McIntosh - Data Protection (GDPR) Policy

Last updated: 16 October 2026

The following should be read together with the documents listed below:

  • Website Terms & Conditions
  • Privacy Policy
  • Cookie Policy
  • McIntosh Customer Charter

1. Who we are

This Data Protection (GDPR) Policy describes how James McIntosh Omnimedia Limited (“McIntosh”, “JMOL”, “we”, “us”, “our”) complies with UK data protection law when handling personal data.

  • Controller: James McIntosh Omnimedia Limited (company no. 09113481)

  • Registered office: 42 Denman Road, London, SE15 5NR, United Kingdom

  • Email (data protection contact): [email protected]

  • ICO registration: ZA547821

  • Websites (the “Sites”): knitmcintosh.com, knitnibble.com, mcintoshpublishing.com, drternst.com, jamesmcintosh.co.uk, sockknitting.co.uk, babyknitting.co.uk, chunkyknits.co.uk, plus any forwarding domains.

We are the data controller for personal data we process through our Sites and business operations. We currently are not required to appoint a statutory Data Protection Officer, but the above contact handles data protection matters.

2. Scope

This policy applies to:

  • All personal data processed by JMOL about customers, newsletter subscribers, website users, suppliers, competition entrants, and business contacts.

  • All processing carried out via our Sites, e-commerce platform, payment and delivery partners, marketing tools, customer support systems, accounting, and product-safety obligations.

  • All staff, contractors and service providers acting on our instructions.

This policy should be read alongside our Privacy Policy and Cookie Policy.

3. Our responsibilities & governance

  • The Board/Directors are accountable for GDPR compliance and approve this policy.

  • The Data Protection Contact oversees day-to-day compliance, training, incident handling, and responses to data subject requests.

  • All staff/contractors must follow this policy and complete basic privacy/security training.

We maintain the following governance records:

  • Record of Processing Activities (ROPA)

  • Data Retention Schedule

  • Third-Party Processor Register (with due-diligence & contracts)

  • Data Breach Register

  • DPIA Log (for high-risk processing, if any)

4. Lawful, fair and transparent processing

We process personal data only where a lawful basis applies:

  • Contract (e.g., taking payment, fulfilling orders, customer service, returns/warranty)

  • Legal obligation (e.g., tax, accounting, consumer law, product safety/recall)

  • Legitimate interests (e.g., IT security, fraud prevention, analytics, service improvement, and soft-opt-in customer marketing under PECR—balanced against your rights)

  • Consent (e.g., non-customer marketing, non-essential cookies/ads, featuring user-generated content)

We do not undertake solely automated decisions with legal or similarly significant effects.

5. The data protection principles

We adhere to the UK GDPR principles. Personal data must be:

  1. Processed lawfully, fairly and transparently

  2. Collected for specified, explicit and legitimate purposes

  3. Adequate, relevant and limited to what is necessary

  4. Accurate and, where necessary, kept up to date

  5. Kept no longer than necessary (see Retention)

  6. Processed securely using appropriate technical and organisational measures

  7. Accountability: we can demonstrate compliance with the above

6. Individual rights

Under UK GDPR you have rights to:

  • Access your data

  • Rectification of inaccuracies

  • Erasure (in certain circumstances)

  • Restriction (in certain circumstances)

  • Portability (data you provided, where processing is by consent or contract and automated)

  • Object to processing based on legitimate interests and to direct marketing at any time

  • Withdraw consent where processing relies on it

How to exercise your rights: email [email protected]. We will respond within one month (extendable by two months for complex requests). We may verify identity before acting. You can complain to the ICO at ico.org.uk.

7. Data we process (summary categories)

  • Identity & contact: name, addresses, email, phone

  • Order & payment: items purchased, order value, delivery choice; payment authorisation details from our processor (we do not store full card numbers)

  • Account & preferences: login, order history, saved addresses, marketing choices

  • Communications: emails, messages, notes

  • Technical/usage: IP, device, browser, pages viewed, cookie IDs (see Cookie Policy)

  • UGC/social: handles and content if you tag us and give permission to feature

  • Competitions & vouchers: entries, eligibility, redemptions

  • B2B contacts: company, role, VAT number (if applicable)

We do not intentionally collect special category data; please do not include sensitive health or other special category details in free-text fields.

8. Retention

We keep data only as long as needed for each purpose:

  • Orders & financial records: typically 7 years (legal obligation)

  • Customer accounts: while active; reviewed and anonymised/deleted after inactivity

  • Marketing lists: until you unsubscribe/withdraw consent; suppression lists kept to honour your choice

  • Customer service correspondence: typically up to 12 months, longer if required for legal/product safety reasons

Our detailed Retention Schedule is available on request.

9. Security

We implement appropriate technical and organisational measures proportionate to risk, including:

  • Encrypted transport (HTTPS/TLS), secure hosting, regular updates/patching

  • Access controls, principle of least privilege, role-based access

  • Strong authentication for admin systems; secure password practices

  • Staff confidentiality, onboarding/offboarding, and baseline privacy/security training

  • Backups, logging, and incident response procedures

  • Vendor due-diligence and processor contracts with data protection clauses

No system is 100% secure. Please keep your credentials safe and tell us if you suspect misuse.

10. Processors & third parties

We use trusted service providers acting under our instructions, for example:

  • Payments: e.g., Shopify Payments / Paypal / Klrana etc

  • Delivery & logistics: e.g., Royal Mail, DPD, UPS, LANGYARNS, and similar couriers

  • E-commerce/IT: platform hosting, site support, security, backups

  • Marketing & analytics: email platforms, analytics, review tools, advertising networks (consent where required)

  • Professional advisers: accountants, auditors, legal advisers

We ensure appropriate contracts and safeguards are in place and do not allow processors to use your personal data for their own purposes.

We do not sell personal data.

10.1 Digital knitting patterns from LANGYARNS

When you purchase a kit that includes a digital pattern supplied by LANGYARNS or from WOOLADDICTS by LANGYARNS, we share your email address with LANG in Switzerland through our order integration solely to arrange delivery of the PDF pattern included with your purchase. Your pattern will be emailed directly to you by LANGYARNS.

We process and share your email address for this purpose to fulfil our contract with you. This sharing is for pattern delivery only and does not subscribe you to marketing communications from LANG or LANGYARNS.

LANGYARNS uses your email address solely to deliver your pattern and does not retain it after delivery, add it to a marketing list or sell it to third parties.

For the transfer to Switzerland, we rely on UK adequacy regulations recognising Switzerland as providing an adequate level of protection for personal data.

11. International transfers

Where processing occurs outside the UK:

  • We rely on UK adequacy regulations (where available), or

  • We use approved safeguards (e.g., UK Addendum/IDTA with EU SCCs) plus appropriate technical/organisational measures.

Details of current transfer mechanisms are available on request.

12. Data Protection Impact Assessments (DPIAs)

We assess new or changed processing that may present high risk to individuals (e.g., large-scale profiling, sensitive data) and conduct DPIAs where required. We consult the ICO where the residual risk remains high.

13. Direct marketing & cookies (PECR)

  • We follow the soft opt-in rule for email marketing to existing customers of similar products.

  • For all other e-marketing, we obtain consent.

  • We use non-essential cookies (analytics/advertising) only with consent.

  • See our Privacy Policy and Cookie Policy for details and controls.

14. Children

Our Sites are not intended for children under 13. We do not knowingly collect personal data from children.

15. Personal data breaches

A personal data breach is a security incident leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.

Our response (summary):

  1. Identify & contain the breach; preserve evidence

  2. Assess risk to individuals’ rights and freedoms

  3. Notify the ICO within 72 hours if required

  4. Inform affected individuals without undue delay where there is high risk

  5. Record all breaches in the Breach Register and implement remediation

Detailed playbook available on request.

16. Complaints

If you are unhappy with how we process your data, contact [email protected] You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

17. Changes to this policy

We may update this policy from time to time. The latest version will be posted on our Sites, with a new “Last updated” date. We will highlight material changes where appropriate.

18. Contact

Data protection contact:
James McIntosh Omnimedia Limited
Email: [email protected]