1. Who we are
Monichan is the trading name of MONICHAN LTD, a company registered in the United Kingdom under company number 17477686. We sell wetsuits, inflatable SUP boards, paddles, pumps, footwear, gloves, caps, dry bags, changing ponchos and bodyboards through monichan.uk.
MONICHAN LTD is the controller of the personal data described in this policy. Registered address: Office 10503 321-323 High Road, Chadwell Heath, Essex, United Kingdom, RM6 6AX.
For any privacy question or request, email [email protected] or call +44 7723 418905.
We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data we collect
When you place an order
- Full name, e-mail address and phone number.
- Delivery address, town or city and postcode.
- The products, sizes and quantities you order, order value, chosen payment method and any comment you add to the order.
- Order number, order date and delivery status.
When you ask us for fitting advice
To recommend a wetsuit size and thickness you may send us your height, weight and body measurements (chest, waist, hips, inside leg), along with where and when you usually get in the water. You choose what to share; we only use it to give you a size recommendation and to handle a related exchange.
When you email or call us
Your name, contact details and the content of our correspondence, including photos you send.
Warranty claims and returns
Order details, a description of the fault or reason for return, photos of the product and, where needed, the return delivery address and tracking number.
Payment data
Card and wallet details are entered directly with our payment provider. We do not receive or store full card numbers or security codes; we only receive confirmation of payment, the payment method type and, for cards, the last four digits.
Technical data
Like any website, our hosting provider receives your IP address, browser type and the pages requested in standard server logs. The basket on our site lives only in your browser's memory and is cleared when you close or reload the page.
3. Purposes and legal bases
| Purpose | Legal basis (UK GDPR Art. 6) |
|---|---|
| Processing and delivering your order, taking payment, sending order and dispatch emails | Contract |
| Handling returns, refunds, exchanges and warranty claims | Contract; legal obligation (Consumer Rights Act 2015, Consumer Contracts Regulations 2013) |
| Recommending a wetsuit size from your height, weight and measurements | Consent, and steps taken at your request before entering into a contract |
| Answering questions you send by email or phone | Legitimate interests (responding to customers); contract where it relates to an order |
| Keeping accounting and tax records | Legal obligation (Companies Act 2006, HMRC requirements) |
| Preventing fraud and keeping the website secure | Legitimate interests |
| Establishing or defending legal claims | Legitimate interests |
We do not send marketing emails unless you have opted in, and we do not use your data for automated decision-making or profiling that has legal or similarly significant effects.
4. Who we share data with
We do not sell personal data. We share it only with the following categories of recipients, and only as far as needed:
- Payment provider — processes card, Apple Pay and Google Pay payments. PayPal and Klarna act as independent controllers when you choose them and apply their own privacy notices; Klarna may run a credit check for pay-in-3.
- Courier and postal services — receive your name, delivery address, phone number and e-mail to deliver parcels and boards and send tracking updates.
- Email and IT service providers — host our mailbox, website and order records under contracts that require them to protect your data.
- Product suppliers — only for a warranty claim that needs the manufacturer's assessment: order date, product, fault description and photos, without your contact details unless direct contact is required.
- Professional advisers and authorities — accountants, insurers, legal advisers, HMRC or the police where the law requires or permits it.
5. International transfers
Some of our service providers, such as payment and email services, may process data outside the UK. Where that happens we make sure the transfer is covered by UK adequacy regulations or by appropriate safeguards such as the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguards used.
6. How long we keep data
- Order, payment and invoice records — 6 years from the end of the financial year of the order, as required for tax and accounting.
- Fitting measurements (height, weight, body measurements) — 12 months from your last message, unless you ask us to delete them earlier.
- Email correspondence not linked to an order — 2 years from the last message.
- Warranty claims and returns — 6 years from the date the claim is closed, the limitation period for consumer claims.
- Server logs — up to 30 days.
When the period ends, we delete or anonymise the data.
7. Security
Our website is served over an encrypted HTTPS connection. Access to order and customer records is limited to the people who need it to fulfil orders and answer you, accounts are protected with strong passwords and two-factor authentication, and our providers are bound by confidentiality and data protection terms. Card data never passes through our systems. If a personal data breach is likely to put you at risk, we will tell you and the ICO as the law requires.
8. Cookies
We do not use advertising, analytics or tracking cookies, and our site does not store your basket in cookies or browser storage. Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when the page opens; Google's own privacy policy applies to that request. Our payment provider may set strictly necessary cookies on its own payment page to complete and protect the payment.
9. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate or incomplete data corrected.
- Erasure — ask us to delete your data where there is no reason to keep it.
- Restriction — ask us to pause the use of your data in certain cases.
- Data portability — receive data you gave us in a structured, machine-readable format, or have it sent to another organisation.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on consent, such as fitting measurements.
To use any of these rights, email [email protected]. We reply within one month, may ask you to confirm your identity, and do not charge a fee unless a request is manifestly unfounded or excessive.
10. Withdrawing consent
You can withdraw consent at any time by emailing [email protected], for example to have your fitting measurements deleted. Withdrawing consent does not affect processing carried out before you withdrew it, or processing we carry out on another legal basis such as completing an order.
11. Complaints to the ICO
If you are unhappy with how we handle your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority: ico.org.uk, telephone 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
12. Children
Our shop is intended for adults. You must be 18 or over to place an order. Children's wetsuits and kit must be bought by a parent or guardian, and we do not knowingly collect personal data from anyone under 18. If you believe a child has sent us their data, contact us and we will delete it.
13. Changes to this policy
We may update this policy when our services or the law change. The date at the top of the page shows when it was last revised; significant changes affecting existing orders will be emailed to the customers concerned.
Last updated: 16 October 2026.