THE SHORT VERSION
- We only collect what we need to deliver your order and run your hill bagger account.
- We never sell your data. We only use analytics and advertising cookies if you accept them, and you can change your mind at any time.
- We don't send marketing emails.
- You can ask to see or delete your data at any time.
Who we are
summited apparel ltd (company number 17514421, registered office Upton Caldbeck, Wigton, Cumbria, CA7 8EU) is responsible for your personal information under UK data protection law. Questions or requests go to hello@summited.co.uk.
What we collect and why
| WHAT | WHY | HOW LONG |
|---|---|---|
| Orders: your name, email address, delivery and billing addresses, and what you bought. Stripe collects your card details; we never see them. | To take payment, make and deliver your order, send tracking updates and handle returns. (Needed for our contract with you.) | 6 years, because tax law requires us to keep sales records. |
| Hill bagger account: your email address, name, password (Google Firebase stores it in scrambled form, so nobody can read it) or Google sign-in, two-step verification settings, and the hills you've ticked off with dates. | To run your account and keep your climbing record. (Needed for our contract with you.) | Until you delete your account. Deleting it removes your record straight away. |
| Optional summit register: a public display name you choose and the climb date, if supplied, for each climb you explicitly choose to share. | To display your entry to anyone visiting that hill's public register. (Your consent, separately for each climb.) Your email and other private climbs are not published. | Until you remove the public entry, make that climb private, untick the climb, or delete your account. |
| Emails you send us. | To reply and help you. (Our legitimate interest in running the business.) | Up to 2 years, or 6 years if they relate to an order. |
| Technical information such as IP addresses, in our hosting providers' security logs. | To keep the site secure and working. (Our legitimate interest.) | Usually 30 days. |
If you buy while signed in, we link the order to your account so you can see your items, order status and parcel tracking. If you buy as a guest, you can use the link in your order email to link that order after signing in or creating an account and verifying the same email address used at checkout. Deleting your account removes your hill tally and account access, but we retain order records for the period above.
Your existing and new hill-bagger records stay private unless you choose to share a particular climb. You can withdraw that choice in the hill's summit register without losing your private tally. Public entries can be viewed and copied by others, so use a nickname if you prefer. To report an entry or request help removing information, email hello@summited.co.uk. Instagram links only open Instagram when you follow them; we do not automatically import or embed Instagram posts.
Who we share it with
We only share what each service needs to do its job, and they may only use it for that job. We never sell your data.
- Stripe processes payments and checks for fraud.
- Inkthreadable (clothing and accessories) and Prodigi (posters) print your order. They receive your name, delivery address and email address, and pass your name and address to Royal Mail or a courier for delivery.
- Google Firebase hosts the site, runs hill bagger accounts and stores orders and climbing records. Our database is in London.
- Resend sends our order and tracking emails.
- Google Fonts supplies the site's typefaces, so your browser sends your IP address to Google when loading them.
- Google Analytics, Meta (Instagram and Facebook) and TikTok, only if you accept cookies. See Cookies and browser storage.
Some of these companies are based in, or use servers in, the United States. Where your data leaves the UK, it's protected by the UK–US data bridge or the UK's standard data transfer agreements.
We may also share information if the law requires it, for example with HMRC.
Cookies and browser storage
The site stores what's strictly necessary for the features you use. These don't need your consent:
| WHAT | WHAT IT DOES |
|---|---|
summited-bag (local storage) | Remembers what's in your bag on this device. It's never sent to us until you check out. |
| Firebase sign-in (IndexedDB) | Keeps you signed in to the hill bagger. Signing out removes it. |
| Stripe and Google cookies | Set by Stripe on its checkout page to process payments and prevent fraud, and by Google if you sign in with Google. See Stripe's and Google's policies. |
You can clear these at any time in your browser settings. The bag will empty and you'll be signed out.
Optional analytics and advertising cookies
If we ask and you choose Accept, we also use the services below to see how people find and use Summited and to measure whether our adverts lead to sales. Nothing loads if you choose Reject or don't choose. Your choice is saved in your browser as summited-consent. You can change it at any time using Cookie settings at the bottom of every page.
| WHO | WHAT THEY RECEIVE |
|---|---|
| Google Analytics | Pages you visit, how you arrived (for example from a search or an advert), your device and approximate location, and anonymous shop events such as viewing a poster, adding to your bag and the value of a completed order. See how Google uses this. |
| Meta pixel (Instagram and Facebook) | The same page and shop events, so Meta can measure our adverts and show them to people likely to be interested. Meta may link this to your Instagram or Facebook account. See Meta's privacy policy. |
| TikTok pixel | The same page and shop events, for the same purpose. See TikTok's privacy policy. |
We never send these services your name, email address, delivery address or payment details. These cookies usually last between 3 months and 2 years.
Your rights
You have the right to:
- get a copy of the personal information we hold about you
- have it corrected if it's wrong
- have it deleted, unless we have to keep it (for example, order records for tax)
- object to or restrict how we use it
- receive it in a format you can take elsewhere
Email hello@summited.co.uk and we'll reply within a month. You can delete your hill bagger account yourself at any time from the hill bagger.
If you're unhappy with how we've handled your information, please tell us. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
Our site isn't aimed at children, and you need to be 13 or over to create a hill bagger account.
Changes
If we change how we use your information, we'll update this page and the date at the top. If the change is significant, we'll also email account holders.