Privacy policy

1. Who is responsible

Boutique Factory LLP, a limited liability partnership registered in England and Wales under company number OC458213, is the controller of the personal data described here.

For anything in this policy, write to contact@boutiquefactory.co.uk.

2. What we collect

• Account data — name, email address, password hash, language, and the record of your account activity.
• Company data — legal name, registered address, country and VAT number, together with the result of the VAT check.
• Order data — what you ordered, the files you sent, the files we returned, prices, invoices and payment records.
• Correspondence — what you write to us and what we write back.
• Technical data — IP address, browser and device information, and server log entries generated when you use the site.

We do not collect special category data, and there is nothing on this site that asks for any.

3. Why, and on what basis

• To supply what you ordered and to operate your account — because it is necessary to perform our contract with you.
• To verify that a company is a real, registered business before releasing commercial information — because we have a legitimate interest in knowing who we are dealing with, and in not being overwhelmed by speculative enquiries.
• To invoice you and collect payment — contract, and our legitimate interest in being paid.
• To keep accounting and tax records — because we are legally required to.
• To keep the site secure and to investigate misuse — our legitimate interest in a service that works and is not abused.
• To answer what you write to us — contract, or our legitimate interest in responding to an enquiry.

We do not send marketing email and there is no mailing list on this site.

4. Artwork you upload

Files you send us are held so that we can produce what you ordered, deliver it, and reissue or correct it afterwards. Where a file contains personal data — a name in a personalisation, a photograph in a source image — it is treated exactly like the rest of your order data.

We do not use your artwork or your marks to promote our services without your written agreement.

5. Who we share it with

We share personal data only with organisations that help us run the service, and only with what they need:

• Hosting and infrastructure providers operating our servers and backups.
• Production partners who carry out marking or produce artwork files.
• Carriers, who receive delivery details for a shipment.
• Our payment and banking providers, for direct debit collection.
• Our accountants and professional advisers.
• A public authority, where we are legally required to disclose.

Each of them acts on our instructions under a written contract. A current list of our processors is available on request to the address above.

We do not sell personal data, and we do not share it for anyone else's marketing.

6. International transfers

We are established in the United Kingdom and our customers are largely in the European Economic Area, so personal data moves between the two. The United Kingdom is the subject of an adequacy decision by the European Commission, which permits that transfer.

Where a processor is outside the United Kingdom and the EEA, the transfer is made under the standard contractual clauses or another lawful transfer mechanism.

7. How long we keep it

• Account and company data — while your account is open, and for one year after it is closed.
• Order data and delivered files — for six years, so that a file can be reissued and so that a query about an old order can be answered.
• Invoices and accounting records — for six years after the end of the financial year they fall in, which is the period we are required to keep them.
• Correspondence — for three years.
• Server logs — for ninety days.

Where something must be kept for one of these reasons and not another, we keep the narrower set and delete the rest.

8. Your rights

You can ask us to give you a copy of your personal data, to correct it, to delete it, to restrict what we do with it, or to give it to you in a portable form. You can object to processing we carry out on the basis of a legitimate interest.

Write to contact@boutiquefactory.co.uk. We will answer within one month, and we will tell you if we need longer or cannot do what you have asked and why.

Some of these rights have limits. We cannot delete an invoice we are required to keep, and we cannot delete the record of an order while it is being disputed.

9. Cookies

This site sets only what it needs to work. There is no analytics, no advertising and no third-party tracking on it. The detail is in our cookie policy.

10. Complaints

If you think we have handled your personal data badly, tell us first — it is usually the fastest way to fix it.

You can also complain to the Information Commissioner's Office in the United Kingdom, at ico.org.uk, or to the supervisory authority of the country you live or work in. Complaining to us does not remove that right.

11. Changes to this policy

We update this policy when what we do changes. The date at the top is the date of the current version, and a material change affecting an open account will be notified to the account's email address.