Privacy policy

1. Who we are

KTS, trading as Thunder Sports ("we", "our", "us") runs this website and is the data controller for the personal data described here, under the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. We are committed to protecting your privacy.

Data controller: KTS, trading as Thunder Sports. 77 Main Street, Cavan, H12 R5Y3, +353 49 430 4104, katherine@kts.ie.

2. What we collect

There are no customer accounts on this site. We collect only what is needed to sell you something and look after you afterwards:

• Order data: your name, email address, phone number, delivery address and what you bought, entered on the secure checkout page.
• Enquiry data: your name, club, email address, phone number and message, when you ask for a club kit quote or write to us, and any photos of your crest or kit you send us to quote from.
• Emails: what you write to us by email, and our replies.
• Technical data: the address your browser connects from and the pages it asks for, in the ordinary logs of the server that hosts the site.
• Nothing about how you browse: this site has no analytics or advertising trackers.

3. Why, and the legal basis

• To take your payment, post your order and send you a receipt: performing the contract between us.
• To answer an enquiry or an email and put together a quote, including an automatic note that your enquiry has arrived: our legitimate interest in replying to someone who has written to us.
• To keep records of sales: our legal obligation under tax law.
• To keep the site secure and stop fraud and abuse: our legitimate interest in running a safe shop.
• To send you marketing: only with your consent, which you can withdraw at any time. We keep no marketing list unless you ask to join one.

4. Who else sees it

Some things we cannot do alone. These companies process data on our behalf, under contracts that limit them to that job. We do not sell your personal data to anyone.

• Stripe takes the payment and holds your card details on its own secure page. We never see your card number. Stripe also keeps the order record and emails the receipt.
• An Post delivers your order, so it receives your name, address and phone number.
• Railway hosts the website. Enquiries, and the shop's own notes on each order, are stored on its servers in the Netherlands.
• Zoho Mail hosts our email, on servers in the European Union. Order emails are sent through it, your emails to us are kept there, and a daily backup copy of the shop's records is sent to our own mailbox there.
• Anthropic's Claude reads the emails you send us and the enquiries made on this site, together with your orders with us, to sort them and suggest a reply. A person reads every suggested reply and decides what is sent; nothing is sent automatically. Anthropic does not use this data to train its models.

5. Partner clubs

When you buy gear from one of our partner clubs, the club earns store credit on the sale. The club is told how much it has earned, never your name or any of your details.

6. Transfers outside the EU

Stripe may process data in the United States. It does so under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses, which is what the GDPR requires for a transfer like that.

Anthropic processes the emails it reads for us in the United States, under the European Commission's standard contractual clauses.

7. How long we keep it

• Order records are kept for six years, because tax law requires it, and then deleted.
• Enquiries are kept while we are dealing with them and for two years after, in case you come back to the quote. An enquiry nobody has touched for two years is deleted automatically, with any photos sent with it.
• Emails are kept for as long as we need them to deal with you and your orders, and no longer than the six years order records are kept.
• The daily backup copies in our mailbox are deleted after 30 days.
• Server logs are kept for a short period for security and then discarded.

8. Your rights

You can ask to see the personal data we hold about you, have it corrected or erased, have its use restricted, object to how we use it, or receive it in a portable form. The full list, and how to ask, is on the your data rights page. We answer within one month.

9. Security

The site is served over HTTPS. Payment happens on Stripe's own certified systems. Enquiries and contact details sit behind a password only the shop holds. No system is perfectly secure, but we take appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure or destruction.

10. Contact us

For anything about your data, or to exercise a right: KTS, trading as Thunder Sports, 77 Main Street, Cavan, H12 R5Y3, +353 49 430 4104, katherine@kts.ie.

11. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Data Protection Commission, 6 Pembroke Row, Dublin 2, D02 X963, through the form at https://www.dataprotection.ie. Phone 01 765 0100 or 1800 437 437 for general information.

12. Changes

If this policy changes, the new version appears here with the date it took effect.