Privacy Policy

This Privacy Policy explains what personal information we collect when you book a gown with us or use our website, why we collect it, who we share it with, and what rights you have over it. We’ve kept it short and plain — if anything is unclear, message us and we’ll explain.

This policy applies to A&F Graduation Gowns as the data controller for the personal data described below. By making a booking with us or using our website, you confirm you’ve read this policy.

We may update this policy from time to time. The latest version is always on this page, and the date at the top tells you when it was last revised.

1.1 Who we are.

We are A&F Graduation Gowns, a small student-run service renting academic dress to university graduates. We’re the data controller for the personal information described in this policy.

2.1 What you give us when you book.

When you place a booking, we collect your name, email address, the WeChat or WhatsApp handle you’d like us to use, your phone number, the ceremony date, the gown type and size, and any notes you add to your booking. If you book on someone else’s behalf, we collect both your details and the named graduate’s details.

2.2 What you give us when you message us.

When you message us on WeChat or WhatsApp, the conversation itself — your messages, photos you send, your account name on that platform — sits with us and with the platform. We use it to coordinate your collection, return and any follow-up.

2.3 Payment information.

Payments are handled by our payment processor. We don’t see or store your full card details — we only see the order reference, the amount, and confirmation that the payment went through.

2.4 Information our website collects automatically.

Our website uses cookies and similar tools to keep the site working and to understand how it’s used. That includes basic technical information like your IP address, browser type, the pages you visited, and how you got to us. See our Cookie Policy for details.

2.5 Reviews and photos you choose to share.

If you send us a review, a graduation photo, or tag us on social media, we’ll have a copy. We only use it as set out in our Terms & Conditions.

Below we explain what we do with your data, why we do it, and the lawful basis we rely on.

Under UK data protection law we need a lawful basis to use your personal data. We rely on the following:

4.1 Contract.

To process your booking, take payment, coordinate collection and return, and handle anything else needed to deliver our service to you.

4.2 Legal obligation.

To keep transaction records for tax and accounting purposes, and to comply with any other legal duties that apply to us.

4.3 Legitimate interests.

To prevent fraud or misuse, to keep our website secure, to understand how our service is used, and to make it better. We always weigh our interests against your rights and only rely on this where the impact on you is limited.

4.4 Consent.

For anything that needs your specific permission — for example, using a photo or review you’ve sent us in our marketing. You can withdraw consent at any time and it won’t affect anything we did before you withdrew it.

We do not sell your personal data. We share personal data with trusted third parties so we can run our service, send marketing where you’ve opted in, and improve what we do.

Payment processor. To take your payment securely. We don’t see or store your full card details ourselves.

WeChat (Tencent) and WhatsApp (Meta). Because all of our day-to-day customer contact happens on these platforms, the conversations and any details you send us pass through Tencent (WeChat) and Meta (WhatsApp). Their use of your data is governed by their own privacy policies.

Website host. Our website and booking data are stored on a third-party hosting provider’s servers under our control.

Email and messaging providers. To send your booking emails and, where you’ve opted in, marketing emails and broadcast messages on WeChat or WhatsApp.

Analytics providers. To help us understand how visitors use our website.

Advertising partners. To show you A&F adverts on other websites and social media platforms. Some of our advertising partners act as joint controllers and handle your data under their own privacy policies. Our partners may include:

Meta (Facebook/Instagram): facebook.com/privacy/policy
Google: policies.google.com/privacy
TikTok: tiktok.com/legal/privacy-policy
WeChat (Tencent): wechat.com/en/privacy_policy
WhatsApp (Meta): whatsapp.com/legal/privacy-policy

Survey and review providers. To collect feedback and reviews from you.

Referral programme providers. If we run a refer-a-friend programme, the provider behind it.

Professional advisors. Such as accountants, lawyers and insurers where necessary.

Law enforcement and regulators. Where we are required to share data by law or to protect our rights, property, or safety.

Corporate transactions. If we ever sell, merge with, or hand over our business to another organisation, your data may be transferred as part of that — and we’ll let you know in advance.

With your consent. We may share your data with third parties when you direct us to or give us permission.

Aggregated data. We may share aggregated, anonymised, or de-identified data that can’t reasonably be used to identify you.

6.1 WeChat (Tencent).

WeChat is run by Tencent, a company based in China. If you message us on WeChat, your messages and any details you share go through Tencent’s servers, which are located outside the UK and outside the European Economic Area. Tencent’s privacy practices, including any government access to data, are governed by Chinese law and Tencent’s own policies — not by UK data protection law.

6.2 WhatsApp (Meta).

WhatsApp is run by Meta, a company headquartered in the US with operations worldwide. Meta processes WhatsApp data in several countries including the US. Meta uses standard contractual clauses and other safeguards to protect international transfers from the UK.

6.3 What this means for you.

You should only contact us via WeChat or WhatsApp if you’re comfortable with how those platforms handle your data.

6.4 Other transfers.

Aside from WeChat and WhatsApp, we don’t intentionally transfer your data outside the UK. If our website host or payment processor stores data outside the UK, they put their own safeguards in place — including standard contractual clauses approved by the UK government.

We keep your data only as long as we actually need it. Roughly:

7.1 Why six years for bookings.

Six years is the standard period for keeping financial records under UK tax law. After that we delete or anonymise booking records.

7.2 If you ask us to delete sooner.

You can ask us to delete your data earlier (see § 10). We’ll do so unless we’re legally required to keep it — for example, transaction records for tax purposes.

8.1 What we use.

Our website uses a small number of cookies — for things like keeping the site working, remembering your booking as you fill it in, and understanding how the site is used so we can improve it.

8.2 Where to find the detail.

Our Cookie Policy explains exactly which cookies we use, what each one does, how long it lasts, and how to turn them off. You can also manage cookies through your browser settings.

9.1 How to opt out.

You can opt out of marketing at any time by clicking the unsubscribe link in any marketing email, or replying STOP to a marketing message on WeChat or WhatsApp.

9.2 It may take a few days.

It can take a few days for our systems to update, so you may still receive a message or two while we process the change.

9.3 You’ll still get service messages.

Even if you opt out of marketing, you’ll still receive service messages about your active bookings — confirmation, collection details, ceremony-day reminders, return instructions, refund updates. These are part of providing the service, not marketing.

Under UK data protection law you have a number of rights over your personal data. In plain terms:

10.1 The right to be informed.

To know what data we hold about you and what we do with it. This Privacy Policy is the main way we tell you.

10.2 The right of access.

To get a copy of the personal data we hold about you.

10.3 The right to rectification.

To have inaccurate or incomplete data corrected.

10.4 The right to erasure.

To have your data deleted, where there’s no good reason for us to keep it. We may need to keep some data — like transaction records — to meet our legal obligations.

10.5 The right to restrict processing.

To ask us to limit how we use your data in certain situations.

10.6 The right to data portability.

To get a copy of your data in a structured, machine-readable format that you can move to another service.

10.7 The right to object.

To object to us processing your data based on legitimate interests.

10.8 The right to withdraw consent.

Where we rely on your consent, you can withdraw it at any time. This won’t affect anything we did before you withdrew it.

10.9 The right to complain.

If you’re unhappy with how we’ve handled your data, you can complain to the UK’s data protection authority (see § 16).

11.1 Get in touch.

There’s no special form — a clear sentence is enough.

11.2 We’ll respond within one month.

We’ll usually be back to you faster than that, but the legal deadline is one calendar month. If your request is unusually complex, we may extend by up to two more months — and we’ll tell you within the first month if we need to.

11.3 We may need to verify it’s you.

Before we send out personal data or delete it, we might ask you a question or two to confirm we’re talking to the right person. This is a security measure, not a way to delay things.

11.4 No fee, in most cases.

Exercising your rights is free. We can only charge a reasonable fee if a request is clearly unfounded or excessive — and we’ll explain why if it is.

12.1 Our service is for adults.

Our service is intended for university graduates, who’ll generally be 18 or over. We’re not aimed at children.

12.2 Under-18s.

If you’re under 18 and want to make a booking, please involve a parent or guardian — see our Terms & Conditions.

12.3 If we collect data from a child by mistake.

We don’t knowingly collect personal data from children under 13.

13.1 What we do.

We use encrypted connections (HTTPS) on our website, restrict access to booking records to the small team that needs them, and review our setup as we grow. Our payment processor and website host both use industry-standard security measures.

13.2 What we can’t promise.

No system on the internet is completely secure. While we do everything reasonable to protect your data, we can’t guarantee absolute security — and you share data with us at your own risk.

13.3 WeChat and WhatsApp messages.

WhatsApp messages are end-to-end encrypted between you and us. WeChat messages aren’t end-to-end encrypted by default and Tencent has access to message content. Keep that in mind when deciding what to send.

13.4 If something goes wrong.

If we ever discover a personal data breach that’s likely to affect your rights, we’ll notify the Information Commissioner’s Office (ICO) within 72 hours and let you know directly where the law requires it.

Our website may link to other websites — for example, your university, our payment processor, or social media. We’re not responsible for the privacy practices of those sites. Have a read of their own privacy policies before sharing your data with them.

15.1 We may update it.

We may update this Privacy Policy from time to time — for example, when we change something about our service, or when the law changes. The current version always lives on this page.

15.2 How we’ll tell you.

The “last updated” date at the top of this page tells you when we last changed anything. For changes that meaningfully affect your rights or the data we collect, we’ll let you know directly — by email, or by message on WeChat or WhatsApp.

16.1 Talk to us first.

We’d much rather hear from you than have you go away unhappy.

16.2 Then the ICO.

If we can’t resolve it together, you have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO):

For anything privacy-related — questions about this policy, requests to access or delete your data, or concerns about how we’ve handled it — get in touch:

17.1 WeChat or WhatsApp.

If you’re already a customer, message us on the handle we shared with you when you booked.