Privacy policy

Version control

This policy was last updated on 14^th October 2026.

The purpose of this Privacy Policy

Welcome to the Total Promotions Limited (trading as Total Clothing) privacy policy. We respect your privacy and are committed to protecting your personal data. This privacy notice aims to give you information on how we collect and process your personal data.

Total Promotions Limited is part of a group of companies that are managed through Banner Limited, the UK's largest wholesaler of school uniform. We provide uniform to over 100 schools via our store and/or our website. We take your privacy very seriously, and we are committed to protecting your personal data.

About us

Total Promotions Limited and Banner Limited are joint controllers of the personal information used to operate the Total Clothing customer account, ordering and group fulfilment services described in this notice. This means that we jointly determine why and how that information is used for those purposes.

In certain circumstance Banner Limited and Total Promotions Limited may also act as separate controllers of the personal information provided. Throughout this notice however we refer to both Banner Limited and Total Promotions Limited collectively as “Banner”, “we”, “us” or “our”. We have agreed our respective responsibilities for complying with data protection law, and you may exercise your rights against either company.

When you interact with us via our website or in one of our stores you give us information about yourself which we then use. This notice will tell you about the information that you give us and how we use it. If you’d like any more information, you can email us at privacy@banner.co.uk

Please be mindful that we often have links to other companies or schools on our website that are not part of our business or group. If you follow a link to one of these websites, please remember that they will have their own privacy information for you to review, and we’re not responsible for how they use your information.

What personal information do we collect about you?

Identity data such as first name, surname, and title. We also capture the name of the pupil that you’re shopping for and their year group.

Contact data such as email address, billing address, delivery address, telephone number and the school that your pupil attends.

Transactional data about the orders that you place with us such as basket number, order number, subtotal, title, currency, delivery address, number of items, product number, single item price, school, tax etc. We also store information about payments to and from you. We also store information about any communication or correspondence with you about your orders with us.

Financial data such as payment type. We don't hold any information about your bank or card details. This is stored within the payment gateway that we use. Please contact us using the details below if you require more information about our payment gateway.

Usage data including how and when you use our website, how you moved around it, what you searched for, website performance statistics, traffic, location, weblogs, and other communication data.

Technical data about the details of the device(s) you use to visit our website, your internet protocol (IP) address, login data, your username and password, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, and platform.

Marketing data including your marketing preferences and limited information about how you interact with our marketing emails.

Sizing data that you may decide to provide us information about a pupil's gender, height, and weight in order for us to recommend the best size of garment to purchase.

Contact data when you call or email us about any issues, queries, or data requests

Children's information. When you place an order, you may provide us with information about a child, including their name, school, year group, gender, height and weight, so that we can process your order and recommend the correct size of garment. This information is provided to us by the parent or guardian placing the order, who is responsible for the accuracy of the information provided and for authorising its use for these purposes on the child’s behalf. We use this information only to fulfil your order and provide sizing recommendations, and we retain it in accordance with our retention periods.

We also collect, use, and share aggregated data which may be derived from your personal data. This isn't considered personal data as this data does not directly or indirectly reveal your identity. For example, we may aggregate your usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

How do we collect your data, why do we collect it and how do we use it?

We collect your data when you:

• Create an account with us or make a purchase online or in our stores.
• Subscribe to our emails.
• Enter a competition.
• Contact us with an enquiry or to report an issue by phone or email.
• Interact with our website.

We only collect and use your personal data to:

• Fulfil your order/s with us or orders made on your behalf.
• Keep you up to date with our latest offers and promotions or information about school uniform.
• Improve your shopping experience.
• Make any marketing conducted by us more relevant to you.
• Improve our services and our website.
• Meet our legal responsibilities.

We will only collect and use your data if:

• We have your consent to do so, or
• Your personal data is required to perform a contract with you such as fulfilling and order or processing a payment from you, or
• We have a legitimate interest to do so which is not overridden by your rights, or
• We have a legal obligation to collect or disclose your personal data.

How do we process your data?

We use your personal data to support a range of different activities which are listed in the table below. Also, included is the type of data used and the legal basis in which rely on when processing it. This includes, where appropriate, our legitimate interests. Please be aware that we may process your personal data using more than one lawful basis, depending on the specific activity involved. Please contact us if you need details about the specific legal grounds that we are relying on to process your personal data where more than one ground has been set out in the table below.

More information on what we collect and why

How do we keep your data secure?

We put in place appropriate organisational safeguards and security measures to ensure that we can effectively protect your data from being lost, used, altered, disclosed, or accessed in an unauthorised way.

Sending information over the internet can never be completely secure. We always strive to protect your data, but we cannot guarantee the security of the data you send to our websites. You send it at your own risk, but please be assured that when you are on our website, the communication between your browser and our website uses a secure encrypted connection for all personal data. Any personal data stored by our website is fully encrypted using an encryption key to protect passwords and other sensitive information. We use the industry-standard ChaCha20-Poly1305 algorithm with a 256-bit key to encrypt all data that requires encryption. As mentioned above, please do not store any of your credit card information.

Once we have received your information, we will use strict procedures and security features to try and keep it safe. Any 3^rd parties that are contracted by us to process your personal data are required to have security measures in place to protect your data and to treat such data in accordance with the law.

We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long do we keep your data?

We won't keep your personal data for any longer than is necessary for the purpose that it was provided for, and to meet our legal obligations.

If reasonably necessary or required to meet legal or regulatory requirements, resolve disputes, prevent fraud, and abuse, or enforce our terms and conditions or other legal rights, we will also retain of some of your information, even if it is no longer needed to provide our services to you.

We may retain information that has been irreversibly anonymised so that no individual is identifiable, for research or statistical purposes, indefinitely and without further notice to you. Pseudonymised or key-coded information remains personal information and is retained under the periods above.

How do we use your data for marketing purposes?

We send electronic marketing to individuals only where they have consented. We may also contact existing customers about our similar products and services where the Privacy and Electronic Communications Regulations' customer soft opt-in applies and we offered an opt-out when collecting the details and in every message. You can opt in and out of emails when you open an account with us, or if you sign up to receiving emails from us on our website. You can opt out of receiving emails from us at any point by clicking the unsubscribe link at the bottom of every email that we send.

Where you have consented to marketing, or the soft opt-in applies, we may use your purchasing data to personalise the marketing messages we send to you.

Cookies

We use cookies and similar technologies for a variety of things on our website, we mostly use them to make sure that your online experience is as smooth and effective as possible, but we also use cookies to monitor performance of our emails and review how customers use our website to see where we can make improvements to it in the future. We also use cookies to recommend products on our website and in emails.

Most cookies require consent. When you first visit our site, a pop-up banner will inform you about our use of cookies. You can choose to accept all cookies, reject all except essential ones, or accept only certain types. Non-essential cookies are only set once you have given consent through the banner. The differences between essential and non-essential cookies are explained below. You can continue to use our sites and complete transactions without consenting to cookies, but if you do this some site functionality may be impaired.

Essential - These cookies are used to deliver and maintain online services, provide basic site functionality, remember your basket content, facilitate transactions and payments, prevent fraud, and secure our sites.

Non-essential - With your consent, we use non-essential cookies to enhance our sites and services, comply with contractual duties, improve service quality, develop new features, and enable special site features like widgets or embedded media. These are not essential for site operation but enhance the user experience and allow us to test new features.

Strictly necessary cookies - Essential - These cookies enable website functionality and services you have specifically requested, such as remembering your basket or completing a transaction. They cannot be turned off and do not require consent. You can block them in your browser, but some site features may not work.. Some of these technologies collect online identifiers, device information and usage information which may constitute personal information.

Functional cookies - Non-Essential - These cookies provide enhanced functionality and personalisation. They may be set by us or third-party services we use. If turned off, some services may not work properly.

Performance cookies - Non-Essential - These cookies help us count visits and traffic sources to measure and improve website performance. Some of these technologies collect online identifiers, device information and usage information which may constitute personal information. Where we describe statistics as anonymous, this means we have verified that individuals are no longer identifiable. Turning them off prevents us from knowing when you visit and hinders performance monitoring.

Tracking cookies - Non-Essential - Set by third-party advertisers, these cookies build a profile of your interests to show relevant ads on other sites. These technologies collect online identifiers, device information and usage information which may constitute personal information, and may uniquely identify your browser and device. Turning them off will result in less targeted advertising.

Who do we share your data with?

We will never sell any of your information to any third party. We do, however, use digital solutions to provide our products and services to you, to send marketing information and to improve our business. These fall into the following categories:

• Companies within the Banner Group for analysis and business purposes and to improve our products and services.
• Companies that enable us to get your purchases to you, such as payment service providers, warehouses, order packers, and delivery companies.
• Brand partners that send purchases directly to you. We'll make it clear if this applies when you place your order. We may also share your personal information with brand partners if you raise a serious complaint about a product of theirs that you've purchased through us or if you tell us that you haven't received your order.
• Professional service providers such as marketing agencies, IT development partners, advertising partners and website hosts/providers/developers, who help us run our business.
• Third party payment processers such as Cybersource, PayPal, Klarna, Apple Pay & Google Pay to process your payment to us. We do not store your payment information. Your payment details are provided to the payment processing service that you select, who are required to comply with applicable regulations and data protection laws. Please refer to the privacy policy of the relevant provider for details of how they process your personal data.
• Third party gift card providers.
• Credit reference agencies, law enforcement and fraud prevention agencies so we can help tackle financial crime, including, but not limited to, fraud and sanctions. If you would like to know more about the third parties, we may share personal data with, or how to find out more on how they will use your data, please contact us at the details below.

Where do we store your data?

We share your personal data within our own group of companies and to external service providers where necessary. Where we make a restricted transfer of personal information outside the UK, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU standard contractual clauses, or another lawful safeguard or exception. Where required, we carry out a transfer risk assessment and apply supplementary measures.

What are your rights?

You have the right to:

• Withdraw your consent where the legal basis of our processing is consent.
• Ask for access to the personal data that we hold (subject access request)
• Prevent our use of your personal data for direct marketing purposes.
• Object at any time to our processing of personal data for direct marketing purposes, including related profiling - this is an absolute right. You may also object to processing based on our legitimate interests or the performance of a public task; where you do, we must stop unless we can demonstrate compelling legitimate grounds or need the information for legal claims.
• Ask us to erase personal data (right to be forgotten):
  • If it is no longer necessary in relation to the purposes for which it was collected or otherwise processed.
  • If the only legal basis of processing is consent and that consent has been withdrawn and there is no other legal basis on which we can process that personal data.
  • If you object to our processing where the legal basis is the pursuit of a legitimate interest or the public interest, and we cannot demonstrate compelling legitimate grounds to continue that override your interests, rights and freedoms, or that we need the information for legal claims.
  • If the data subject has objected to our processing for direct marketing purposes.
  • If the processing is unlawful.
• Request that inaccurate data is rectified (or to complete incomplete data).
• Restrict processing in specific circumstances e.g. where there is a complaint about accuracy.
• Where processing is based on consent or contract and carried out by automated means, request the personal information you provided in a structured, commonly used and machine-readable format and, where technically feasible, ask us to transmit it to another controller.
• Request a copy of the safeguards under which any personal data is transferred outside of the UK.
• The right not to be subject to decisions based solely on automated processing, including profiling, except where necessary for entering into, or performing a contract. It is based on the data subject's explicit consent and is subject to safeguards; or is authorised by law and is also subject to safeguards.
• Prevent processing that is likely to cause damage or distress to the data subject or anyone else.
• To be notified of a personal data breach which is likely to result in high risk to their rights and freedoms.

We normally respond without undue delay and within one month. We may extend this by up to two further months where necessary, taking into account the complexity and number of requests, and will tell you within the first month if an extension is needed. We may request information needed to verify your identity. Requests are normally free of charge, subject to limited statutory exceptions. You can reach out to us using the contact information provided below if you wish to exercise any of these rights. There may be instances where we are unable to fulfil your request; in such cases, we will inform you and explain why.

You also have the right to make a complaint to the ICO. You can do this by following this link - https://ico.org.uk/make-a-complaint/

How can you contact us?

We are happy to answer any questions that you have about your data or about this policy. Please send any questions, requests, or comments to privacy@banner.co.uk and our nominated data protection representative will respond to you.