first at team@built-different.co — we will do our best to resolve your concern promptly.
If you remain unsatisfied, you have the right to lodge a complaint with a data protection supervisory authority:
- UK: Information Commissioner's Office (ICO) — ico.org.uk — 0303 123 1113
- EU: The supervisory authority in your country of residence. A full list is available at edpb.europa.eu.
15. Contact Us
For any questions about this Privacy Policy or your personal data, please contact:
Fumoney Ltd The Mill, Pury Hill Business Park Towcester, Northampton NN12 7LS
Email: team@built-different.co Website: built-different.co
This policy applies under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR 2016/679) where applicable.