8. How to exercise your rights
How to exercise your rights How to exercise your rights
You may submit a rights request by contacting us at:
Email: dpo@ctshirts.co.uk
Verification: We may need to verify your identity before processing a request.
Authorized agents may submit requests on your behalf in states where permitted.
9. Children’s privacy
Our services are not directed to children under 16, and we do not knowingly collect personal information from them. If we learn that information has been collected in error, we will delete it.
10. Data security
We use appropriate technical and organizational measures to protect personal information, including encryption, access controls, secure systems, and staff training. No system is completely secure, but we work to safeguard your data.
11. Data retention
We keep personal information for 7 years, unless a longer period is required by law or necessary to protect our business, prevent fraud, or resolve disputes. When information is no longer needed, we delete or de-identify it.
12. International data transfers
As a UK-based company, we may transfer your information to the United Kingdom or other countries. When we do, we use legally recognized safeguards, such as:
- Standard Contractual Clauses (SCCs)
- Appropriate administrative, technical, and organizational measures
13. SMS / Text Messaging
When you opt in to receive SMS / text messages from us, we will collect your phone number and any other information you voluntarily provide. Charles Tyrwhitt does not sell or share your phone number with third-parties for marketing/promotional purposes. All the above categories in Section 4 exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties. You can opt-out of receiving text messages from us at any time.
14. Your Privacy Rights and Choices
Privacy Rights
Certain U.S. privacy laws require that we disclose to you the privacy rights that you have regarding personal information. We have defined the various privacy rights below.
- Know: You may have the right to know what personal information is being collected, used, shared, and sold about you, including the categories, sources, and business purposes for collecting your personal information.
- Access: You may have the right to request access to your personal information.
- Erase, Delete: You may have the right to request that we delete or erase your personal information if we do not have a legal or business reason to keep it.
- Correct: You may have the right to correct inaccurate personal information we have about you.
- Data Portability: You may have the right to obtain personal information in a portable and readily usable format.
- Request the transfer of your personal information to you or to a third party in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided for us to use or where we used the information to perform a contract with you.
- Opt Out of Sale or Sharing: You may have the right to ask us not to share or sell your personal information or use it for purposes of targeted advertising or profiling.
- Limit Processing of Sensitive personal information: Sensitive personal information includes your Social Security number, driver’s license number, state ID card, passport number, precise geolocation, racial or ethnic origin, union membership, and health and genetic data. You may have the right to ask us to limit our use of your Sensitive personal information to only what is required to accomplish the purposes we included in this Privacy Notice or that you reasonably expect from us. Our practice is to not process your Sensitive personal information except when it is necessary to accomplish the purposes disclosed in this Notice.
- Non-Retaliation for Exercising Privacy Rights: You also may have the right not to receive discriminatory treatment for the exercise of any of the privacy rights conferred by applicable law.
- Right to Appeal: If we decline to take action regarding your request to exercise any privacy right, you may have the right to appeal the decision.
Making Privacy Requests
How to Make a Request: If you would like to make a request, you may submit a request to exercise a privacy right in any of the following ways:
Once the request has been received, you may be asked to provide additional personal information for verification purposes before your request can be accommodated, including your full name, email address, telephone number, billing address, previous purchase history and order information.
Responding to Requests: Your request will be evaluated to determine whether the requested change meets legal regulatory requirements and does not risk making our other data less secure or changing our other data. If we are not able to honor any part of your request, we will tell you that in our response, as well as the reason(s) we cannot do so.
Response Timeline: We will respond to your request within 45 days of receiving it. If we need more time (up to an additional 45 days), we will notify you in writing.
Verifying Your Identity: In order for us to look into your request, we may first need to verify your identity, meaning that we need to make sure that you are the consumer we may have collected personal information about or a person who has been duly authorized to make the request on behalf of the consumer. For example, if you make a request, we will ask you to confirm your name and email address. For certain requests, we will use a combination of your email address, name, and/or zip code to verify your identity, so that we can help protect your information.
Appealing a Denied Request: If we deny all or part of your privacy request, you may have a right to appeal that decision. If you would like to make an appeal, please contact us using the methods described in this section, and include your name, email address, physical address, the type of request you made, and the reason for requesting an appeal.
Requests by Authorized Agents: You may have the right to designate someone else make privacy requests for you under the data protection laws. Authorized agents must:
- Provide us with valid written authorization, that the third party agent has the authority to act on behalf of the individual whom they are making the request, which must include the agent’s name, email address, and phone number,
- You must follow the instructions above to verify your own identity, and
- The authorized agent must follow the instructions provided in this section to make a request.
As permitted by California privacy law, any request you submit to us is subject to an identification and verification process, and confirmation of the agent’s authority, which may include attestation under penalty of perjury. Absent a power of attorney, we will also require the consumer to verify their own identity. We may verify identity based on matching information you provided with data we have maintained on you in our systems. This data could include, but is not limited to, email address, mailing address, or phone number. We reserve the right to verify the validity of any third party request to exercise privacy rights on behalf of our customers to the fullest extent permitted under applicable data protection law
15. Changes to this Privacy Notice
We may update this Privacy Notice from time to time. The “Last updated” date will be shown at the bottom of this page. Material changes will be communicated where appropriate.
Last updated: 10th August 2026
Exercising Access, Deletion and Opt Out Rights
To exercise the access and deletion rights described above, please submit a verifiable consumer request to us by either:
- Calling us on: 1866 797 2701
- Emailing us at: dpo@ctshirts.co.uk
To exercise your right to Opt out:
SUBMIT REQUEST TO OPT OUT OF SALE TO MARKETING AND PROMOTIONAL PARTNERS
Opt out of campaigns and programs that require the sale or disclosure of information to our partners
