Privacy policy

Last updated: 5 November 2026

This notice explains how PrintPost handles personal information when you browse our website, contact us, apply for a business account, discuss an integration or use our printing and fulfilment services. It also covers personal information that a business supplies about the people receiving its orders.

Who we are and how to contact us

PrintPost is a trading name of G M C MARKETING LIMITED, registered in England and Wales under company number 05083485. Our registered office is Unit C Cartel Business Estate, Edinburgh Way, Harlow, Essex, CM20 2TT, United Kingdom.

For privacy questions or to exercise your rights, email charlie@printpost.co.uk or write to our registered office, marked “Privacy”. For general service enquiries, visit our contact page.

We are responsible as a controller for information we use to manage our website, business relationships and legal obligations. When we process recipient information or artwork on a seller’s behalf, the relevant service and data-processing arrangements determine our responsibilities. If your information was supplied by a seller, we may need to work with that seller to answer your request.

Information we handle and where it comes from

• Business applications and accounts: your name, business and contact details, store URL, business country, account identifiers, permissions, ordering region and communications about access. We review business-account applications before granting ordering access.
• Enquiries and integration discussions: the contact details, business requirements, platform information and other information you choose to send us.
• Orders and delivery: order references, products, sizes, quantities, instructions, billing and delivery details, recipient contact details, payment status, transaction records and service correspondence. Payment providers process the payment details needed for checkout.
• Artwork: uploaded originals, filenames, previews or thumbnails, file information and instructions associated with a print job. Artwork may itself contain personal information.
• Website and device information: IP address, browser and device information, identifiers, page and service interactions, preferences and consent choices, including information collected through cookies or similar technologies.

We receive information directly from you; from the seller or business placing an order; through an authorised store connection; automatically when the website is used; and from providers supporting accounts, payments, delivery, security or other requested services. We may review the store URL and business information supplied with an application.

Where a form or ordering step requires information, we need it to assess the application, answer the request or provide the relevant service. If it is not supplied, we may be unable to complete that step. Please provide only information needed for the job and make sure you are entitled to share artwork and other people’s details with us. Do not put passwords, sign-in codes, payment-card details or customer artwork in an ordinary enquiry message.

Why we use information

For processing for which we are the controller, the applicable UK or EEA lawful basis depends on the purpose:

• Applications, enquiries and business administration: our legitimate interests in assessing business suitability, responding to requests and managing the relationship with the business you represent. Where you personally are entering into a contract with us, we use the information necessary to take steps you request before that contract and to perform it.
• Providing orders and support: performance of our contract where you are personally a party to it; otherwise our legitimate interests in delivering and supporting the services requested by our business customer, including communicating with its authorised contacts.
• Security and service reliability: our legitimate interests in protecting accounts and files, preventing fraud or misuse, investigating problems and maintaining a reliable service.
• Business records and legal matters: compliance with applicable accounting, tax and other legal obligations; and our legitimate interests in resolving disputes, establishing or defending legal claims and protecting our business.
• Optional marketing and tracking: consent where required for the communication or technology, with the ability to withdraw it. The cookie and Shopify sections below explain the available choices.

We consider people’s rights and reasonable expectations when relying on legitimate interests. Applying for an account or sending an integration enquiry is not, by itself, permission for unrelated marketing. You can unsubscribe from promotional emails using their unsubscribe link. Service messages about an application, account or order are separate from promotional messages.

Artwork uploads and file access

Our online ordering service uses Upload-Lift, provided by Cloudlift, to receive and associate artwork with a print job. Originals and the previews or thumbnails used to review a job are different files; a preview does not replace or correct the production original.

Cloudlift describes temporary working copies and archived files separately. A working-copy link can be opened by someone who has that link without signing in, so do not share it unnecessarily. Cloudlift states that temporary working copies expire within 30 days. Automatic archive expiry is currently switched off in our Upload-Lift settings, so archived files remain until deleted. This is not a promise that every PrintPost or production copy is deleted after 30 days.

Our current Upload-Lift storage location for new uploads is the United States. Changing that setting does not automatically move files already stored elsewhere.

For portal orders, artwork is currently downloaded to a production machine and loaded into the printing software. The downloaded files are deleted at the end of each day. This routine applies to those downloaded files; it is not a statement that Upload-Lift archives or every other system copy are erased at the same time.

Businesses using connected automated production can opt in to cloud retention of artwork so that the same artwork can be used for continuous printing and ongoing orders. Retention for that service follows the ongoing production arrangement and the retention criteria below.

Files and order information are used to prepare, produce, deliver and support the requested job. Access arrangements for a connected production workflow should not be assumed to apply to every portal upload link. Removing an item from a basket or expiry of a link does not, by itself, establish that all archived, order-linked or production records have been erased. Contact us about deletion requests.

Further information is available in Cloudlift’s security and privacy information and its data-processing agreement.

Who receives information

We share information needed for the relevant purpose with:

• Shopify, which hosts this store and supports accounts, checkout, order administration, forms and workflows;
• Cloudlift, which provides the artwork-upload service;
• staff, production operations and relevant group businesses involved in preparing, making or supporting an order;
• payment, delivery, hosting, communications, security and other service providers supporting the service;
• professional advisers or authorities where needed for a legal obligation, dispute, claim or business transaction; and
• other recipients where you request or authorise the disclosure.

Depending on the service, providers act on our instructions or are responsible for some processing in their own right. Production and delivery require information to reach the relevant operation or carrier. The Shopify section below also explains processing connected with enhanced services and advertising choices.

Shopify and enhanced services

Shopify receives information when you visit or use this store so that it can provide and improve the services. Shopify reports our store’s primary customer-data hosting location as the European Union. This describes hosting, not an EU-only limit on all processing: Shopify and providers supporting it may process information in other countries.

We use Shopify enhanced services to help protect, operate and improve our business. These services can use information about interactions with this store together with interactions with other merchants and Shopify. Some enhanced services support personalisation or advertising based on activity across merchants and websites. Shopify is responsible for its processing for these purposes, including the rights requests that relate to that processing.

Read the Shopify Consumer Privacy Policy. You can learn about and exercise relevant Shopify privacy rights, including withdrawing consent or objecting to enhanced-service processing where available, through the Shopify Privacy Portal.

Cookies, consent and advertising choices

We and our service providers, including Shopify, use cookies and similar technologies for the website’s operation and for optional purposes such as personalisation, analytics and advertising. Necessary technologies support functions such as sign-in, security, the basket and remembering choices. Where consent is required, optional purposes depend on your choice.

Use Cookie preferences in the website footer to review or change the available choices, including rejecting optional categories or withdrawing consent. You can also manage browser storage through your browser, although blocking necessary technologies can affect the service. A choice on one browser or device may need to be set separately on another.

Some uses of information for advertising across different businesses may be described as a “sale”, “sharing” or “targeted advertising” under certain US state laws. Where applicable, use Your Privacy Choices to opt out. Shopify’s privacy controls also recognise the Global Privacy Control signal in regions where the relevant opt-out applies. You can contact us using the privacy email above about your choices or rights.

International processing

PrintPost’s production network includes the UK, the Netherlands and the United States. Your order’s destination and service determine which operation needs its information. Website, upload, payment and other providers can also process information outside the UK or the country where you live, including in the United States. Choosing UK production does not mean that every website or upload record is stored in the UK.

For transfers from the UK or EEA that require safeguards, we rely on the applicable adequacy decision or recognised contractual safeguards, such as the EU Standard Contractual Clauses and relevant UK provisions. You can contact us for information about the safeguards relevant to your data and how to obtain a copy. Cloudlift publishes its providers and transfer arrangements in its subprocessor list; Shopify explains its arrangements in its privacy information.

How long information is kept

We retain personal information for the purposes described in this notice, taking account of the following criteria:

• Enquiries and applications: whether the enquiry or review is still active, the resulting business relationship and any follow-up, complaint or dispute that needs a record.
• Accounts, orders and payment records: the period of the business relationship, completing and supporting orders, and applicable accounting, tax, contractual or legal record requirements.
• Artwork and production records: the current daily deletion routine for downloaded portal files described above; completing and supporting the job; opted-in cloud retention for connected customers’ ongoing printing; relevant storage settings, deletion requests and records needed for a dispute or legal obligation.
• Technical and preference records: the function of the technology, its security or troubleshooting purpose and the period needed to respect a consent, objection or communication preference.

Different records can have different retention periods. Temporary upload links, archived originals, production copies and backups should not be treated as one record with one expiry date. We do not promise indefinite artwork storage or a reusable artwork archive through this notice. Contact us to ask about information associated with a particular account or job, or to request deletion. Some information may need to be kept to meet a legal obligation or resolve a claim.

Security

We use technical and organisational measures appropriate to the service to protect personal information. No website or storage system can be guaranteed completely secure. Keep account access and sign-in codes private, share artwork links only where necessary and contact us promptly if you think information has been accessed improperly.

Your rights

Depending on the applicable law and circumstances, you may be entitled to access information about you, receive a copy, correct inaccuracies, request deletion, restrict processing or receive certain information in a portable form. Where processing relies on consent, you can withdraw it without affecting processing that took place lawfully before withdrawal.

Right to object: you can object to processing based on legitimate interests because of your particular situation. You can object to use of your personal information for direct marketing at any time.

Use the controls described above or contact charlie@printpost.co.uk. We may need reasonable information to verify your identity and find the relevant records. An authorised representative may make a request where the law allows, with appropriate evidence of authority. We will respond within the period required by applicable law and explain any applicable exception. We will not discriminate against you for exercising privacy rights.

If a seller supplied your details for fulfilment, you can contact that seller or contact us so that we can identify the appropriate route. If an applicable US state law gives you a right to appeal a privacy-request decision, reply using the same privacy contact to request a review.

Complaints

You can raise a privacy concern with us using the contact details above. You also have the right to complain to the UK Information Commissioner’s Office or the relevant supervisory authority. EEA residents can find their authority through the European Data Protection Board. You do not have to contact us before approaching an authority.

Children, other websites and updates

Our service is intended for business users, not children opening accounts. If you believe a child has provided personal information directly to us inappropriately, please contact us. Sellers should avoid including unnecessary personal information in artwork or instructions.

Other websites linked from our pages have their own privacy practices. Check their notices before giving them information.

We may update this notice when our services, practices or legal requirements change. The date above identifies the latest version. We will provide any additional notice required by applicable law.