Privacy Policy

Last updated 16 October 2026

1. Who we are

MK Bullion is a trading name of Adam Okapa, a sole trader based in the United Kingdom. For the purposes of UK data protection law we are the “data controller” for the personal information described on this page — meaning we decide how and why it is used.

2. The short version

This website has no accounts, no analytics and no cookies. We do not track you, we do not build a profile of you, and we never sell or rent your information to anyone.

The only personal information we hold is what you choose to send us when you get in touch, and what you give us when you order — through our online checkout or any other way — so that we can make, deliver and account for it.

3. What we collect, and when

When you simply browse this site

We collect nothing ourselves. There are no cookies, no analytics scripts, no advertising pixels and no visitor tracking of any kind. Everything on the page, including its fonts, is served from our own site. One third party is involved in delivering it to you:

• Cloudflare hosts the site. Like any web host, its servers automatically log technical information — including your IP address, browser type and the pages requested — and run automated checks to block attacks and abusive bots, for security and to keep the site running. See the Cloudflare Privacy Policy.

When you contact us

Our enquiry form and “Send as enquiry” buttons do not transmit anything to us on their own. They open your own email app or WhatsApp with a message pre-filled, which you then choose to send. Nothing reaches us unless you press send.

When you do send us a message, we receive and keep:

• Your name and the email address or phone number you contact us from
• The specification you configured, if you used the box builder
• Anything else you choose to write to us

If you message us on WhatsApp, that conversation also passes through WhatsApp's own systems, operated by Meta. See the WhatsApp Privacy Policy.

When you buy through our online checkout

When you press the button to go to payment, our checkout service — which runs on Cloudflare — sends the box you configured, including any text to be engraved, to Stripe, our payment provider. You are then taken to Stripe's secure checkout page, where you enter:

• Your name, email address and delivery address
• Your payment details

and tick to accept our Terms. Stripe passes us your name, contact details, delivery address, order and a record that you accepted our Terms, so we can make and send your box. It processes your payment on our behalf, and also uses information about your payment and your device to prevent fraud, to check it's really you (for example with 3-D Secure) and to meet its own legal obligations — for those purposes it acts under its own Stripe Privacy Policy.

If you leave without paying, we don't use what you entered, and the unpaid checkout expires automatically.

Whenever you order

However you buy, to make and send your box we need:

• Your name and delivery address
• Any custom text you want printed onto the insert
• A record of what you ordered, what you paid and when

We never see or store your full card details. Payments through our online checkout are handled by Stripe; payment links and invoices we send you are handled by Revolut or Stripe. We may see the card type and its last four digits, never the full number. If you buy through eBay or Whatnot, that marketplace handles your payment and shares only what we need to dispatch your order.

4. Why we use it, and our lawful basis

We do not send marketing emails. If that ever changes we will ask for your consent first, and every message will carry a one-click unsubscribe.

You don't have to give us any of this, but we need your name, contact details and delivery address to quote for, make and send an order — without them we can't take it, and the checkout won't let you pay.

We make no decisions about you by automated means, and we do not profile you. Our payment providers run automated fraud and security checks on card payments, which can occasionally decline a genuine one — if that happens, contact us and we'll arrange another way to pay.

5. Who we share it with

We share your information only with the suppliers we need to run the business:

• Our email provider (Microsoft, through Microsoft 365), which stores our correspondence with you
• Our hosting provider (Cloudflare), which serves this website and runs our checkout service
• Delivery carriers such as Royal Mail or a courier, who need your name and address to deliver
• Our payment providers: Stripe, which runs our online checkout, processes those payments and holds your online order details for us; and Revolut, which processes payment links and invoices we send
• Our accountant and HMRC, where required for tax

We do not sell, rent or trade your personal information, and we do not share it for anyone else's advertising.

6. How long we keep it

• Enquiries that don't become orders: up to 12 months, then deleted.
• Unpaid checkouts: they expire automatically within 24 hours and we do not use them. Stripe keeps its own record under its privacy policy.
• Order and accounting records: up to six years after the end of the tax year they relate to, because HMRC requires us to keep them.
• Custom artwork or engraving text: kept with the order record, so we can repeat or repair a build.

7. Where your information is held

We are based in the UK and our records are held here. Some of our suppliers — including Cloudflare, Microsoft, Meta, Stripe and Revolut — are international and may process data outside the UK. Where that happens, those transfers are covered by safeguards recognised under UK data protection law, such as UK adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. Your rights

Under UK GDPR you have the right to:

• Ask what personal information we hold about you, and get a copy
• Have inaccurate information corrected
• Ask us to delete your information, where we have no ongoing legal reason to keep it
• Ask us to restrict how we use it, or object to that use
• Receive your information in a portable format
• Withdraw consent at any time, where we relied on consent

To exercise any of these, email [email protected]. We will respond within one month. It is free, unless a request is manifestly unfounded or excessive.

9. Complaining

If you think we have mishandled your personal information, you have the right to complain to us. Email [email protected] with “Data protection complaint” in the subject, or write to us at the address in section 1 — or tell us any other way you contact us, such as WhatsApp or by phone, and we will treat it the same.

We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you updated if it takes longer, and tell you the outcome.

You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at any time:

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Cookies

This website sets no cookies and uses no local storage, so there is no cookie banner and nothing to consent to. If we ever add analytics, we will ask before anything non-essential is stored on your device.

If you pay through our checkout, Stripe's checkout page is a separate site run by Stripe. It uses its own cookies and similar technology, which it needs for security and fraud prevention, under its own policy.

11. Children

Our products are not aimed at children and we do not knowingly collect information from anyone under 16. If you believe a child has sent us personal information, contact us and we will delete it.

12. Changes to this policy

We may update this policy as the business changes. The date at the top always shows the current version.

Read our Terms & Returns