PRIVACY POLICY
What we collect, why we collect it, and what you can tell us to do about it. In plain English, because there is no reason for it to be anything else.
no small print gamesLook At This Mug · Last updated 14 August 2026 · Version 1.0
1. Who we are
Look At This Mug is the trading name of Debbie Prescott, a sole trader based in Essex. She is the “data controller” for the personal information described in this policy, which means she decides why and how it is used.
Business name | Look At This Mug |
Who runs it | Debbie Prescott, sole trader |
Where we are | Essex, United Kingdom |
How to reach us | Through the contact form on this website |
Business name
Look At This Mug
Who runs it
Debbie Prescott, sole trader
Where we are
Essex, United Kingdom
How to reach us
Through the contact form on this website
We are not required to appoint a Data Protection Officer, and we have not. Anything to do with privacy goes to Debbie directly, through the contact form — see section 13.
This policy explains what personal information we collect through this website, why we collect it, what we do with it, and the rights you have over it.
2. What we collect
2.1 What you send us
When you send a message through the contact form, we collect:
- your email address
- whatever you write in the message
That is the whole form — two fields. We do not ask for your name, your phone number or your address, because none of them are needed to answer a question. If you put any of that into the message yourself then we will have it, and we will treat it exactly the same way as the rest.
Giving us this is not a legal or contractual requirement. But we cannot reply without an email address, so if you would rather not give us one, please do not use the form.
Please do not send us “special category” information — health, ethnicity, religious or political views, and the like — or anything about criminal offences. We have no use for any of it.
2.2 What we collect automatically
Analytics. If you agree to analytics cookies, we use Google Analytics 4 (loaded through Google Tag Manager) to understand how people find and use the site — which pages get read, how long people stay, roughly where in the world they are, and what device they are on. This runs only if you accept analytics cookies on our cookie banner. If you decline, no analytics cookies are set and we collect no analytics about your visit at all.
Server logs. Our hosting provider automatically records technical information every time a page is served, including IP address, browser type and the time of the request. These logs exist to keep the site working and to keep it secure. They are not used to identify or profile individual visitors.
The full detail on cookies is in our cookie policy.
2.3 The mug designer
Nothing you put into the mug designer ever leaves your browser. The photo you upload, the text you add, the colours you pick — all of it is held in your browser’s memory while the page is open, and it is gone the moment you close the tab.
It is never uploaded to us. We never see it, we never store it, and there is nothing there for us to delete or hand over. There is no way to save a design yet, and that is precisely why — if there were, it would have to go somewhere.
That will change when ordering opens, because a mug cannot be printed from a photo that never left your laptop. We will update this policy before it does — see section 11.
3. Why we use it, and our legal basis for doing so
UK data protection law requires a valid “lawful basis” for each use of personal information. Ours are set out below.
| What we use it for | Legal basis |
|---|---|
Replying to a message you send us | Legitimate interests — answering someone who has asked us to get in touch. Where the message is about placing an order, this is also taking steps at your request before entering a contract. |
Keeping a record of what we have been asked, so we can improve the site and our answers | Legitimate interests — running and improving a small business |
Understanding how the website is used, so we can improve it | Consent — given through our cookie banner |
Keeping the website and our systems secure | Legitimate interests — protecting the site and the people who use it |
Establishing, exercising or defending legal claims | Legitimate interests — protecting our legal position |
Replying to a message you send us
Legitimate interests — answering someone who has asked us to get in touch. Where the message is about placing an order, this is also taking steps at your request before entering a contract.
Keeping a record of what we have been asked, so we can improve the site and our answers
Legitimate interests — running and improving a small business
Understanding how the website is used, so we can improve it
Consent — given through our cookie banner
Keeping the website and our systems secure
Legitimate interests — protecting the site and the people who use it
Establishing, exercising or defending legal claims
Legitimate interests — protecting our legal position
Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms and concluded that it does not override them — the information involved is minimal, you gave it to us so that we would reply, and you can object at any time (see section 6). Ask us if you would like more detail on that assessment.
Where we rely on consent, you can withdraw it whenever you like, and doing so does not affect anything we did before you withdrew it.
Marketing. We do not send marketing email. If that ever changes, we will ask you first, or rely on the “soft opt-in” in the narrow circumstances the law allows it, and every message will carry a one-click way out that we will act on straight away. We do not sell, rent or pass on your details for anyone else’s marketing — not now, not ever.
4. Who we share it with
We do not sell your personal information, and we do not share it for anyone else’s marketing. We share it with the following kinds of recipient, only as far as it is actually needed:
| Who | Why |
|---|---|
Our website hosting provider | Serving the website, storing what you send through the form, and holding server logs |
Google (Google Analytics and Google Tag Manager) | Website analytics, where you have agreed to it |
Our accountant | Where an enquiry turns into paid work and ends up in our accounting records |
Professional advisers, such as a solicitor or insurer | Where we need advice, or need to protect our legal position |
Law enforcement, regulators or the courts | Where we are legally required to hand something over |
Our website hosting provider
Serving the website, storing what you send through the form, and holding server logs
Google (Google Analytics and Google Tag Manager)
Website analytics, where you have agreed to it
Our accountant
Where an enquiry turns into paid work and ends up in our accounting records
Professional advisers, such as a solicitor or insurer
Where we need advice, or need to protect our legal position
Law enforcement, regulators or the courts
Where we are legally required to hand something over
Our hosting provider and Google act on our instructions under a written contract. Our accountant and any professional advisers act as independent controllers, responsible for the information under their own privacy policies and professional duties. Google also uses analytics data for its own purposes under its own terms, which is why we ask for your consent rather than treating analytics as exempt — see section 5, and section 3.2 of the cookie policy.
5. Where your information is held, and transfers outside the UK
We are in the UK, and we keep our records in the UK or the European Economic Area wherever we can. The exception is analytics data, which Google processes outside the UK.
Where a supplier processes data outside the UK, including in the United States, we rely on one or more of the safeguards UK law allows: adequacy regulations covering the destination country, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. For Google Analytics, the safeguard is normally the UK Extension to the EU–US Data Privacy Framework — the “UK–US data bridge”.
Ask us and we will tell you which safeguard applies to a particular transfer, or where it has been published.
6. Your rights
Under UK data protection law you have the right to:
- be told how your information is used — which is what this policy is for
- access a copy of the personal information we hold about you
- have inaccurate information corrected
- have information erased, where we no longer have a good reason to keep it
- restrict how we use your information while a query about it is sorted out
- object to our use of your information where we rely on legitimate interests — and an absolute right to object to direct marketing, which we will always honour
- portability — receive certain information in a machine-readable format, or have it sent to another provider
- withdraw consent at any time, where we rely on it
To use any of these, send us a message through the contact form and say what you are asking for. There is no charge in normal circumstances.
We will respond within one month. If a request is complex, or you have made several, we may extend that by up to two further months and will tell you if we do. If we need to confirm who you are, or ask you to narrow down what you are looking for, the month does not start — or pauses — until you reply. We ask so that we do not hand your information to the wrong person.
Complaining
If you are unhappy with how we have handled your information, you have the right to complain to us directly. Send a message through the contact form with “Data protection complaint” at the top. We will acknowledge it within 30 days of receiving it, look into it properly, keep you posted on where it has got to, and tell you the outcome without undue delay.
You do not have to come to us first, and you can complain to the Information Commissioner’s Office at any time:
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk/make-a-complaint
7. How long we keep it
| Information | How long |
|---|---|
Messages sent through the contact form | 24 months from our last contact about it, then deleted |
Anything that turns into paid work | 6 years from the end of it — the limitation period for claims, and the tax record-keeping requirement |
Website analytics data | No more than 14 months, after which Google deletes it automatically |
Server logs | A short period set by our hosting provider for security and troubleshooting, then overwritten |
Anything you put into the mug designer | Never held at all — it stays in your browser and goes when you close the tab |
Messages sent through the contact form
24 months from our last contact about it, then deleted
Anything that turns into paid work
6 years from the end of it — the limitation period for claims, and the tax record-keeping requirement
Website analytics data
No more than 14 months, after which Google deletes it automatically
Server logs
A short period set by our hosting provider for security and troubleshooting, then overwritten
Anything you put into the mug designer
Never held at all — it stays in your browser and goes when you close the tab
When we no longer need something, we delete it, or strip it back far enough that it can no longer be linked to you.
8. Security
We take appropriate technical and organisational measures to protect personal information: encryption in transit (HTTPS across the whole site), access controls, multi-factor authentication on the accounts we use, and keeping what we hold down to the minimum we actually need. The less there is, the less there is to lose.
No system is completely secure. If a breach happens that is likely to put people’s rights at risk, we will report it to the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours of finding out. Where the risk is high, we will tell the people affected as well.
9. Children
This site is meant for adults. Nothing on it is aimed at children, and we do not knowingly collect information about them. If you think a child has sent us something through the contact form, tell us and we will delete it.
When ordering opens, you will need to be 18 or over to place an order.
10. Automated decision-making
We do not make decisions about you by purely automated means that produce legal or similarly significant effects. There is no profiling, no scoring and no automated screening — messages sent through the form are read by Debbie.
11. Ordering is not open yet
You cannot buy anything through this site at the moment. There is no basket, no checkout and no payment. The sign-in panel does not create an account either — nothing typed into it is sent anywhere or stored, by design.
Once ordering opens we will be collecting a good deal more: names, delivery addresses, order details, and payment information handled by a payment provider. None of that happens today. We will update this policy, and say what has changed, before any of it starts.
12. Changes to this policy
We may update this policy — for example if we change the tools we use, or the way we work. The version number and “last updated” date at the top will always tell you which version you are reading, and material changes will be flagged on this page.
If we ever want to use your information for a new purpose that is not covered here, we will tell you about it, and about the lawful basis for it, before we start.
13. Contact us
Questions about this policy, about how we handle your information, or a request to use any of the rights in section 6 — all of it goes through the same place:
Look At This Mug
Debbie Prescott, sole trader · Essex, United Kingdom
Send us a message
The form goes straight to Debbie — there is no call centre and no shared inbox in between. You can also complain to the Information Commissioner’s Office at any time, whether or not you have come to us first: ico.org.uk/make-a-complaint.