Privacy Policy
Last updated: 2 September 2026
Who we are
This website is operated by Genuine Case Company Limited, trading as JCB Phone, a company registered in England and Wales under company number 12199129. Our registered office is at Southlands, Wybunbury Lane, Stapeley, Nantwich, Cheshire, CW5 7HH.
We are the data controller for the personal information described in this policy. That means we decide why and how your information is used, and we are responsible for looking after it.
We are registered with the Information Commissioner's Office under registration number 1847772.
If you have any questions about this policy or about how we handle your information, contact us at support@jcbphone.com or write to us at the address above.
What this policy covers
This policy explains what information we collect when you visit our website or buy from us, why we collect it, who we share it with, how long we keep it, and what rights you have. It applies to jcbphone.com and to any orders placed through it.
It does not cover other websites we link to. If you follow a link away from our site, that site will have its own privacy policy and we are not responsible for it.
The information we collect
When you place an order, we collect your name, billing address, delivery address, email address, telephone number, and the details of what you have bought. We also collect information about how the order was paid for, though not your full card number (see “Payments” below).
When you create an account, we collect your name, email address and password, together with any addresses or order history you choose to save.
When you contact us about an order, a return, a warranty claim or anything else, we keep a record of the correspondence and of what was agreed.
When you sign up for marketing, we record your email address and the fact that you consented, along with the date and how you gave that consent. We are required to be able to demonstrate that consent was given.
When you use the website, we collect technical information automatically, including your IP address, browser type and version, device type, and the pages you visited. Some of this is collected through cookies. Our use of cookies is described in the separate section below.
We do not knowingly collect information from anyone under 16. If you believe a child has provided us with personal information, please contact us and we will delete it.
Payments
Our shop runs on Shopify, and payments are taken through Shopify Payments, PayPal, Klarna, Shop Pay, Apple Pay and Google Pay. When you pay, your card details go directly to the payment provider. They are not stored on our systems and we never see the full card number or the security code.
What we do see, and keep, is the last four digits of the card, the card type and the expiry date. We use this to match payments to orders, to refund the right card, and as part of our checks on suspicious orders.
The payment providers also use your information for their own purposes where the law requires it, for example identity, anti-money-laundering and sanctions checks. When they do that, they are acting on their own account rather than on our instructions, and their own privacy notices apply. You can read Shopify's at shopify.com/legal/privacy, PayPal's at paypal.com, and Klarna's at klarna.com.
Shopify holds Level 1 PCI DSS certification for the card data it handles. We follow the requirements that apply to us as a merchant.
Why we use your information, and our legal basis for doing so
Data protection law requires us to have a valid reason for using your personal information. The table below sets out what we use it for and which reason applies.
| What we use it for | Legal basis |
|---|---|
| Taking and fulfilling your order, arranging delivery, and handling returns and warranty claims | Performance of our contract with you |
| Managing your account | Performance of our contract with you |
| Answering your questions and dealing with complaints | Performance of our contract with you, or our legitimate interest in running a responsive business where no contract exists yet |
| Checking orders for signs of fraud | Our legitimate interest in preventing fraud and protecting our customers and our business |
| Keeping records of sales and VAT | Compliance with a legal obligation |
| Sending marketing emails about our products and offers | Your consent, or the “soft opt-in” described below |
| Inviting you to review your purchase | Your consent, or the “soft opt-in” described below |
| Understanding how the website is used and improving it | Your consent, given through our cookie banner |
| Establishing, exercising or defending legal claims | Our legitimate interest in protecting our legal position |
Where we rely on legitimate interests, we have considered whether our interest is outweighed by the effect on you. You can ask us for more detail on that assessment, and you have the right to object (see “Your rights”).
Marketing
We will send you marketing emails if you have asked us to, or if you have bought something from us and we told you at the time that we would send you information about similar products. In the second case, you were given the chance to opt out when you ordered.
Every marketing email we send includes an unsubscribe link. You can also email us at support@jcbphone.com and ask to be removed. We will act on that request without delay, and there is no cost to you.
Unsubscribing from marketing does not stop us sending you emails about an order you have placed, such as dispatch confirmations or responses to a query, because we need to send those to fulfil the contract.
Review invitations
After you have bought from us we may email you to ask for a review, through REVIEWS.io or Trustpilot. You can opt out of these in the same way as any other marketing email, using the unsubscribe link or by contacting us. If you choose to leave a review, the review platform will hold what you write and any account you create with them under its own privacy notice.
Who we share your information with
We do not sell your information, and we do not share it with third parties for their own marketing.
Suppliers who act on our instructions. These companies only use your information to do a job for us, and are bound by written contracts requiring them to keep it secure and use it for nothing else.
- Shopify, who provide the platform our shop runs on. Shopify hosts the website, stores our order and customer records, processes payments, and powers our live chat through Shopify Inbox. For customers in the UK and Europe, this is handled in the first instance by Shopify International Limited in Ireland. Shopify's own subprocessor list is published at help.shopify.com.
- REVIEWS.io, who send review invitations on our behalf and host the reviews on our product pages. They receive your name, email address and what you ordered.
- Google, who provide Google Analytics, where you have consented to analytics cookies.
- Royal Mail, who deliver your order and collect returns.
- Our accountants, where they need access to do their work for us.
Companies that decide for themselves how they use your information. Some of the services on our site are run by organisations that act on their own account, not on our instructions. We pass information to them, but from that point their own privacy notices govern what happens to it, and any questions about their use of your information are best directed to them.
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A.), if you pay by PayPal. Their notice is at paypal.com.
- Klarna (Klarna Bank AB), if you choose to pay with Klarna. Klarna carries out its own identity and affordability checks in order to decide whether to offer you credit, which may involve a search with a credit reference agency. Their notice is at klarna.com.
- Meta (Meta Platforms Ireland Limited), who operate Facebook and Instagram. If you consent to marketing cookies, our advertising tools send Meta information about your visit so that we can measure our advertising and reach people with similar interests. For that collection, we and Meta are jointly responsible, and Meta then uses the information for its own purposes under its own terms.
- Google (Google Ireland Limited) in respect of Google Ads, on the same basis as Meta above, where you have consented to marketing cookies.
- Trustpilot (Trustpilot A/S), who host reviews of our business. When we invite you to review us, we send Trustpilot your name, email address and order reference. Trustpilot runs the review platform as an independent business and controls what happens to the review you write and the account you create with them.
We will also disclose information where we are legally required to, for example to HMRC, to a regulator, to the police in response to a lawful request, or to a court. And if the business is ever sold or transferred, customer information would form part of what transfers, in which case we would tell you.
Shopify's own use of your information
Separately from the work Shopify does for us, Shopify uses information about orders placed across its merchants, including ours, to develop its own analytics, personalisation and advertising services. For that use, Shopify decides what happens to the information rather than following our instructions, and its own consumer privacy policy applies. You can ask Shopify directly to stop this or to delete your information through Shopify's privacy portal, and you can also ask us and we will pass the request on.
If you choose to pay with Shop Pay, you enter into a direct relationship with Shopify for that service, and Shopify handles the information you give it under its own privacy policy.
Sending information outside the UK
Some of your information is accessed or processed outside the United Kingdom. Shopify stores European and UK customer data at rest in Europe, but it operates globally and moves data between regions in order to run the service, so processing outside the UK does happen. Other suppliers we use may do the same.
Where that happens, the transfer is covered by one of the safeguards allowed under UK data protection law. That is either a finding of adequacy by the UK government for the country concerned, or the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Shopify's data processing addendum includes those clauses, and requires the same of the subprocessors it uses.
You can ask us which safeguard applies to any particular supplier and we will tell you.
How long we keep it
We do not keep personal information for longer than we need it.
Order and transaction records are kept for six years from the end of the financial year in which the order was placed, because HMRC requires us to retain records for that period. Account details are kept for as long as your account is open, and for 24 months afterwards if you close it or stop using it. Correspondence about an order, return or complaint is kept for 24 months after the matter is closed. Marketing records are kept until you unsubscribe, and we keep a note of the unsubscribe itself so that we do not contact you again by mistake. Website analytics data is kept for 14 months.
Where information is no longer needed, we delete it or anonymise it so that it can no longer be linked to you.
How we keep it secure
We use access controls, encryption in transit, and restricted permissions so that staff and suppliers only see the information they need to do their job. The website runs on Shopify's infrastructure, which provides the underlying security of the platform and the servers, and which is independently audited.
No system can be guaranteed completely secure, and we would rather say that plainly than claim otherwise. What we can tell you is that we take security seriously, we review it, and if there were ever a breach affecting your rights we would report it to the Information Commissioner's Office and, where required, tell you directly.
Cookies
Cookies are small files placed on your device when you visit a website. We use them for three purposes.
Strictly necessary cookies make the site work. They remember what is in your basket, keep you logged in, and secure the checkout. The site cannot function without them, so they are set automatically and do not require your consent.
Analytics cookies tell us how many people visit, which pages they look at, and where they run into problems. We only set these if you agree.
Marketing cookies are set by Meta, for Facebook and Instagram advertising, and by Google Ads. They let us measure whether our advertising works and show our products to people who have shown an interest. We only set these if you agree.
Some of the strictly necessary cookies are set by Shopify itself to run the basket, the session and the checkout.
You are asked to choose when you first visit the site, and you can change your choice at any time using the Cookie preferences link in the site footer. You can also block or delete cookies through your browser settings, though the site may not work properly if you block the strictly necessary ones.
Your rights
Under UK data protection law you have the following rights.
You can ask us for a copy of the personal information we hold about you. We will respond within one month, and we will not charge you for it.
You can ask us to correct information that is wrong or incomplete.
You can ask us to delete information where we no longer have a good reason to keep it. This does not extend to records we are legally required to keep, such as transaction records for HMRC.
You can ask us to restrict how we use your information while a dispute about its accuracy or our use of it is being resolved.
You can object to us using your information where we are relying on legitimate interests. If you object to marketing, we will stop, without exception. If you object to another use, we will stop unless we can show compelling grounds to continue.
You can ask us to transfer your information to you or to another provider in a common, machine-readable format, where we hold it on the basis of your consent or your contract with us.
You can withdraw consent at any time where we relied on it. That does not affect anything we did before you withdrew it.
To exercise any of these rights, email support@jcbphone.com. We may ask you to confirm your identity before we act, so that we do not disclose your information to someone else.
Complaints
If you are unhappy with how we have handled your information, please tell us first at support@jcbphone.com. We would rather have the chance to put it right.
You also have the right to complain to the Information Commissioner's Office, which regulates data protection in the UK. You can reach them at ico.org.uk, on 0303 123 1113, or at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Complaining to us first does not affect your right to go to them.
Changes to this policy
We update this policy when our practices change or when the law does. The date at the top shows when it was last revised. If we make a change that materially affects how we use your information, we will tell you directly rather than relying on you to notice.