Privacy Policy

1. Who we are

Jiu Jitsu Brotherhood is owned and operated by Kingston Jiu Jitsu Ltd, a company registered in England and Wales under company number 11578178. Our registered office is 56 Staunton Road, Kingston upon Thames, Surrey, England, KT2 5TL.

For UK data protection law, Kingston Jiu Jitsu Ltd is the controller of the personal information described in this Policy.

This Policy explains how we collect, use, store and share personal information when you visit Jiu Jitsu Brotherhood, contact us, subscribe to email updates, leave a comment, or place a shop order.

2. Information we collect

Depending on how you use the website, we may collect:

Contact and identity information

• your name;
• email address;
• telephone number, where you provide one;
• the content of messages you send through the contact form;
• name, email address and comment text if you leave a comment; and
• communication preferences where you tell us them.

Shop orders are placed as guest checkout. The website does not currently offer a public customer login account. Staff authentication details are used only to operate and secure the administration of the website.

Order and transaction information

• billing and delivery details;
• products, variants and quantities ordered;
• order value and delivery method;
• payment status and transaction references;
• order, delivery, return and refund history; and
• communications about your order.

We do not store your full payment card number or card security code. Payments are processed by our payment provider.

Marketing information

• whether you have asked to receive email updates or a free guide;
• your consent record where consent is relied upon for electronic marketing;
• unsubscribe or preference information; and
• engagement information that MailerLite may record if open, click or similar tracking features are enabled in our MailerLite account. Whether those features are currently active has not been verified in the MailerLite dashboard for this Policy and should be treated as unverified until confirmed.

Website and technical information

• IP address and, for comments, a hashed form of the IP address and browser user-agent used for abuse prevention;
• browser, device and operating-system information;
• pages viewed and actions taken;
• referring website or campaign information;
• approximate location derived from technical information;
• security and diagnostic logs; and
• information collected through cookies or similar technologies, including the shopping basket cookie and your cookie-preference cookie.

Non-essential analytics or marketing technologies are loaded only after you give the required cookie consent. Strictly necessary technologies needed for the website, basket and checkout may be used without that consent.

3. How we obtain information

We obtain personal information:

• directly from you when you contact us, subscribe, leave a comment or place an order;
• automatically when you use the website, subject to your cookie choices where required;
• from payment, delivery, authentication and technical service providers where needed to operate the service; and
• from advertising or analytics services where those services are enabled and used in accordance with your cookie choices.

4. How we use personal information

We may use personal information to:

• respond to enquiries;
• process payments and orders;
• arrange delivery and collection;
• send order, payment, dispatch and customer-support communications;
• manage cancellations, returns, refunds and customer support;
• moderate comments and reduce spam or abuse;
• maintain tax, accounting and transaction records;
• protect the security and integrity of the website and prevent fraud;
• operate, troubleshoot and improve the website;
• measure website use where analytics are enabled and consented to;
• send marketing emails where you have consented (or where another lawful PECR permission clearly applies); and
• comply with legal and regulatory obligations or establish, exercise or defend legal claims.

We will not use order information to send unrelated direct marketing merely because you made a purchase.

5. Our lawful bases

We rely on one or more of the following lawful bases under the UK GDPR:

Contract

Processing is necessary to enter into or perform a contract with you, for example to process an order, take payment, arrange delivery or send order-related service messages.

Legitimate interests

We may process information where necessary for our legitimate interests or those of another person, provided those interests are not overridden by your rights. These interests include responding to enquiries, operating and securing the website, preventing fraud and abuse, keeping appropriate business records, and understanding how the website is used in aggregate where analytics are lawfully used.

Legal obligation

We process or retain information where necessary to comply with legal, tax, accounting, consumer-protection or regulatory requirements.

Consent

We rely on consent where required, including for most electronic marketing emails and for non-essential cookies or similar technologies. Cookie consent and marketing consent are separate. You may withdraw consent at any time without affecting earlier lawful processing.

Purpose	Typical lawful basis
Taking and fulfilling shop orders	Contract; legal obligation for accounting records
Payment processing via Mollie	Contract; Mollie may also act under its own legal duties
Contact-form enquiries	Legitimate interests (responding to your request)
Moderating comments and reducing abuse	Legitimate interests
Order, payment and dispatch emails	Contract
Email marketing and free-guide delivery	Consent (PECR / UK GDPR)
Non-essential analytics cookies	Consent
Non-essential advertising cookies or pixels	Consent (where enabled)
Security, fraud prevention and hosting logs	Legitimate interests; legal obligation where applicable

This table is a summary. The sections above explain the bases in more detail. This is not a substitute for legal advice.

6. Payments

Online payments are processed by Mollie. Payment data is sent securely to Mollie. We may retain associated information such as the order number, amount, payment status and Mollie transaction reference.

Mollie may process some information as an independent controller under its own legal obligations and privacy notice.

7. Service providers and sharing

We do not sell personal information.

We use third parties to help us operate Jiu Jitsu Brotherhood. The providers currently relevant to this website include:

• Mollie for payment processing;
• Vercel for hosting and application infrastructure;
• Supabase for database, staff authentication and backend services;
• Resend for transactional and contact-form email;
• MailerLite for email marketing, free-guide signup and related list management;
• delivery and fulfilment providers for physical orders;
• Google Analytics for consent-controlled website analytics where you allow analytics cookies;
• advertising platforms for consent-controlled measurement or marketing, only if those features are enabled in our tracking settings; and
• professional, accounting, legal or technical advisers where reasonably necessary.

Embedded third-party content, such as YouTube videos, may allow those providers to process technical information under their own terms when you choose to play that content. Videos on this site use a click-to-load embed so the YouTube player is not loaded until you press Play.

These organisations may act as processors on our behalf or, in some circumstances, as independent or joint controllers with their own legal responsibilities.

We may also share information where required by law, in connection with a business reorganisation, to establish or defend legal claims, or where reasonably necessary to protect the rights, property or safety of us, our customers or others.

8. Transactional communications

We may send emails necessary to provide a service you request, including order confirmations, payment updates, dispatch or delivery information, return and refund updates, and messages about an enquiry you sent us. These are service communications, not marketing.

9. Marketing

We send marketing emails and free-guide emails through MailerLite where you have given consent through the relevant signup form. Consent for marketing emails is separate from consent for analytics or advertising cookies.

You can unsubscribe using the link in a marketing email or by contacting us. You also have an unconditional right to object to direct marketing at any time. If you object, we will stop using your personal information for direct marketing. We may keep a limited suppression record so that we do not contact you again by mistake.

Unsubscribing from marketing, or objecting to direct marketing, will not prevent necessary service communications about an order or an enquiry you have made.

10. Retention

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected and to meet legal, tax, accounting and regulatory requirements.

Order and transaction records are generally retained for up to six years after the end of the relevant accounting period, or longer where required by law or reasonably necessary for legal claims. There is currently no automatic deletion of order records; retention and erasure requests are handled manually.

Contact-form messages are retained for as long as needed to respond and keep a reasonable support record. Comments are retained while published or while needed for moderation and abuse prevention. Marketing list records are retained until you unsubscribe or otherwise object, after which we may keep a suppression record. Technical logs and cookie records are retained for periods proportionate to security, diagnostics and your cookie choices.

When information is no longer required, we delete or anonymise it where appropriate.

11. International transfers

Some providers may process or store information outside the United Kingdom, including in the European Economic Area and other countries where those providers operate. Where personal information is transferred internationally, we take steps intended to ensure the transfer complies with UK data protection law, which may include recognised adequacy arrangements or contractual safeguards offered by the provider.

If you need more detail about a particular transfer, contact us using the details below.

12. Security

We use appropriate technical and organisational measures intended to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. Access to administrative systems and order information is restricted to authorised users.

No internet or electronic-storage system can be guaranteed completely secure, but we take reasonable measures appropriate to the information and risks involved.

13. Cookies and similar technologies

We use necessary technologies to provide and secure the website, including the shopping basket and cookie-preference tools. We may use optional analytics or marketing technologies only with the required consent. Google Analytics 4 is loaded only when you allow analytics cookies. You can accept, reject or customise optional categories, and change your choices later, through the cookie controls on the website. Embedded videos use a click-to-load YouTube player; playing a video may involve processing by YouTube under its own terms.

See our Cookie Policy for more information.

14. Your rights

Depending on the circumstances, UK data protection law may give you the right to:

• request access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to delete information in certain circumstances;
• ask us to restrict processing in certain circumstances;
• object to certain processing, including an unconditional right to object to processing for direct marketing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

Direct marketing: you may object to the use of your personal information for direct marketing at any time. This right is absolute. Contact us or use the unsubscribe link in a marketing email.

These rights are otherwise subject to legal conditions and exemptions. We may need to confirm your identity, and we may retain information despite a deletion request where the law requires or permits this. There is currently no self-service account-deletion portal because the shop uses guest checkout rather than public customer accounts; privacy requests are handled by contacting us.

We do not use solely automated decision-making that produces legal or similarly significant effects about you on this website. Payment providers may run their own fraud and security checks under their terms.

To exercise a right, contact us using the details below.

You may complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk. We would appreciate the opportunity to address your concern first.

15. Children

Jiu Jitsu Brotherhood is a general-interest content and retail website and is not intended to collect personal information directly from children. If you are under 18, a parent or guardian should place an order on your behalf.

If you believe that a child has provided personal information to us inappropriately, please contact us.

16. Third-party websites

The website may link to services operated by other organisations. We are not responsible for their privacy practices. Review their privacy information before providing personal information to them.

17. Changes to this Policy

We may update this Policy to reflect changes in our services, providers or legal obligations. We will publish the current version here and change the “Last updated” date where appropriate.

18. Contact us

Kingston Jiu Jitsu Ltd trading as Jiu Jitsu Brotherhood

Company number: 11578178

Registered office: 56 Staunton Road, Kingston upon Thames, Surrey, England, KT2 5TL

Email: admin@kingstonjiujitsu.com

Telephone: 07584 131335

---