Privacy Policy
Last updated: 20 August 2026
LCARS Workshop is a one-person shop. This policy explains what personal data I collect when you browse, buy merch, or download wallpapers, why I collect it, who I share it with, and what you can do about it. I have named every supplier rather than hiding behind categories like “fulfilment partners”, because you should be able to see exactly where your information goes.
If anything here is unclear, email me at and I will answer.
Who I am
I am Michael Overton, based in Surrey, United Kingdom, trading as LCARS Workshop. I am the data controller for the information described in this policy.
Contact:
I do not publish a street address, as I work from home. If you need it in writing, for a legal notice or a complaint, email me and I will provide it.
What I collect and why
If you contact me
Through the contact form, by email, or on social media.
What: your name, email address, and whatever you tell me in your message.
Why: to reply to you.
Lawful basis: legitimate interests, specifically responding to someone who has approached me. If your message is about an order, the basis is performance of our contract.
If you buy merch
T-shirts, prints and other physical products ordered through this site.
What: your name, email address, delivery address, what you ordered, and your order history. If you create an account, your login details too.
Why: to take payment, print and ship your order, send you order confirmations and shipping updates, handle returns, and keep the records I am required to keep for tax.
Lawful basis: performance of our contract, and legal obligation for the financial records.
I never see or store your card or PayPal login details. Payment happens entirely on PayPal’s side.
If you buy wallpapers
My digital wallpapers are sold and delivered through Gumroad. When you buy one, the checkout and download happen on Gumroad’s platform under . Gumroad shows me the order details — your email address and what you bought — so I can help with any download problems.
If you just visit the site
What: aggregated, anonymous statistics only. Pages viewed, referring site, rough country, device type.
Why: to see whether the site is working and what people look at.
Lawful basis: legitimate interests in understanding site performance.
I do not use Google Analytics. I do not run advertising pixels, Meta or Google tags, heatmaps, or session recording. Nothing on this site follows you around the internet.
My web server also keeps standard access logs, which include IP addresses, for security and troubleshooting.
I do not run a newsletter or a marketing list, and I do not buy or sell contact data.
Everyone I share your data with
These are all the third parties involved. Nobody else sees your data.
| Supplier | What they do | What they receive | Where |
|---|---|---|---|
| PayPal | Payment processing for merch orders | Your payment, handled entirely on their platform — I never see your card details | United States |
| Printful | Prints and ships merch orders | Your name, delivery address, email address, and the items ordered | United States, with fulfilment centres in the UK and EU |
| Gumroad | Sells and delivers my digital wallpapers | Your purchase happens on their platform; they share your email and order details with me | United States |
Sending data outside the UK
PayPal, Printful and Gumroad are US companies. Transfers to them are covered by the safeguards those suppliers have in place, typically the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework. Where Printful fulfils an order from its UK or EU facilities, your delivery details stay in those regions.
How long I keep things
- Enquiries that go nowhere: up to two years, in case you come back, then deleted.
- Orders, invoices and financial records: six years plus the current tax year, because HMRC requires it.
- Website analytics: aggregated and anonymous, retained indefinitely. Server logs are cleared periodically.
If you want your data gone sooner than the above, ask. Unless I am legally required to keep something, I will delete it.
Cookies
This site does not set tracking or advertising cookies. The shop sets a small number of strictly necessary cookies so your cart works and, if you have an account, so you can stay logged in. Because there is no tracking, there is no cookie banner. That is deliberate.
Security
The site runs over HTTPS. My devices are encrypted and password protected, credentials live in a password manager with two-factor authentication, and backups are encrypted and stored separately.
No system is perfect. If I ever suffer a breach that puts your rights at risk, I will tell you and the ICO without unnecessary delay.
Your rights
Under UK GDPR you can ask me to:
- give you a copy of the data I hold about you
- correct it if it is wrong
- delete it
- restrict or object to how I use it
- send it to you, or someone else, in a portable format
- stop relying on legitimate interests, where that is my basis
Email . There is no charge and I will respond within one month.
You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, though I would appreciate the chance to sort it out first.
Children
You need to be 18 or old enough to hold the payment method you use. I do not knowingly collect data about anyone under 18.
Changes
If I add or drop a supplier, this page gets updated, because the list above is meant to be exhaustive. The date at the top tells you when it last changed.