Policy

Privacy policy

Last updated:

1. Who we are

This website is operated by [YOUR LEGAL BUSINESS NAME] ("we", "us"), registered at [STREET ADDRESS], [CITY, POSTCODE, COUNTRY], company registration number [NUMBER]. We are the data controller for the personal data described in this policy.

For any privacy question, or to exercise any of the rights below, contact [YOUR EMAIL]. Where required, our EU/UK representative for data protection is [EU REPRESENTATIVE NAME AND ADDRESS].

2. What we collect

• Order and enquiry data — name, email address, shipping address, phone number, order contents, and any notes or reference images you send us when designing a custom piece.
• Payment data — the amount, currency, date and the last four digits of your card. We never receive or store your full card number. Card details are collected and processed directly by our payment provider.
• Communications — the content of emails and messages you send us, and our replies.
• Technical and usage data — IP address, device and browser type, pages viewed, referring URL, and marketing parameters such as UTM tags and TikTok click identifiers, collected through cookies and similar technologies.
• Marketing data — your email address and subscription status, if you join our mailing list.

We do not collect special category data (such as health, religion or ethnicity). Please do not include such information in a custom brief — it is not needed to make your piece.

3. Why we use it, and our legal basis

• To take, process and deliver your order — including producing custom pieces to your specification and handling returns. Legal basis: performance of a contract.
• To answer your enquiries and provide customer support. Legal basis: performance of a contract, or our legitimate interests in running our business.
• To meet tax, accounting, customs and consumer law obligations. Legal basis: compliance with a legal obligation.
• To prevent fraud and secure the site. Legal basis: our legitimate interests.
• To measure and improve our marketing, including advertising on TikTok, Meta and Google, and to show relevant ads to people who have visited our site. Legal basis: consent where required by law (for example for non-essential cookies in the EU/UK), and our legitimate interests otherwise. You can withdraw consent at any time.
• To send you marketing emails if you join our list. Legal basis: consent, or our legitimate interests in the case of existing customers, subject to your right to opt out at any time using the unsubscribe link in every email.

4. Cookies, pixels and tracking

We use the following technologies. Where the law requires consent, they are only set after you agree, and you can change your choice at any time by clearing your browser storage or contacting us.

• Strictly necessary — remembering what is in your shopping bag and your cookie preference. These cannot be switched off and hold no personal identifiers beyond your browser storage.
• Analytics — aggregated statistics on how the site is used (for example Google Analytics). These help us see which pages work and which do not.
• Advertising — the TikTok Pixel, and optionally the Meta Pixel, which report conversions such as an add-to-bag or a completed order, and allow us to show ads to people who have visited. These providers may combine this data with information from other sites under their own privacy policies.

We also record marketing parameters such as utm_source, utm_campaign and ttclid from the link you arrived through, so we know which content led to your order. This is stored in your browser session and attached to the order record.

5. Who we share it with

We share personal data only where necessary, and only with processors bound by contract to protect it:

• Payment providers — to take payment and handle refunds and chargebacks.
• Shipping carriers and customs brokers — to deliver your order and clear it through customs. This requires sharing your name, address and a description and value of the goods.
• Hosting, email and analytics providers — who store data on our behalf.
• Advertising platforms — where you have consented, to measure and target advertising.
• Professional advisers and authorities — accountants, auditors, or law enforcement where we are legally required to disclose.

We do not sell your personal data, and we do not share it with third parties for their own independent marketing.

Some of these providers are located outside the EU/UK, including in the United States. Where we transfer data internationally we rely on appropriate safeguards such as the UK Addendum, the EU Standard Contractual Clauses, or an adequacy decision.

6. How long we keep it

• Order, invoice and tax records: 7 years from the end of the relevant financial year, as required by tax law.
• Custom design briefs and reference images: 24 months after your order is delivered, so we can remake or match a piece — or sooner if you ask us to delete them.
• Enquiries that do not become orders: 12 months.
• Marketing subscriber data: until you unsubscribe, plus a short suppression record so we do not contact you again by mistake.
• Analytics and advertising data: for the retention period set by the relevant provider.

7. Your rights

Depending on where you live, you have some or all of the following rights:

• Access — a copy of the personal data we hold about you.
• Rectification — correction of inaccurate data.
• Erasure — deletion of your data where we have no overriding legal reason to keep it.
• Restriction and objection — including the right to object to processing based on our legitimate interests and to direct marketing at any time.
• Portability — a machine-readable copy of data you provided to us.
• Withdraw consent — at any time, without affecting processing already carried out.
• Non-discrimination (California) — we will not degrade our service because you exercised a privacy right.
• Do Not Sell or Share My Personal Information — we do not sell personal data. Where our use of advertising cookies constitutes "sharing" under California law, you may opt out by contacting us or declining cookies.

To exercise any right, email [YOUR EMAIL]. We will respond within 30 days (or within the shorter period required by your local law). You also have the right to complain to your local data protection authority — in the UK, the ICO; in the EU, your national supervisory authority.

8. Security

The site is served over HTTPS. Payments are processed by a PCI-DSS compliant provider and card data never reaches our servers. Access to order data is limited to the people who need it. No system is perfectly secure, and we cannot guarantee absolute security — but if a breach affects your rights, we will notify you and the relevant authority as required by law.

9. Children

This site is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Changes to this policy

We may update this policy to reflect changes in our practices or the law. The "last updated" date at the top always shows the current version. Material changes affecting how we use your data will be notified by email where we hold an address for you.