Privacy Policy
Last updated: 4 September 2026 • How GlowPrint Boutique Ltd protects and manages your personal data
Data Controller Identification
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, the Data Controller responsible for your personal information is:
GlowPrint Boutique Ltd
Company Registration: Companies House No. 16455082 (Registered in England and Wales)
Registered & Correspondence Address: 26 Lanercost Way, Ipswich, Suffolk, IP2 9DL, United Kingdom
Privacy Enquiries Email: glowprint.boutique@gmail.com
Customer Service WhatsApp: +44 7352 113825
1. Overview & Our Commitment
At GlowPrint Boutique Ltd, we understand how important your personal information is. We are committed to safeguarding your privacy and ensuring that any personal data you share with us is handled lawfully, transparently, and securely.
This policy explains what information we collect from you when you visit our website, place guest orders, upload images for personalised keepsakes, or communicate with our studio team.
2. Personal Data We Collect
We collect only the information strictly necessary to fulfill your orders, craft your personalised items, and provide helpful customer support:
- Identity & Contact Information: Your full name, delivery address, billing details, email address, and telephone number provided during guest checkout or customer enquiries.
- Bespoke Personalisation Content: Inscriptions, personal messages, names, dates, and photographs uploaded or emailed to us for custom gift crafting (such as printed mugs, natural rock photo slates, and custom cake toppers).
- Order & Transaction Records: Details of the items ordered, quantities, delivery methods, total amounts, order references, and payment status confirmation.
- Customer Communications: Messages, feedback, and records of correspondence via email or our dedicated studio WhatsApp service.
- Technical Connection Information: Anonymized server access logs, device type, and IP address for essential server security, network protection, and fraud prevention.
3. Legal Bases & Purposes of Processing
Under UK GDPR Article 6, we process your personal data under the following lawful grounds:
A. Contractual Necessity (Article 6(1)(b))
Processing is necessary to perform our contract with you: receiving your order, crafting bespoke and personalised items, verifying designs, dispatching goods via Royal Mail or couriers, and sending order receipts and tracking links.
B. Legal & Statutory Obligations (Article 6(1)(c))
We are required by UK law to retain order transaction histories and financial records for statutory tax (HMRC) and accounting compliance, as well as statutory consumer rights management.
C. Legitimate Interests (Article 6(1)(f))
Processing necessary for our legitimate commercial interests in maintaining website security, detecting and preventing fraudulent orders, and responding to customer enquiries and service requests.
4. Third-Party Service Providers
We do not sell, rent, or trade your personal data. We share information only with technical and operational service providers strictly necessary to operate our boutique and fulfill your orders:
- Cloud Hosting & Edge Infrastructure: Netlify Inc. hosts our storefront application and manages edge delivery and server security logs.
- Database & Cloud Storage: Supabase Inc. provides secure database infrastructure for order records and catalogue information, protected with Row-Level Security (RLS).
- Postal & Courier Partners (including Royal Mail): Couriers receive recipient name, delivery address, and tracking contact details strictly to execute parcel dispatch and delivery.
- Email Communications (Google LLC): Customer service enquiries and transactional notifications sent to or from glowprint.boutique@gmail.com are processed through Google Workspace/Gmail infrastructure.
- Messaging & Customer Support (WhatsApp / Meta Platforms Ireland Ltd): When you choose to contact our studio via WhatsApp to discuss bespoke requirements, verify designs, or send photos, your communications are processed through the WhatsApp platform.
- Payment Processing (Stripe Payments UK Ltd): Stripe will operate as an authorized payment processor for secure card transactions once online card payments are activated.
5. Data Retention Criteria
We retain personal data only for as long as reasonably necessary to fulfill the purposes for which it was collected, satisfy statutory legal obligations, resolve customer disputes, and defend potential claims:
| Data Category | Retention Criteria | Legal & Operational Justification |
|---|---|---|
| Order, invoice & transaction records | Retained for the duration required by applicable UK tax and accounting legislation (typically 6 years from the end of the relevant financial year). | HMRC statutory compliance and limitation periods under the Limitation Act 1980. |
| Uploaded bespoke customer photos & artwork | Retained only for as long as necessary to complete order production, verify quality, and address immediate post-delivery reprint or customer queries, after which they are removed when no longer required, except where retention is necessary for an ongoing dispute or legal obligation. | Order fulfillment, craftsmanship verification, and customer query support. |
| Customer correspondence & support enquiries | Retained only for as long as necessary to resolve the enquiry, maintain customer service continuity, and address potential claims. | Legitimate interest in responsive customer service and complaint resolution. |
6. Your Statutory Rights Under UK GDPR
As a data subject in the United Kingdom, you possess clear statutory rights regarding your personal information:
- Right of Access: You may request a copy of the personal data we hold about you (Subject Access Request).
- Right to Rectification: You may request correction of any inaccurate or incomplete data.
- Right to Erasure ('Right to be Forgotten'): You may request deletion of your data where retention is no longer required for statutory tax, legal, or contract defense reasons.
- Right to Restriction: You may ask us to restrict the processing of your data under certain circumstances.
- Right to Data Portability: You may request transfer of your data to another service provider in a structured, machine-readable format.
- Right to Object: You may object to processing based on legitimate interests.
To exercise any of these rights, please contact us at glowprint.boutique@gmail.com. We will respond within one calendar month, free of charge.
Your statutory rights are not affected.
7. Right to Complain to the ICO
If you have any concerns about how we handle your personal data, we encourage you to contact us first so we can resolve the issue promptly.
However, you always have the statutory right to lodge a complaint directly with the UK's supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Online Complaints Portal: https://ico.org.uk/make-a-complaint/
8. International Data Transfers
Where technical service providers (such as cloud hosting or database infrastructure) transfer or process data outside the United Kingdom, such transfers are governed by UK International Data Transfer Agreements (IDTAs), the UK Addendum to the EU Standard Contractual Clauses (SCCs), or recognized UK adequacy regulations, ensuring your data receives equivalent protection to UK GDPR standards.
9. Information Security
We implement appropriate technical and organizational measures to safeguard your personal data against unauthorized access, loss, destruction, or alteration. These measures include encrypted HTTPS/TLS transmissions, secure credential handling, database row-level access permissions, and strict administrative authentication safeguards.
10. Children's Privacy
Our website and services are directed exclusively at adults purchasing gifts and keepsakes. We do not knowingly solicit or collect personal information from individuals under the age of 18. If we become aware that a child has provided us with personal data, we will promptly delete it.
11. Policy Changes
We may update this Privacy Policy from time to time to reflect changes in our commercial operations, technical infrastructure, or applicable UK legislation. Any updates will be published directly on this page with an updated "Last updated" date.
12. Contact Details
For any questions regarding this Privacy Policy or your personal information:
- Data Controller: GlowPrint Boutique Ltd (Company No. 16455082)
- Postal Address: 26 Lanercost Way, Ipswich, Suffolk, IP2 9DL, United Kingdom
- Email: glowprint.boutique@gmail.com
- WhatsApp / Customer Service: +44 7352 113825
