Privacy
Policy.

01 The Basics

By using our website or placing an order, you acknowledge that you have read this Privacy Policy and understand how we collect, use and disclose your information. Our store is hosted on Shopify, which provides the secure e-commerce platform that powers our business.

When we use the term "personal information", we mean data that identifies you or can reasonably be linked to you. It does not include anonymised or de-identified data.

Custom Drops UK is the data controller responsible for your personal information.

02 What We Collect

We only collect what we need to process your order, run our business, and stay compliant with the law.

• Contact Details: Name, billing address, shipping address, phone number, email.
• Order Data: Items purchased, options selected, the artwork files you upload, proof approval messages, notes you add to your order.
• Financial Info: Payment confirmation and transaction reference. Full card details are processed by PCI-compliant providers (Shopify Payments, PayPal, Klarna, Apple/Google Pay) — we never see or store your card number.
• Account Info: Login, password (hashed), preferences.
• Shopping Activity: Items viewed, cart additions, purchases, returns, order history.
• Device Data: IP address, browser, device type, pages visited — via cookies and similar tech.
• Communications: Emails, WhatsApp messages, contact-form submissions, support tickets.

03 UK GDPR & Legal Bases

We only process your data when the law allows. The lawful bases we rely on:

• Contract: To fulfil your order, take payment, produce your item, send proofs, arrange delivery, handle returns.
• Legitimate Interests: To prevent fraud, recover debts, improve our service, defend legal claims, keep order records.
• Legal Obligation: HMRC requires us to keep transactional records for 6 years.
• Consent: For marketing communications and non-essential cookies — withdrawable at any time.

04 How We Use Your Data

We don't sell your data. We use it to provide, tailor and improve our services — including processing payments, sending proofs, providing shipping updates, and protecting your account against fraud.

05 Who We Share It With

We only share data with trusted service providers, and only as much as they need to do their job:

• Shopify: Hosts our store, processes orders, stores your account data.
• Payment Processors: Shopify Payments, PayPal, Klarna, Apple Pay, Google Pay.
• Courier: Royal Mail, to deliver your order.
• Design Tools: Qstomizer processes your uploaded artwork so we can produce your item.
• Email Providers: For order confirmations, proof approvals, dispatch notifications, support.
• Professional Advisers: Accountant, legal advisers, insurers.
• Government & Regulators: HMRC, police, courts where legally required.

Some providers are based outside the UK / EEA. Where this happens, transfers are protected under UK adequacy regulations, EU adequacy decisions, the UK International Data Transfer Agreement, or equivalent standard contractual clauses.

06 Security & Retention

We use SSL encryption, restricted staff access, and secure storage with our providers. No system is 100% secure — if a breach materially affects you, we will notify you and the relevant authorities within 72 hours, as required by law.

We retain your data only as long as we need to:

• Orders & Accounting: 6 years (HMRC requirement).
• Account Data: While your account is active. Delete any time.
• Uploaded Artwork: Up to 12 months after fulfilment, for reprints. Sooner on written request.
• Marketing Data: Until you unsubscribe.
• Communications: Up to 3 years from last contact.
• Fraud / Dispute Records: Up to 6 years where relevant.

07 Your Rights

Under UK GDPR you have total control over your data, free of charge:

• Access: Request a copy of the data we hold about you.
• Rectification: Correct inaccurate or incomplete data.
• Erasure: Delete your data, where we have no overriding legal reason to keep it.
• Restriction: Limit how we use your data.
• Portability: Receive your data in a portable format.
• Object: Object to processing based on legitimate interests, or to direct marketing.
• Withdraw Consent: At any time, where we rely on consent.

To exercise any right, email info@customdrops.co.uk. We will respond within 30 days.

08 Cookies & Children

We use cookies to keep the site working, remember your cart, and (with your consent) for analytics and ads. Manage preferences from the cookie banner or your browser. Disabling essential cookies may break parts of the site.

Our products and website are not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we will delete it.

09 Contact & Complaints

If you have questions about this policy, or want to file a complaint about how we handle your data, email us directly at info@customdrops.co.uk.

If you are in the UK, you also have the right to lodge a complaint with the UK supervisory authority: the Information Commissioner's Office (ICO) at ico.org.uk.

10 Changes To This Policy

We may update this Privacy Policy from time to time. The date at the top shows when. Material changes will be communicated by email or a prominent notice on the website. Continued use of the site after updates means you accept the changes.