Legal

Privacy Policy

Last updated 24 June 2026

This privacy policy explains how OBRA (“OBRA”, “we”, “us” or “our”), a TACITO Group company, collects, uses and protects your personal data when you visit madebyobra.com, contact us or start a brief. We are committed to handling your personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

OBRA is a football jersey studio operated by TACITO Group. For the purposes of UK data protection law, OBRA is the data controller responsible for your personal data. If you have any questions about this policy or how we handle your data, you can contact us at hello@madebyobra.com.

2. The information we collect

We may collect and process the following:

  • Information you give us. When you submit a brief or contact us, this can include your name, email address, the brand, project or organisation you represent, and any details you choose to share about your project.
  • Information we collect automatically. When you use our website we may collect technical and usage data such as your IP address, browser type, device information, pages viewed and how you interact with the site, collected through cookies and similar technologies.

3. How and why we use your information

We use your personal data for the following purposes, relying on the lawful bases set out below:

  • To respond to your enquiry or brief and discuss a potential project (lawful basis: taking steps at your request prior to entering into a contract, and our legitimate interests in responding to enquiries).
  • To provide our design and production services and manage our relationship with you (lawful basis: performance of a contract).
  • To operate, maintain, secure and improve our website (lawful basis: our legitimate interests in running and improving our business).
  • To send you updates or marketing where you have asked us to or where we are otherwise permitted to (lawful basis: consent or legitimate interests). You can opt out at any time.
  • To comply with our legal and regulatory obligations (lawful basis: legal obligation).

4. Cookies and analytics

Our website may use cookies and similar technologies to make the site work, remember your preferences and understand how the site is used. Non-essential cookies, including analytics, are only set where permitted. You can control or delete cookies through your browser settings; blocking some cookies may affect how the site functions.

5. Sharing your information

We do not sell your personal data. We may share it with trusted third parties who process data on our behalf, such as hosting, email, analytics and form providers, and with our manufacturing and production partners where this is necessary to deliver a project. These parties are only permitted to use your data on our instructions and under appropriate contracts. We may also disclose your data where required by law or to protect our legal rights.

6. International data transfers

Some of our providers or partners may be located outside the United Kingdom. Where personal data is transferred outside the UK, we take steps to ensure it is protected by an appropriate safeguard, such as UK adequacy regulations or the International Data Transfer Agreement (or equivalent standard contractual clauses).

7. How long we keep your information

We keep your personal data only for as long as necessary for the purposes set out in this policy, including to meet any legal, accounting or reporting requirements. Enquiry and project data is typically retained for the duration of our relationship and for a reasonable period afterwards, after which it is securely deleted or anonymised.

8. How we protect your information

We use appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse or alteration. No method of transmission over the internet is completely secure, but we take reasonable steps to keep your data safe.

9. Your rights

Under UK data protection law you have the right to: access your personal data; ask us to correct inaccurate data; ask us to erase your data; restrict or object to our processing; request data portability; and, where processing is based on consent, withdraw that consent at any time. To exercise any of these rights, contact us at hello@madebyobra.com. We will respond within the timeframes required by law.

10. Children

Our website and services are not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Third-party links

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites, and we encourage you to read their privacy policies.

12. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated “last updated” date.

13. How to contact us and complaints

If you have any questions about this policy or wish to make a complaint, please contact us at hello@madebyobra.com. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk, though we would appreciate the chance to address your concerns first.