Privacy Policy
Last updated: 7 August 2026
1. Data Controller
2Rush Office ("we", "us") is the data controller of your personal data as defined by the EU General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. We are responsible for how your personal data is collected, used, and protected.
2. Personal Data We Collect
We collect and process the following categories of personal data: your name, email address, billing and shipping address, phone number, payment information (processed by our payment providers — we do not store full card details), order history, and browsing data collected via cookies and similar technologies.
3. Lawful Basis for Processing
We process your personal data under the following lawful bases as set out in Article 6 of the GDPR: (a) your consent for marketing communications and cookies; (b) the performance of a contract for order processing and fulfilment; (c) our legitimate interests in operating and securing our business; and (d) compliance with legal and tax obligations.
4. How We Use Your Data
We use your personal data to process and deliver your orders, manage your account, provide customer support, send order confirmations and updates, prevent fraud, and — with your consent — send marketing communications about products and offers relevant to your interests.
5. Data Retention
We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, and tax requirements. Order data is typically retained for 7 years to comply with EU tax regulations. Account data is retained for the lifetime of your account and deleted within 30 days of a deletion request.
6. Your Rights Under GDPR
You have the right to: access your personal data (Article 15), rectify inaccurate data (Article 16), erase your data ("right to be forgotten", Article 17), restrict processing (Article 18), data portability (Article 20), object to processing (Article 21), and withdraw consent at any time. To exercise these rights, contact us at privacy@2rush.com.
7. Cookies
We use essential cookies for the functioning of our website (e.g., cart and session management) and, with your consent, analytics and marketing cookies. You can manage your cookie preferences at any time through your browser settings or our cookie banner. Essential cookies do not require consent under the ePrivacy Directive.
8. Data Sharing
We share your data with trusted third parties only as necessary: payment processors (e.g., Stripe, PayPal), shipping carriers, cloud hosting providers, and email service providers. All third parties are bound by GDPR-compliant data processing agreements. We never sell your personal data.
9. International Data Transfers
If your data is transferred outside the EU/EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, or the recipient is located in a country with an adequacy decision.
10. Data Security
We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, encryption at rest, access controls, and regular security assessments. In the event of a personal data breach, we will notify the relevant supervisory authority within 72 hours as required by Article 33 of the GDPR.
11. Children's Privacy
Our services are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have collected such data, please contact us and we will delete it immediately.
12. Contact & Supervisory Authority
For any privacy-related queries, contact us at privacy@2rush.com. You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data appropriately.