Purchase Now

Privacy Policy

‌Effective Date: 17 October 2026‌

1. Introduction

This Privacy Policy is issued by THULE OUTDOOR LIMITED, whose registered and operating details are as follows:

  • Website: www.thuleoutdoorshop.com
  • Contact Email: bitwy@thuleoutdoorshop.com
  • Contact Address: Units 1-3 Two Counties Estate, Falconer Road, Haverhill, Suffolk, CB9 7XZ
  • Contact Telephone: +44 1440 762518

The purpose of this Privacy Policy is to provide full, transparent information about how we process your personal data in connection with your use of our website and all outdoor gear, equipment and accessory services we provide through this platform. We respect your privacy rights unreservedly, and are fully committed to protecting all personal data we process about you, in full compliance with the UK General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications Regulations (PECR), the Data (Use and Access) Act 2025, and all applicable UK and EEA information society service regulations that apply to our operations.

We place special emphasis on protecting the integrity of children online. We do not intentionally process personal data relating to any person under the age of 18, and we have designed our website features and data collection mechanisms to prevent the accidental capture of personal information from minors without verifiable parental consent. This document outlines in clear terms all categories of personal data we collect, the purposes for which we process that data, the legal bases that underpin our processing activities, how we share your data, your full rights over your personal information, and all the security measures we have implemented to keep your data safe.

2. Personal Data We Process, Processing Purposes and Legal Bases

We only collect personal data that is directly relevant to delivering a secure, seamless e-commerce shopping experience to you. We do not collect excessive or unrelated personal information, and all processing activities are tied to clearly defined legal bases under UK GDPR, in full alignment with the requirements of Articles 13 and 14 of UK GDPR.

2.1 Data Collected When You Browse Our Website

When you visit www.thuleoutdoorshop.com, we may collect and store information about your visit by placing non-intrusive cookies on your device. Cookies are small text files that our website or our trusted service providers transfer to your computer’s hard drive through your web browser, which enable us to recognise your browser, capture and remember your preferences, and optimise your browsing experience. The personal data we collect through cookies includes your Internet Protocol (IP) address, browser language setting, approximate geographical location data, anonymised demographic information, date and time of your visit, information about specific webpages you view, weblinks you click, and any other information you choose to input on our public website forms that are not tied to a registered account.

We process this category of browsing data on the legal basis of our legitimate interest (Article 6(1)(f) UK GDPR) to continuously improve our website performance, troubleshoot technical errors, and understand how visitors interact with our outdoor product range to refine our user experience design. For all non-essential cookies that are not strictly necessary for the operation of the website, we will only load these tracking tags after you have given your explicit, freely given consent, in full compliance with PECR requirements for cookie consent management.

2.2 Data Collected When You Create an Account or Place an Order

When you register for a user account on our platform, or proceed to complete a checkout process to purchase any of our products (including items priced at €38.00 as listed on our website), we collect the following personal data to fulfil your order and provide post-purchase support: your full name, billing and shipping addresses, valid email address, contact telephone number, payment card details or other payment method information, and order history including product specifications you have purchased, purchase dates, and order values.

The primary legal bases for processing this order-related data are:

  1. Performance of a contract (Article 6(1)(b) UK GDPR): All processing that is necessary to fulfil our contractual obligations to deliver the products you have ordered, process your payment, arrange shipping, and handle post-delivery returns, refunds or warranty claims.
  2. Compliance with our legal obligations (Article 6(1)(c) UK GDPR): Processing your payment records to meet UK tax, accounting and commercial record-keeping requirements.
  3. Legitimate interest (Article 6(1)(f) UK GDPR): Storing your order history in your account to help you track past purchases, initiate repeat orders easily, and access product warranty documentation without repeated verification of your identity.

2.3 Data Collected for Customer Support and Communication

When you contact our customer support team via email, telephone or our on-site contact form, we will collect the personal data you voluntarily provide to us, such as the details of your enquiry, your order reference number, and any additional information you share to help us resolve your issue effectively. We process this data on the legal basis of our legitimate interest to respond to your enquiries, resolve technical issues, and improve our overall customer service quality.

3. Marketing Consent and Electronic Communications Compliance

We adhere fully to all requirements under PECR that govern electronic marketing, to ensure we only send you marketing communications that you have explicitly agreed to receive:

  • For new prospects who have not previously made a purchase from our store, we will only send marketing emails, SMS or other electronic marketing messages if we have received your explicit, freely given consent. Pre-ticked opt-in boxes, bundled authorisation or vague, hidden consent clauses are never used to obtain marketing consent from our users. We maintain full, retrievable records of all consent you provide, so that we can demonstrate compliance if requested by you or the UK Information Commissioner’s Office (ICO).
  • For our existing customers, we operate within the soft opt-in provisions permitted under PECR: we may send you marketing communications about similar outdoor products, new gear launches and exclusive offers that are aligned with your past purchase history, only if we provided you with a clear, free opt-out option at the point of your original purchase.
  • All marketing SMS we send follow strict UK regulatory requirements: we use a clear, identifiable sender ID that displays our brand name THULE OUTDOOR LIMITED, rather than vague signatures such as “system notification” or “warm reminder”. Every marketing message includes a simple, no-cost opt-out instruction, such as “Reply STOP to unsubscribe”, and we process all unsubscribe requests immediately, stopping all marketing communications to your contact details without additional delay or barriers. We schedule all marketing communications to arrive at reasonable local hours, avoiding overnight and early morning windows to prevent disturbance, taking into account UK local time and relevant timezone differences to ensure our communications are not classified as nuisance messages.
  • Please note that non-marketing notification messages, including order confirmations, shipping updates, delivery verification SMS and account security verification codes, do not require your prior marketing consent. We will never embed any unrelated marketing content in these transactional notification messages.

4. Data Sharing and Data Recipients

We will never sell, rent or lease your personal data to unauthorised third parties for commercial purposes without your explicit separate consent. We only share your personal data with the following categories of trusted third parties, where such sharing is strictly necessary to deliver our services to you, and all these parties are bound by strict data protection agreements that require them to uphold the same level of data security as we do:

  1. Regulated payment service providers: We share your payment information with our PCI DSS compliant payment processors, solely for the purpose of processing your payment, verifying transaction legitimacy, and preventing fraud. We do not store full payment card details on our own on-premise servers at any time.
  2. Shipping and logistics partners: We share your shipping name, address and contact telephone number with our selected courier providers, for the exclusive purpose of arranging the successful delivery of the products you have ordered from us.
  3. Authorised legal and regulatory bodies: We may disclose your personal data if we are required to do so by law, pursuant to a valid court order, or as part of a formal investigation conducted by the ICO, the Competition and Markets Authority (CMA) or other relevant UK public authority, to comply with our legal obligations.
  4. Trusted cloud service and website technology providers: We may share limited anonymised or pseudonymised website browsing data with our website hosting providers, security service providers and analytics partners, to maintain the stable operation of our website, protect our platform against cyberattacks, and generate aggregated, non-personal performance reports.

5. Data Retention Periods

We will only retain your personal data for as long as it is strictly necessary to fulfil the specific purposes for which we originally collected it, in full compliance with UK GDPR and the Data (Use and Access) Act 2025 requirements:

  • We retain order-related personal data (including your name, shipping address, purchase records and payment transaction logs) for a period of 7 years after your last active order with us, to meet UK tax law requirements, handle potential warranty claims, and resolve any post-transaction disputes.
  • If you hold a registered user account on our website, we will retain all personal data associated with your account for as long as your account remains active. You may request to permanently delete your account at any time by contacting our data protection team at bitwy@thuleoutdoorshop.com.
  • We retain marketing consent records for as long as we continue to send you marketing communications, and for a further 12 months after you unsubscribe from our marketing lists, to demonstrate our compliance with PECR consent requirements.
  • Anonymised website browsing analytics data that can no longer be linked back to an identifiable individual is retained for a maximum period of 24 months, after which it is fully aggregated and cannot be associated with any specific user.

6. Your Data Subject Rights Under UK GDPR

Under UK data protection law, you hold a full set of legally enforceable rights over your personal data. You may exercise any of these rights at any time by sending a request to our data protection team using the contact details listed at the start of this Privacy Policy, and we will respond to your request within one calendar month, free of charge, in line with the mandatory complaint procedures added by the Data (Use and Access) Act 2025:

  1. ‌Right of Access‌: You can request a full copy of all personal data we hold about you, including a detailed explanation of all our processing activities related to your information.
  2. ‌Right to Rectification‌: If you believe any of the personal data we hold about you is inaccurate, incomplete or out of date, you may request us to correct that information immediately.
  3. ‌Right to Erasure (“Right to be Forgotten”)‌: You may request us to permanently delete all your personal data, in circumstances where there is no longer a legitimate legal reason for us to continue processing that information.
  4. ‌Right to Restriction of Processing‌: You can request us to temporarily suspend processing of your personal data, for example while we verify the accuracy of your data or assess the legitimacy of your erasure request.
  5. ‌Right to Data Portability‌: You can request us to provide all the personal data you have provided to us in a structured, machine-readable format, or transmit that data directly to another data controller you nominate, where technically feasible.
  6. ‌Right to Object‌: You may object to our processing of your personal data that is based on our legitimate interest, at any time. We will cease processing your data unless we can demonstrate compelling, legitimate grounds for the processing that override your rights and freedoms. You also have an absolute right to object to the processing of your personal data for direct marketing purposes, at no cost to you.
  7. ‌Right to Lodge a Complaint with the ICO‌: If you are not satisfied with how we have handled your personal data or your exercise of your rights, you have the right to submit a formal complaint directly to the Information Commissioner’s Office, the UK’s independent data protection regulatory authority.

7. Data Security Measures

We have implemented industry-leading, robust technical and organisational security measures to protect your personal data against unauthorised access, accidental loss, unlawful alteration, disclosure or destruction. All data transmitted between your browser and our website is secured by end-to-end TLS 1.3 encryption, and all personal data stored on our servers is encrypted at rest using AES-256 standards. Our internal staff are only granted access to your personal data on a strict need-to-know basis, and all our team members complete regular data protection compliance training. We maintain a formal data breach response plan, and we are required by UK GDPR law to report any personal data breach that poses a risk to individuals’ rights and freedoms to the ICO within 72 hours of becoming aware of the incident. In the event that a high-risk data breach is likely to cause substantial harm to you, we will notify you directly without undue delay, to advise you of protective steps you can take.

8. Amendments to this Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our business operations, new legal requirements introduced by relevant UK legislation, or updates to our data processing practices. When we make material changes to this policy, we will update the “Effective Date” at the top of this document, and publish a prominent notification on the homepage of www.thuleoutdoorshop.com before the new terms come into effect. We encourage you to review this Privacy Policy on a periodic basis to stay informed about how we protect your personal data.

9. Contact Information

If you have any questions, concerns or requests related to this Privacy Policy, or any aspect of how we process your personal data, you can contact our data protection team at any time using the following details:

  • Company Name: THULE OUTDOOR LIMITED
  • Postal Address: Units 1-3 Two Counties Estate, Falconer Road, Haverhill, Suffolk, CB9 7XZ
  • Email Address: bitwy@thuleoutdoorshop.com
  • Telephone Number: +44 1440 762518

We will respond to all legitimate data protection related enquiries promptly, in full alignment with our legal obligations under UK data protection law.