Last updated: 5 September 2026
1. Who is responsible for your data
Humax Global Ltd (company number 14920614, registered at 71-75 Shelton Street, Covent Garden, London, United Kingdom), trading as Echoed, is the data controller. Contact us about data protection at info@echoedleather.com.
ICO registration: to be confirmed. Registration with the UK Information Commissioner’s Office is required of most organisations processing personal data; we are confirming our position and will publish the number here.
2. What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Name, email, delivery and billing address, phone | To take payment, make and deliver your order, and contact you about it | Performance of a contract |
| Engraving text — often a person’s name or initials | To make the item you ordered | Performance of a contract |
| Order history | Customer service, returns, and our legal record-keeping | Contract and legal obligation |
| Payment details | Handled by our payment provider — we never see or store your full card details | Performance of a contract |
| Site usage and cookies | To keep the site working, and — only if you agree — to understand how it is used | Legitimate interests (essential) / consent (everything else) |
| Marketing email address | To send you things you asked to receive | Consent |
The engraving text deserves a specific mention: it is usually somebody’s name, sometimes not the buyer’s. We use it to make the item and to fulfil the order, and for nothing else.
3. Who we share it with
- Our own workshop, which makes the item — see section 4. We do not use a third-party manufacturer.
- Delivery carriers, to get the parcel to you
- Our payment provider, to take payment
- Our hosting and email providers, who process data on our instructions
- Authorities, where the law requires it
We do not sell your data.
4. Where your data goes
We make everything ourselves, in our own workshop in Türkiye. Your order is not sent to a third-party manufacturer. To make it — particularly an engraved one — your name, engraving text and delivery details are handled there.
The workshop is part of Humax Global Ltd itself, not a separate company. Under UK GDPR this means it is not a restricted transfer: those rules apply when personal data goes to a separate legal entity abroad, and sending data to your own overseas operation is not that. No Standard Contractual Clauses or International Data Transfer Agreement are required, and none would be possible — a company cannot contract with itself.
What does not change is our obligation to protect the data wherever it is handled. The same security standards, the same retention limits and the same rights described below apply to your information in the workshop exactly as they do here.
5. How long we keep it
- Order and transaction records: 6 years after the order, to meet UK tax and accounting requirements
- Engraving text: kept with the order record, so we can identify and remake an item under warranty
- Marketing consent: until you withdraw it
- Analytics: 14 months
6. Your rights
Under the UK GDPR and the EU GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Where we rely on consent, you can withdraw it at any time.
Email info@echoedleather.com. We respond within one month.
One practical limitation: once an engraved item is in production we cannot un-make it, and we must keep the order record for tax purposes even if you ask us to delete other data.
7. Complaints
If you are unhappy with how we have handled your data, tell us first. You can also complain to the UK Information Commissioner’s Office, or to the data protection authority in your EU country of residence.
8. Changes
We will post any changes here and update the date above.