Privacy Policy
Last updated: 10 July 2026
1. Introduction
Decal Empire LTD ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal information when you use our website (decalempire.co.uk) and services.
Decal Empire LTD is the data controller for the personal data described in this policy. Our contact details are set out in section 14.
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we offer our products to customers in the European Union, the EU General Data Protection Regulation (EU GDPR) also applies to our processing of those customers' personal data, and references to your rights in this policy apply equally under both regimes.
2. Information We Collect
2.1 Information You Provide
- Account information: name, email address, password (managed securely by our authentication provider, Clerk)
- Order information: billing and delivery addresses, phone number, order history
- Payment information: processed securely by Stripe; we do not store your full card details
- Artwork and design files: images and files you upload for printing
- Communications: messages you send us by email, contact forms, or SMS
2.2 Information Collected Automatically
- Usage data: pages visited, time on site, referral source
- Device data: browser type, operating system, screen size
- Cookies and similar technologies: as described in section 8
3. How We Use Your Information and Our Lawful Bases
Under data protection law we must have a lawful basis for each use of your personal data. The table below sets out what we do and why we are allowed to do it.
| Purpose | Data used | Lawful basis |
|---|---|---|
| Processing and fulfilling your orders, including printing your artwork and arranging delivery | Account, order, artwork, and payment data | Performance of a contract |
| Sending order confirmations, proofs, and delivery updates by email or SMS | Contact details, order data | Performance of a contract |
| Storing your artwork in your Artwork Library so you can reorder | Artwork files, account data | Performance of a contract and our legitimate interest in providing a convenient reorder service |
| Customs declarations and tax reporting for international orders | Name, address, order contents and value | Legal obligation |
| Keeping accounting and tax records | Order and payment data | Legal obligation |
| Responding to your enquiries and providing customer support | Contact details, communications | Legitimate interests |
| Preventing fraud and securing our website and systems | Usage, device, and order data | Legitimate interests |
| Website analytics and improvement | Usage and device data, cookies | Consent |
| Sending marketing communications, including loyalty programme updates and offers | Contact details, order history | Consent, or legitimate interests where we rely on the "soft opt-in" for existing customers (see section 9) |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects.
4. How We Share Your Information
4.1 Service Providers
We share personal data with trusted third parties who help us run our business, only to the extent needed for their service:
- Stripe: payment processing
- Clerk: account authentication and management
- Amazon Web Services (AWS): secure storage of your uploaded artwork files and our systems data
- Resend: transactional and service emails
- Twilio: SMS order notifications
- Royal Mail and other delivery carriers: name, address, and contact details for delivery, and order contents and value where required for customs
- Google Analytics and Microsoft Clarity: website analytics, as described in section 8
- Our accountants and professional advisers: where necessary for accounting, tax, and legal compliance
4.2 Customs and Tax Authorities
For orders delivered outside the United Kingdom, we are legally required to provide customs authorities and our carriers with information about your order, including your name, delivery address, and a description and value of the goods. For EU orders declared under the Import One-Stop-Shop (IOSS) scheme, order and tax information is reported to the relevant tax authorities.
4.3 Legal Requirements
We may disclose personal data where required by law, court order, or governmental authority, or where necessary to protect our rights, property, or safety, or that of others.
4.4 Business Transfers
If we sell or transfer our business or assets, personal data may be transferred as part of that transaction. We will notify you of any change in ownership or use of your personal data.
We do not sell your personal data to third parties.
5. International Transfers
Some of our service providers process data outside the UK and the European Economic Area, including in the United States. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or Addendum, EU Standard Contractual Clauses, or certification under the EU-US Data Privacy Framework and its UK Extension.
6. Data Retention
- Order and transaction records: retained for 7 years to meet accounting, tax, and legal obligations
- Account information: retained while your account is active and for a reasonable period after closure
- Artwork files: retained in your Artwork Library while your account is active so you can reorder. You can delete files from your library at any time, and we delete stored artwork when your account is closed, except where a copy must be kept as part of an order record
- Analytics data: retained in accordance with the retention settings of our analytics providers, as described in section 8
- Communications: retained for as long as needed to handle your enquiry and for a reasonable period afterwards
Where data is no longer needed, we delete or anonymise it.
7. Your Rights
Under UK GDPR and, where applicable, EU GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data in certain circumstances
- Restrict our processing of your data in certain circumstances
- Object to processing based on legitimate interests, and to any direct marketing
- Data portability: receive your data in a structured, commonly used, machine-readable format
- Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal
To exercise any of these rights, contact us using the details in section 14. We will respond within one month.
You can exercise your access and erasure rights yourself at any time: download a copy of your data or delete your account from Account → Settings → Privacy & data. For any other request, email us at contact@decalempire.co.uk.
8. Cookies and Analytics
We use cookies and similar technologies to operate our website and understand how it is used.
- Essential cookies: required for the website to function, including your basket, checkout, and account session. These do not require consent.
- Analytics cookies (Google Analytics): help us understand how visitors use our site. Set only with your consent.
- Session replay (Microsoft Clarity): records anonymised interactions such as clicks and scrolling to help us improve usability. Set only with your consent.
You can manage your preferences through the cookie banner shown on your first visit, change them at any time via the cookie settings link in our website footer, and control cookies through your browser settings.
9. Marketing
We may send you marketing emails about our products, offers, and our customer loyalty programme where you have opted in, or where you are an existing customer and we rely on the "soft opt-in" for messages about our own similar products and services.
Every marketing email includes an unsubscribe link, and you can opt out at any time without affecting your orders or account. We do not send marketing SMS without your explicit consent.
If we introduce loyalty programme features based on your purchase history, such as tier status or personalised perks, we will use your order history for that purpose as described in section 3, and you may opt out of the programme at any time.
10. Data Security
We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, and secure cloud infrastructure. Payment details are handled entirely by Stripe and never touch our servers.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security, but we regularly review our security practices.
11. Children's Privacy
Our website and services are not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.
12. EU/EEA GDPR Representative (Article 27)
If you are located in the EU and have questions or concerns regarding your personal data, you may contact our appointed GDPR representative:
EU Representative: Euverify Ltd (Ireland) Unit 3D North Point House North Point Business Park New Mallow Road Cork T23 AT2P Ireland Email: gdpr@euverify.com
To submit a Data Subject Access Request (DSAR), data deletion request, or any other GDPR-related inquiry, please use our secure portal at:
https://gdpr.euverify.com/verify/2610b0dd-7020-4131-85da-8f3bb2df0917
This link allows you to verify our appointed representative and submit GDPR requests directly. Requests submitted through this portal are logged and tracked to ensure timely response and compliance.
13. Complaints
If you have a concern about how we handle your personal data, please contact us first and we will do our best to resolve it.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. If you are in the European Union, you may instead complain to the data protection supervisory authority in your country of residence.
14. Contact Us
For any questions about this Privacy Policy or your personal data:
Email: contact@decalempire.co.uk
Address: Decal Empire LTD Unit 6 Parc Gelli Werdd Cross Hands, Llanelli SA14 6EF United Kingdom
Company No. 13933695 VAT No. GB 496306660
15. Changes to This Policy
We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date, and where changes are significant we will take reasonable steps to bring them to your attention.