Privacy policy

Last updated: October 2026

Urban Good respects your privacy. This policy explains how we collect, use and share personal information when you visit urbangood.org, buy from our shop, subscribe to our emails or contact us.

Who we are

This website is operated by Urban Good Community Interest Company, registered in England and Wales with company number 10690638, trading as Urban Good.

Urban Good is responsible for deciding how personal information is used for the purposes described in this policy.

For privacy questions, requests or complaints, email shop@urbangood.org.

You can also write to: Urban Good — Privacy enquiries, 18–22 Ashwin Street, London, E8 3DL, United Kingdom.

Information we collect

Contact information. We collect your name, email address, billing and delivery addresses, and telephone number if you provide it.

Order information. This includes products purchased, order value, payment status, delivery details, returns, refunds and correspondence about your purchase.

Payment information. Payment providers process the details needed to complete your transaction. We receive payment confirmations and limited transaction information, rather than your full payment-card number or security code.

Account information. Where you choose to use a customer account, we process the information associated with it.

Correspondence. We collect information you provide through emails, enquiries, feedback and other communications.

Marketing preferences. This includes subscription status, consent records and unsubscribe requests.

Website and device information. This can include your IP address, browser and device details, approximate location, referring websites, pages and products viewed, shopping activity and interactions with the website.

Email engagement information. Our email tools record information about delivery, email opens, links clicked and purchases associated with our marketing emails.

We obtain information directly from you, automatically through our website and connected services, and from providers involved in payments, delivery and operating the shop.

If you give us another person’s details—for example, a delivery address for a gift—please make sure you are entitled to do so and let them know about this policy.

Why we use your information

Processing purchases and providing customer service

We use contact, payment and order information to accept orders, arrange delivery, provide updates, handle returns and resolve problems. This is necessary to perform our contract with you or take steps you request before entering into a contract.

Responding to enquiries

We use information you provide to answer questions and discuss our products, projects or services. Our legal basis is taking steps towards a contract where relevant, or our legitimate interest in responding to people who contact us.

Keeping business records

We retain information needed for accounting, taxation and other legal requirements. Our legal basis is compliance with legal obligations.

Security, fraud prevention and resolving disputes

We use relevant transaction and technical information to protect customers, secure our services, investigate misuse and establish or defend legal claims. Our legal basis is our legitimate interest in running a secure business, and compliance with legal obligations where applicable.

Newsletters and marketing

We use contact details and preferences to send news, product information and offers. We rely on consent where required. Where the law permits marketing about our own similar products to existing customers, we may rely on our legitimate interests, provided the required opportunity to opt out has been given.

Analytics, advertising and personalisation

We use website and engagement information to understand how people use the shop, measure marketing and provide relevant content or advertising. We rely on consent for cookies, tracking and associated processing where required by law. Essential operational reporting and security processing may rely on our legitimate interests.

Where we rely on legitimate interests, we consider the effect on your privacy and your reasonable expectations.

You do not have to provide optional information or agree to marketing to make a purchase. However, we cannot process an order without the information needed to take payment and deliver it.

Payments and delivery

Our shop uses Shopify Payments and the payment methods offered at checkout. Payment providers process information to authorise payments, prevent fraud and meet their own legal obligations.

We share the information needed to prepare and deliver your order with our fulfilment and delivery providers. These include Dennis Maps, which helps fulfil folded-map orders, and carriers including Royal Mail and Evri.

This can include your name, delivery address, order contents and relevant contact or delivery instructions.

We use Make to automate parts of our order-handling process, including transferring fulfilment information to the people preparing your order.

Shopify and connected services

Our online shop is hosted by Shopify. Shopify processes personal information to provide the storefront, checkout, payments, order management, security and other services used to operate our business.

We also use Shopify Network Intelligence. This allows Shopify to use information from interactions with our store together with information from interactions with other merchants and Shopify to provide enhanced services, including personalisation, service improvements and advertising-related features. These services take account of applicable consent and privacy choices.

Shopify acts on our instructions for some processing and is independently responsible for other processing, including certain enhanced services.

You can read the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal to exercise relevant rights directly with Shopify, including choices about personalised advertising.

Our connected business tools also include services for email marketing, accounting, shipping, data exports and workflow automation. Depending on the task, these tools process the contact, order or transaction information needed to provide their services.

We are moving our email marketing to Shopify Messaging. Mailchimp remains connected during this transitionand may continue to process information associated with that connection and existing mailing-list records.

Cookies, analytics and advertising

Cookies are small files stored on your device. We also use related technologies, including pixels and tags, which can record website activity and interactions.

Essential functions. These technologies operate the basket and checkout, remember necessary settings, record privacy choices and protect the website.

Analytics. These tools help us understand visits, product interest and how people use the shop.

Marketing. These tools measure advertising, connect visits with purchases and support relevant advertising.

Additional content. Some technologies provide features such as embedded video players.

Our website includes Shopify analytics, Google Analytics, Google advertising services, and Meta services associated with Facebook and Instagram. These services can receive technical identifiers and information about browsing or shopping activity. Depending on your choices and the provider’s settings, information may be associated with other information held by the provider.

The cookie banner offers options to accept, decline or manage optional cookie categories. Essential cookies are needed for the service you request and are not switched off through these choices.

Your choices apply to the browser and device you are using. Clearing your browser’s site data can remove saved preferences and cause the banner to appear again. You can also use browser settings to block or delete cookies, although blocking essential cookies can affect the shop.

For information about Shopify’s technologies and their lifetimes, read Shopify’s cookie policy.

For information about Google’s services and privacy controls, read How Google uses information from websites using its services.

For information about Facebook and Instagram services, read Meta’s privacy policy.

For information about Mailchimp, read Intuit’s privacy statement.

Cookie names and lifetimes vary by service and may change. The providers’ policies explain their technologies and retention periods.

Marketing emails

You can unsubscribe from our marketing emails at any time using the unsubscribe link in an email or by contacting shop@urbangood.org.

Unsubscribing from marketing does not stop essential messages about an order, payment, delivery or customer-service enquiry.

Our email tools record delivery and engagement information, including opens and link clicks, to help us understand readership and the effectiveness of our communications. Open tracking commonly uses a small image loaded when an email is opened. Some email applications block or obscure this information.

You can limit image-based tracking through your email application’s remote-image settings and contact us with questions about email tracking. This is separate from the website’s cookie preferences.

We retain a limited record of unsubscribe requests so that we can respect your preference and avoid adding you back to marketing inadvertently.

Embedded content and external links

Some pages contain embedded content, including Vimeo videos. When that content loads, the provider may receive technical information such as your IP address and browser details and may use its own cookies or similar technologies. See Vimeo’s privacy policy.

Our website also links to publishers, partners, social platforms and other external websites. Their handling of your information is governed by their own privacy policies.

Who else receives information

We share personal information where necessary with providers that host and support the website and our business systems; payment, fulfilment and delivery providers; email, analytics and advertising providers; and accountants, professional advisers and authorised technical support providers.

We may also disclose information to authorities or other parties where required by law or necessary to establish, exercise or defend legal claims.

Some providers act on our instructions. Others, such as payment providers and certain advertising platforms, also use information for purposes for which they are independently responsible.

Advertising-related disclosures may be described as “sharing”, “targeted advertising” or a “sale” under some privacy laws, even where no money is paid for the information. Applicable choices can be exercised through the relevant consent controls, provider privacy tools or by contacting us.

International processing

We operate in the United Kingdom, but Shopify and other service providers operate internationally. Your information may therefore be stored or processed outside the UK, including in the European Economic Area, the United States and Canada.

Shopify’s data-hosting region does not mean that every connected service processes information only in that region.

Where international transfer rules apply, transfers require an appropriate legal mechanism, such as recognition that the destination provides adequate protection or approved contractual safeguards. Shopify describes its arrangements in its Data Processing Addendum.

Contact us if you would like further information about a transfer or the safeguards relevant to your information.

How long we keep information

Retention depends on the reason information was collected and any legal requirements.

Order and financial records. We keep the information needed for accounting, taxation, returns and disputes. Company tax records generally need to be retained for six years from the end of the relevant financial year, and longer in certain circumstances.

Enquiries and correspondence. We consider whether the enquiry is resolved, whether an ongoing relationship exists, and whether records are needed for a complaint or legal claim.

Marketing records. We retain subscription information while it is needed to manage the mailing list, and a limited suppression record where necessary to honour an unsubscribe request.

Website and engagement information. Retention depends on the purpose, the relevant service’s settings and whether identifiable information is still necessary.

Legal matters. Relevant records may need to be retained for longer where a dispute, investigation or legal obligation requires it.

These reasons do not justify retaining every item of personal information indefinitely. Information should be deleted or anonymised when it is no longer needed.

Security

We use technical and organisational measures appropriate to the information and the risks involved, including access controls and the security features of our service providers.

No website, email service or storage system can be guaranteed completely secure. Please do not send payment-card details or unnecessary sensitive information by email.

Your rights

Depending on the circumstances and applicable law, you may have the following rights.

Access. You can ask for access to your personal information and receive a copy.

Correction. You can ask us to correct inaccurate or incomplete information.

Deletion. You can request that personal information is deleted in appropriate circumstances.

Restriction. You can ask us to restrict how information is used in appropriate circumstances.

Portability. You can request certain information in a portable format.

Withdrawal of consent. You can withdraw consent where processing relies on it.

Objection. You can object to processing based on legitimate interests.

Automated decisions. You may have rights to challenge certain decisions made solely by automated means that have legal or similarly significant effects.

You can object to the use of your information for direct marketing at any time.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Some information may still need to be retained for another lawful reason, such as tax obligations.

To make a request, email shop@urbangood.org. We may need information to confirm your identity. We normally respond within one month, subject to any extension or other adjustment permitted by law, which we will explain where applicable.

Complaints

Please contact us if you are concerned about how we have handled your information. We will acknowledge a privacy complaint within 30 days, investigate it and respond without undue delay.

You also have the right to make a complaint to the UK Information Commissioner’s Office.

If you live elsewhere, you may also have the right to complain to your local data protection authority.

Changes to this policy

We may update this policy when our services, providers or legal requirements change. The date at the top shows when it was last updated. Where a change requires additional notice or fresh consent, we will take the appropriate steps.