Last updated 30 September 2026
This policy explains what personal information No Favors collects through this website, why, who we share it with and the rights you have over it. We only collect what we need, we never sell it, and we don’t use advertising or tracking cookies.
Who we are
No Favors is a rock band based in Stoke-on-Trent, England. We run this website and our merch shop, and we’re the “controller” of the personal information described here under UK data protection law (the UK GDPR and the Data Protection Act 2018).
To get in touch with No Favors about anything in this document, message us through our social media pages.
What we collect and why
Our mailing list
If you join the mailing list we keep your email address and when you signed up, and use it only to send you news about the band: new music, tour dates and merch. We do this with your consent. You can withdraw it at any time: just message us through our social media pages and we’ll take you off the list. We keep your address until you unsubscribe.
Merch orders
When you buy from the shop we collect your name, email address, delivery address, phone number (if you give one) and what you ordered. You enter your payment and address details on the secure checkout page run by our payment provider, Stripe, which passes us your name, address and the result of the payment. We never see or store your full card details.
We use this to take payment, pack and send your order, email you about it (confirmation, dispatch and tracking) and deal with any returns or refunds. We need it to carry out our contract with you. We keep order records for six years after the order, because the law requires us to keep financial records for that long.
Customer accounts
An account is optional. If you create one we keep your email address, name, phone number (if you give one) and your password, stored only as a secure one-way hash that nobody can read back, so you can see your orders and check out faster. We keep your account until you delete it, which you can do yourself in your account settings. Deleting your account doesn’t delete past order records, which we still have to keep as explained above.
Keeping the site secure
When someone tries to sign in we briefly record the email address used and the time, so we can slow down anyone trying to guess passwords. We also keep a log of the emails we send about orders (who to, the subject and whether it was delivered) so we can sort out problems. This is in our legitimate interests in keeping accounts and orders safe. Our hosting provider also keeps short-lived technical logs, such as IP addresses, to run and protect the site.
When you contact us
If you email us, we’ll use what you send to reply, and keep it for as long as we need to deal with your message.
Cookies
We only use cookies that the site needs to work, so we don’t ask for consent to them. We don’t use analytics, advertising or social media tracking cookies.
| Cookie | What it’s for | How long it lasts |
|---|---|---|
nf_cart | Remembers what’s in your basket. | 60 days |
nf_customer | Keeps you signed in to your account, if you have one. | 90 days, or until you sign out |
nf_session | Keeps band members signed in to the admin area. Never set for visitors. | 30 days, or until they sign out |
Videos on the site come from YouTube’s privacy-enhanced mode and don’t load anything until you press play. Once you do, YouTube (Google) may set its own cookies, under Google’s privacy policy. Stripe’s checkout page also uses its own cookies to process payments and prevent fraud.
Who we share it with
We only share your information with companies that help us run the site and the shop, and only what they need to do that:
- Stripe processes payments and refunds.
- Resend sends our order emails.
- Vercel hosts the website and its files.
- Prisma hosts our database.
- Royal Mail or another delivery company receives your name and address so they can deliver your order.
We may also share information if the law requires it, for example with HM Revenue & Customs. We never sell your personal information or share it for marketing.
Information sent outside the UK
Some of these providers store or process data in the European Union or the United States. When that happens, the transfer is protected by UK adequacy regulations (including the UK–US data bridge) or by the UK’s approved contract terms for international transfers.
Your rights
You have the right to:
- get a copy of the personal information we hold about you
- have anything inaccurate corrected
- have your information deleted, where we don’t need to keep it by law
- ask us to limit how we use it, or object to how we use it
- get your information in a format you can take elsewhere
- withdraw your consent at any time, where we rely on it (such as the mailing list)
To use any of these rights, message us through our social media pages. It’s free, and we’ll reply within one month. You can update your details or delete your account yourself at any time from your account page.
Complaints
If you’re unhappy with how we’ve handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.
Children
This site isn’t aimed at children under 13, and we don’t knowingly collect their information. Orders must be placed by someone aged 18 or over.
Changes to this policy
We’ll update this page if anything changes, and change the date at the top when we do. If the changes are significant, we’ll let customers and mailing list subscribers know.