GDPR Policy

1. GDPR Overview & Our Commitment

The General Data Protection Regulation (GDPR) is a comprehensive data protection law that governs how personal data of individuals within the European Economic Area (EEA) is collected, processed, and stored.

Printedin is fully committed to GDPR compliance. We process personal data lawfully, fairly, and transparently. We collect data only for specified, explicit, and legitimate purposes and ensure it is adequate, relevant, and limited to what is necessary.

2. Data Controller Information

Under GDPR, Printedin acts as the Data Controller for the personal data of our users. This means we determine the purposes and means of processing personal data.

3. Legal Basis for Processing

Under Article 6 of GDPR, we process personal data based on the following legal grounds:

Where we rely on consent as the legal basis, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing performed before the withdrawal.

4. Categories of Personal Data

We process the following categories of personal data:

5. Data Subject Rights

Under GDPR, you have the following rights regarding your personal data. We will respond to all valid requests within 30 days (extendable by 60 days for complex requests):

5.1 Right of Access (Art. 15)

You have the right to obtain confirmation of whether we process your personal data and request a copy of your data in a commonly used electronic format.

5.2 Right to Rectification (Art. 16)

You have the right to request correction of inaccurate personal data or completion of incomplete data. You can update most information directly through your profile settings.

5.3 Right to Erasure (Art. 17)

You have the right to request deletion of your personal data ("right to be forgotten"), subject to applicable legal obligations (e.g., tax records that must be retained).

5.4 Right to Restriction (Art. 18)

You can request restriction of processing of your data while we verify its accuracy, assess our legitimate interests, or when processing is unlawful but you oppose erasure.

5.5 Right to Data Portability (Art. 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (JSON or CSV), and to transmit it to another controller.

5.6 Right to Object (Art. 21)

You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

5.7 Rights Related to Automated Decision-Making (Art. 22)

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you.

6. Data Processing Activities

We maintain a Record of Processing Activities (ROPA) as required by Article 30 of GDPR. Our key processing activities include:

• User Registration: Processing name, email, and password for account creation.
• Product Design: Processing uploaded images and text to create design previews.
• Order Fulfillment: Processing addresses and payment data for printing and shipping.
• Customer Support: Processing communications and account data to resolve inquiries.
• Marketing: Processing email addresses to remind you of a design you left unfinished (consent-based, from your notification settings).
• Enquiry replies: Sending your correspondence with us, and the record of the job it belongs to, to an AI service provider that drafts a reply for us to review (contract performance and legitimate interest).
• Analytics: Processing usage data to improve our services (consent-based).
• Advertising: Processing page visits and purchases to measure advertising and build audiences (consent-based).

6.1 Sub-Processors

We engage the following categories of sub-processors, all with appropriate Data Processing Agreements (DPAs):

7. International Data Transfers

We primarily store and process personal data within the European Economic Area (EEA). When data transfers outside the EEA are necessary, we ensure adequate protection through:

• Adequacy Decisions: Transfers to countries with EU adequacy decisions.
• Standard Contractual Clauses (SCCs): EU-approved contract terms ensuring equivalent data protection.
• Supplementary Measures: Additional technical and organizational measures where required (encryption, pseudonymization).

8. Data Protection Measures

In accordance with Article 32 of GDPR, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk:

8.1 Technical Measures

• End-to-end TLS 1.3 encryption for all data in transit
• AES-256 encryption for personal data at rest
• Bcrypt password hashing with adaptive cost factor
• Regular automated security scanning and testing
• Network segmentation and firewall protection
• Database access logging and monitoring

8.2 Organizational Measures

• Staff data protection training and awareness programs
• Access control based on the principle of least privilege
• Non-disclosure agreements with all employees and contractors
• Data Protection Impact Assessments (DPIAs) for high-risk processing
• Regular reviews and audits of data processing activities
• Incident response procedures and escalation protocols

9. Data Breach Notification

In accordance with Articles 33 and 34 of GDPR, we have established data breach response procedures:

• Supervisory Authorities: We will notify the competent supervisory authority within 72 hours of becoming aware of a personal data breach that is likely to result in a risk to individuals’ rights and freedoms. For data subjects in the United Kingdom this is the Information Commissioner’s Office (ICO). For data subjects in the European Economic Area it is the competent authority in the relevant Member State — we are not established in the EU, so notification is not made through a single lead authority.
• Affected Individuals: We will notify affected data subjects without undue delay when a breach is likely to result in a high risk to their rights and freedoms.
• Documentation: All data breaches are documented in our breach register, regardless of severity, including facts, effects, and remedial actions taken.

10. Data Protection Contact

We have not appointed a Data Protection Officer, and the GDPR does not require one of us: Article 37(1) calls for a DPO only from public authorities and from controllers who monitor people on a large scale or process special categories of data on a large scale. Data protection is the responsibility of the management of the business, which answers these requests. You can reach us here:

11. Supervisory Authority & Complaints

If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with a supervisory authority (Article 77). Which authority that is depends on where you are, not on where we are:

11.1 If you are in the European Economic Area

You may complain to the supervisory authority of the Member State where you live, where you work, or where the alleged infringement took place. Because we are established in the United Kingdom and not in the Union, no single authority acts as a lead authority for us — your own national authority is competent. The European Data Protection Board publishes the current contact details for every national authority:

11.2 If you are in the United Kingdom

The Information Commissioner’s Office is the supervisory authority for the UK. The details below are the ICO’s own — they are not our contact details; to reach us, see the Data Protection Contact section above.

Exercising this right costs you nothing and does not depend on contacting us first — but we would rather put a problem right than have you need to. If you write to privacy@printedin.com we will answer within 30 days.