Version 2026-07-28
1. Controller and contact
The trader below is the controller of personal data used to operate Vintage Pitch, fulfil orders and provide customer support.
- Trading name
- Vintage Pitch
- Legal identity
- Vintage Pitch
- Geographical address
- Marrsfield Avenue, Apartment 204, Dublin, Co. Dublin, D13 EDK1, Ireland
- pitchvintage@gmail.com
- Telephone
- +353 85 839 1525
Send data-protection questions or requests to pitchvintage@gmail.com.
2. Information we collect
- Account data: name, email address, password hash and account status.
- Order data: selected goods, personalisation, prices, currency and order history.
- Delivery data: recipient name, address and telephone number.
- Payment references: Stripe Checkout, PaymentIntent and refund identifiers and statuses.
- Support data: messages, issue type, attachments and the action taken.
- Technical and security data: session identifiers, IP-related request logs, timestamps and audit records.
- Marketing preferences, only if an optional marketing service is introduced and you choose it.
We do not receive or store your complete card number or card security code.
3. Why we use it and our legal bases
| Purpose | Typical legal basis |
|---|---|
| Create and secure your account | Performance of the account service contract; legitimate interests in account security |
| Take payment, deliver goods and manage returns | Steps at your request and performance of the sales contract |
| Invoices, tax records and statutory consumer obligations | Compliance with legal obligations |
| Fraud prevention, security and legal claims | Legitimate interests, and legal obligations where applicable |
| Optional electronic marketing | Your consent, or another basis permitted by applicable ePrivacy rules |
Information required for account creation, payment and delivery is contractual. Without it, we cannot create the account, complete the order or deliver the goods.
4. Who receives information
- Stripe, which processes checkout, payment, fraud signals and refunds.
- Zoho Mail / transactional sender pending, to deliver account and order messages.
- Contabo (EU), to host the store and database.
- Delivery carriers, for fulfilment and tracking.
- Professional advisers, public authorities or courts where reasonably necessary or legally required.
Providers act under their own legal responsibilities or under contracts requiring appropriate protection. We do not sell personal information.
5. International transfers
Some providers may process data outside Ireland or the European Economic Area. Where GDPR restricted transfers occur, we use a lawful mechanism such as an adequacy decision or approved contractual safeguards. The final production provider register and transfer locations must be confirmed before launch.
6. Retention
- Order, invoice and payment records are normally retained for six years where needed for Irish tax and accounting obligations.
- Account information is kept while the account is active, then deleted or minimised when no longer required, subject to transaction and legal records that must remain.
- Incomplete carts and routine technical logs are kept for shorter operational and security periods.
- Support records and uploaded evidence are kept only as long as needed to resolve the case, meet consumer obligations and handle legal claims.
- Consent records are retained as necessary to demonstrate the preference you selected.
Specific operational deletion schedules will be finalised with the production infrastructure.
7. Your rights
Subject to the conditions in data-protection law, you may request access, correction, erasure, restriction or portability, and may object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing.
We may ask for information necessary to verify your identity. We normally respond within one month. You may complain to Ireland’s Data Protection Commission at dataprotection.ie.
8. Security and automated decisions
We use access controls, password hashing, CSRF protection, payment-provider separation and administrative audit records. No internet service is completely risk-free. Stripe may use automated fraud-prevention measures under its own notices; Vintage Pitch does not currently make solely automated decisions that produce legal or similarly significant effects about customers.
9. Updates
This notice is reviewed when processing or providers change. The current version and date appear at the top of this page. Material changes will be communicated where required.