Privacy notice
How we use information when you order or contact us.
Policy version: 2 November 2026.
Who is responsible
MFL Satchel is the trading name of Omar Diallo-Ouedraogo, a UK sole trader. Business address: 14 Felbrigg Close, Luton, Bedfordshire, LU2 8UL, United Kingdom. For privacy enquiries or complaints, email hello@mflsatchel.com.
Information we use
We use your name, contact and billing details, purchases, licence choice, payment references, download records and correspondence. Technical information can include IP address, browser information and security logs. Please do not send pupil records or sensitive information when requesting support.
Why we use it
- Orders and downloads: to fulfil our contract, confirm payment, provide your purchased files and deal with order enquiries.
- Tax and accounting: to meet legal record-keeping duties.
- Security, fraud prevention and complaints: our legitimate interests in protecting the shop and resolving problems, balanced against your rights. Payment providers may make their own fraud checks; contact us if a payment is declined.
- Marketing: a purchase does not subscribe you. Any future newsletter signup will have its own clear choice and unsubscribe facility.
Billing details are needed to process purchases; without the required information we may be unable to accept an order. Free samples do not require newsletter signup. The shop is intended for adult purchasers; student-facing resources do not require us to collect pupils’ details.
Who receives information
Hostinger provides website hosting and the business mailbox. WooCommerce manages order records on the website. WooPayments, Automattic and Stripe process payment and fraud information. Their security integrations can include Sift fraud protection and hCaptcha bot protection, which analyse device and browser signals. We do not store full card numbers. If you choose a wallet or another payment method, its provider also processes information under its own notice. WP Mail SMTP sends transactional messages through the business mailbox. Authorised advisers or public authorities may receive relevant records where necessary. We do not sell customer details.
Provider information: Hostinger privacy notice, Automattic privacy notice and Stripe privacy notice.
Retention schedule
This schedule is applied through record reviews and available store controls. It does not mean all records are deleted automatically.
| Record | Retention |
|---|---|
| Paid/refunded orders, invoices and relevant licence/consent evidence | At least five years after the 31 January Self Assessment filing deadline for the relevant tax year. Keep longer only for a specific legal duty or unresolved dispute; review annually after that period. |
| Unpaid pending, failed or cancelled orders with no accounting or dispute need | 30 days, then remove unnecessary personal information. |
| Routine support enquiries unrelated to retained orders | 24 months after resolution, then delete or anonymise. |
| Customer accounts and download entitlements | Review after 24 months of inactivity; do not remove paid download access without checking obligations and notifying the customer where appropriate. Account deletion does not necessarily delete legally required order records. |
| Security logs and routine backups | Routine copies under our control are reviewed and removed within 90 days unless specific incident evidence or a legal duty requires longer. Hostinger makes website access/error logs available for up to 7 days and email access/delivery logs for 30 days; daily website backups are kept for 7 days and published guidance gives 6 weeks for weekly backups. These availability windows do not guarantee deletion of every provider-held copy: providers may keep underlying records longer for legal or security reasons under their privacy/data-processing terms. Historical recovery copies require a separate documented review. |
If an overseas tax scheme requires longer records, its period takes precedence for the records it covers. We must document that period before opening sales in that market. Deletion requests are checked against legal duties and paid access; a restored backup must not permanently reinstate information already marked for deletion.
International processing
Hosting, email and payment providers may process information outside the UK. Hostinger’s published data-processing terms include standard contractual clauses and a UK transfer addendum where applicable. Payment providers explain their international processing in their notices. Where UK transfer restrictions apply, an applicable adequacy arrangement or appropriate contractual safeguards are needed. Contact us for information about safeguards relevant to your data.
The website server is located in the United Kingdom and its hosting backups are stored in Germany. Hostinger states that Hostinger Mail mailboxes and their backups are stored in France or Germany and may move between those locations. Its published data-processing agreement sets out processor duties, subprocessors and transfer safeguards. Payment, support and content-delivery providers may also process information in other countries; the locations above do not mean every service is restricted to the UK or EEA. Provider information: Hostinger data-processing agreement and Hostinger storage locations.
Your rights and complaints
Depending on the circumstances, you can request access, correction, deletion, restriction or portability, object to processing based on legitimate interests, and withdraw consent for future processing. Contact hello@mflsatchel.com. We normally respond within one month; lawful extensions may apply and we may need to verify identity. Some records must be retained by law.
If you are unhappy with how we use your information, contact us first. You can also complain to the Information Commissioner’s Office or, where applicable, your local regulator.
Cookies and updates
See our cookie notice. This notice must reflect the services actually enabled when the shop opens.