Privacy Notice

1. What we collect

When you order or contact us we may collect: your name; email address; phone number; delivery and billing address; the details of your order; the artwork and files you upload; and the messages you send us.

We also collect limited technical information needed to run the site securely (for example your basket identifier and information your browser sends). We do not collect payment card numbers — these go directly to our payment processor.

Only for the specific categories you choose in the cookie notice (see section 6): if you choose Analytics, aggregated information about which pages you view via Google Analytics; if you choose Advertising, the Google advertising click identifier that brought you to the site from one of our adverts, the page you arrived on, a coarse device type (phone, tablet or desktop), the time you granted it, and — if you go on to order — a record of that click against your order. Choosing one category never turns the other on. Whatever you choose, an order you place records whether Advertising was granted, rejected or unanswered when you arrived and when you paid, and nothing else about your choice.

2. How and why we use it

We use your data to: take and fulfil your order; produce proofs and print your items; arrange delivery or collection; provide customer support and send order-related emails; keep accounting and tax records; and prevent fraud and misuse.

Once, after your order has shipped or is ready for collection, we may email you to ask for an honest Google review. Every one of these emails includes a link to opt out, and we will not send you more than one per order.

If you choose Analytics, we use Google Analytics to measure which pages lead to enquiries and orders, and to improve the site. If you choose Advertising, we use Google Ads to measure which of our adverts lead to orders and to show ads to people who have visited the site (remarketing); for the same purpose we record, against a consented order only, which advert click led to it. We do not use Google's "Enhanced Conversions" feature: we never send Google a hashed copy of your name, email address or phone number, from any page, whichever categories you choose. We never use either category to build a profile of you, and we use neither at all if you reject cookies, choose only the other category, or have not answered.

Our legal bases are: performance of our contract with you (to fulfil your order); our legitimate interests (to run and secure the business and communicate about orders, including the one-off review request above); compliance with legal obligations (such as tax records); and your consent for the Analytics and/or Advertising cookies and the advert-click record described above, and for anything else we ask your permission for (for example any optional marketing). You can withdraw that consent, for either category independently, at any time — see section 6.

3. Service providers we share data with

We use trusted providers to run the service, and share only what each needs: Stripe (payment processing); Resend (sending your order and proof emails); Supabase (our database and secure storage for your artwork and order records); and Vercel (website hosting). Each processes your data on our instructions under its own security and privacy terms.

If you choose Analytics, Google (Google Ireland Limited) receives the page and engagement data Google Analytics collects. If you choose Advertising, Google separately receives purchase totals and order numbers (never your name, address or artwork) and click-measurement data via Google Ads. Neither category ever includes your name, email, phone number or address, or a hashed copy of any of them — we never pass those details to Google's tag, which is how sites using Google's "Enhanced Conversions" send them. Pages you open with a private link — your order page, a quote, and the order confirmation page — are addressed by a private code: pages whose address contains it as part of the path never load Google's tag, and on the confirmation page we remove the code from the page address and referrer that Google's tag reports. Google uses whatever it receives under its own privacy terms, described at policies.google.com/technologies/partner-sites. For its advertising services Google acts as an independent controller of that data under the Google Controller-Controller Data Protection Terms. Nothing is sent to Google for a category before you grant it, and nothing is ever sent for a category if you reject without having accepted first; if you accept and later withdraw a category, section 6 describes exactly what happens from that moment.

Some of these providers may process data outside the UK/EEA. Where they do, appropriate safeguards (such as standard contractual clauses) apply. We do not sell your personal data.

4. How long we keep it

We keep order and account records for as long as needed to provide the service and to meet our legal and accounting obligations (generally up to six years for financial records). We keep the artwork and files you upload only for as long as they are needed — to fulfil your order, provide support, handle any dispute, support repeat orders where relevant, or meet a legal or accounting obligation — and remove them when they are no longer required.

The advert-click identifier recorded against a consented order is scheduled for permanent removal within 90 days of the order: an automated daily process removes it once it is older than 89 days. If a scheduled run is missed (for example during a hosting outage), removal is delayed until the next successful run, which then removes every identifier that is due. After removal the order keeps only a label saying it came from a Google advert (with the page, device type, capture time and your cookie choices), for as long as the order record itself is kept. The same removal schedule applies to the copy held in the checkout record. The first-party attribution cookie described in section 6 lasts at most 30 days.

5. Your rights

You have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to certain processing, and to data portability, subject to legal limits. Where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, contact us at hello@primeprintco.co.uk (or message us on WhatsApp). You also have the right to complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.

6. Cookies, your choices and security

Cookies and similar storage we always use: the ones needed to make the site work. This is essential storage, not something the cookie notice asks you about — it is always on. It covers your basket identifier (up to 30 days), your sign-in session if you have an account, security, completing checkout, and your own answer to the cookie notice, kept in your browser's local storage rather than a cookie so we do not ask you again. That stored answer has no expiry and stays in your browser; to remove it, clear this site's data in your browser settings, after which we will ask you again.

The cookie notice offers two further categories, each off by default and decided independently — choosing one never turns the other on: Analytics (Google Analytics) and Advertising (Google Ads conversion tracking and remarketing). You can grant neither, either, or both, either from the notice itself ("Accept all", "Reject optional", or "Choose cookies" to pick individually) or later via "Cookie settings" (see below).

Analytics, if you grant it: we load Google's tag with Analytics enabled, which sets cookies on this site's domain — _ga and _ga_* (up to 2 years), _gid (24 hours) and _gat_* (1 minute) — and shares page and engagement data with Google (section 3).

Advertising, if you grant it: we load Google's tag with Advertising enabled, which sets cookies on this site's domain — _gcl_* (for example _gcl_au, _gcl_aw, _gcl_gb and _gcl_gs) and _gac_* (up to 90 days) — and shares purchase and click-measurement data with Google (section 3). With Advertising we also grant Google's "ad_user_data" consent signal, which lets the tag send this advertising-related data about your visit to Google for advertising purposes, including conversion measurement (Google requires it for its conversion tracking); without Advertising that signal stays denied. It never includes your name, email, phone number or address, or a hashed copy of them — we never pass those details to Google's tag. With the same grant, if you arrived from one of our Google adverts, we set our own first-party cookie, ppc_attr (up to 30 days, not readable by page scripts), holding that advert's click identifier, and if you then order we record that click against the order (section 4). The time we record is the time you granted Advertising on the page you arrived on, not the time of the click itself.

Before you answer, and if you reject without having accepted first (whether via Reject optional, or by choosing cookies and leaving a category off): no Google tag is loaded for that category, no request is made to Google for it, no Google cookie for it is set, and (for Advertising) no click identifier is stored anywhere. Your answer is kept only in your browser as described above; a rejection or an unanswered notice is not sent to Google and is not recorded on our servers, except that an order you place notes whether the Advertising category was accepted, rejected or unanswered when you arrived and when you paid.

Changing your mind: Cookie settings in the footer of any page shows the notice again, pre-filled with your current choice, where you can change either category and choose Save choices, or choose Keep my current choice to close it unchanged. Cookie settings changes or keeps your stored answer; it does not clear anything from your browser — use your browser settings for that. Turning a category off after it had been on withdraws your consent for it from that moment: the Google tag already on the page is told that consent is withdrawn for that category (it stops setting and reading that category's cookies, and that consent signal may reach Google without any cookie); we delete that category's cookies set on this site's domain (Analytics: _ga, _ga_*, _gid, _gat_*; Advertising: _gcl_*, _gac_* and our ppc_attr cookie); and — if you turn off the only category still granted — no Google tag is loaded on your next page or visit. The other category, if still granted, is entirely unaffected: turning off Analytics never touches Advertising's cookies, and turning off Advertising never touches Analytics's. Withdrawal does not affect what was lawfully collected before it; to have the click record removed from an order you have placed, contact us (section 5). Cookies that Google sets on its own domains (for example google.com or doubleclick.net) are controlled by Google, not by us — you can manage them in your browser settings and at adssettings.google.com and myadcenter.google.com.

Security: we take reasonable technical and organisational measures to protect your data, including encrypted connections and access controls.

Business details and how to contact us

Company name: Prime Print Co Ltd.

Business address: Unit G05, Regents Studio, 1 Thane Villas, N7 7PH (our North London studio).

Email: hello@primeprintco.co.uk. You can also message us on WhatsApp.

Opening hours: Monday–Friday 10:00–17:00; Saturday–Sunday closed.