Privacy Notice
Updated: 12 September 2026
This notice explains what personal data HUMTTO collects when you use humtto.uk, why we collect it, who we share it with, and the rights you have under the UK GDPR. It covers this website only.
1. Who is responsible for your data
humtto.uk is operated by Quanzhou Humtto Outdoor Products Co., Ltd, which is the data controller for the personal data described here. You can reach us about anything in this notice at global@humtto.com.
2. What we collect and why
We only collect what the shop actually needs. We do not buy personal data from anyone else, and we do not build advertising profiles.
| Data | Why | Lawful basis | Kept for |
|---|---|---|---|
| Name, delivery address, email | To take payment, deliver your order and handle returns | Performance of a contract | 6 years from the order, to meet UK tax and accounting rules |
| Email and password (account holders) | To create and secure your account and show your order history | Performance of a contract | Until you ask us to delete the account |
| Order number and email (guest order tracking) | To let you look up an order you placed without an account | Performance of a contract | With the order |
| Email address for back-in-stock alerts | To tell you once when a size you wanted returns | Consent | Until we send the alert, or you ask us to remove it |
| Name, rating and review text | To publish reviews from verified purchasers | Consent | Until you ask us to remove the review |
| Marketing preference | To send news and offers only if you asked for them | Consent — the optional box when you create an account, recorded with the date | Until you unsubscribe |
| Name, email, subject and message (contact form) | To answer your question | Legitimate interest in replying to you | 2 years |
3. Payment details
We never see or store your card details. Payments are handled by our payment provider on their own systems; we receive only a confirmation that payment succeeded, plus the reference we need to issue a refund.
4. Cookies and browser storage
We do not use advertising cookies, and we do not track you across other websites, so there is no tracking to consent to. The site stores three things in your browser, all of them needed for it to work: your basket, your currency choice, and — if you sign in — your login token. Ticking “Keep me logged in” stores that token until you sign out; leaving it unticked clears it when you close the browser. You can delete all of it by clearing your browser’s site data.
We do measure how the site is used — which pages are visited and roughly where visitors come from — through Vercel Web Analytics. It sets no cookies, stores nothing on your device and does not identify you: we only ever see counts, never individuals. Our lawful basis is our legitimate interest in knowing whether the shop works.
5. Who we share data with
We share personal data only with the suppliers that run the shop, and only for that purpose. They act on our instructions and cannot use your data for their own ends.
- Supabase — database, accounts and file storage
- Vercel — website hosting and cookieless, aggregate visit counts
- Resend — sending order confirmations and back-in-stock alerts, and passing contact-form messages to our team
- Google — only if you choose to sign in with a Google account
- Our payment provider — taking payment and processing refunds
- Delivery carriers — your name and address, to deliver the order
Some of these suppliers process data outside the UK. Where they do, the transfer is covered by the UK International Data Transfer Addendum or an adequacy decision. We also disclose data where the law requires it.
6. Your rights
Under the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or stop how we use it, or send it to another provider. Where we rely on your consent — marketing, stock alerts, reviews — you can withdraw it at any time, and that does not affect anything done before you withdrew it.
Email global@humtto.com to make a request. We will respond within one month. To unsubscribe from marketing, use the link in any marketing email.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.
7. How we protect your data
Traffic to the site is encrypted. Passwords are hashed by our authentication provider and are never visible to us. Access to customer data is restricted to the accounts that need it, and database rules stop one customer from reading another’s orders or details. No system is perfectly secure, but if a breach put you at risk we would tell you and the ICO as the law requires.
8. Children
This shop is not intended for children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, email us and we will delete it.
9. Changes to this notice
We update this notice when the shop changes. The date at the top always shows the current version. If a change materially affects your rights we will tell you before it takes effect.