Privacy policy

Last updated: 31 October 2026

This policy explains how Graff-City Ltd, trading as Montana Colors UK, a company registered in England and Wales (company number 08021989) ("we", "us") collects and uses your personal information when you use montanacolors.co.uk or buy from us. We are the data controller for your personal information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Information we collect

Contact and order details: your name, billing and delivery addresses, email address, phone number and order history.
Payment information: payments are processed securely by our payment providers. We do not see or store your full card details.
Account information: if you create an account or trade account, your login email and account details. For trade accounts, your business name, address, VAT number and contact details.
Communications: messages you send us by email, live chat or our contact and trade application forms.
Stock alert requests: your email address if you ask to be notified when an item is back in stock.
Technical and usage information: your IP address, device and browser type, and how you use our website, collected through cookies and similar technologies.

How we use your information and our lawful basis

To process and deliver your orders, take payment, handle returns and provide customer service. Lawful basis: performance of a contract.
To manage trade accounts and assess trade applications. Lawful basis: performance of a contract and our legitimate interests.
To send stock alerts you have asked for. Lawful basis: consent.
To send marketing emails about products and offers, only where you have signed up or where we are allowed to under the law. You can unsubscribe at any time using the link in every email. Lawful basis: consent or legitimate interests.
To keep our website secure, prevent fraud and improve our website and services. Lawful basis: legitimate interests.
To keep records for tax, accounting and legal purposes. Lawful basis: legal obligation.

Who we share your information with

We share your information only with trusted service providers who help us run our business, and only as needed for the purposes above:

Shopify, which hosts our website, checkout and customer accounts.
Payment providers, such as Shopify Payments and PayPal.
Delivery companies, including DPD, FedEx, Evri and Royal Mail, so they can deliver your order.
Our order management and warehouse systems.
Apps that provide live chat (Shopify Inbox), stock alerts and site search.

We may also share information where required by law, or to protect our rights or prevent fraud. We never sell your personal information.

International transfers

Some of our service providers, including Shopify, may process your information outside the UK. Where this happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.

Cookies

We use cookies that are essential for the website to work, such as remembering your basket. With your consent, we may also use analytics and marketing cookies to understand how the website is used. You can change your cookie choices at any time through the cookie banner or your browser settings.

How long we keep your information

We keep order and transaction records for 6 years after the end of the financial year they relate to, to meet tax and accounting requirements. Account information is kept while your account is open. Marketing and stock alert data is kept until you unsubscribe or ask us to delete it.

Your rights

Under UK data protection law you have the right to:

ask for a copy of the personal information we hold about you;
ask us to correct information that is wrong or incomplete;
ask us to delete your information, where we no longer have a reason to keep it;
object to or ask us to restrict how we use your information;
ask us to transfer your information to another organisation;
withdraw your consent at any time, where we rely on consent.

To use any of these rights, email mail@graff-city.com. We will respond within one month.

Children

Our website is not intended for children. We do not sell spray paint to anyone under 16 and do not knowingly collect information from children.

Complaints

If you are unhappy with how we have handled your information, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.