Introduction to GDPR

The GDPR is a legal framework that sets guidelines for the collection and processing of personal information from individuals within the European Union and the United Kingdom. Its purpose is to protect privacy, give individuals control over their personal data and unify data protection laws across the region.

Data Controller

Palette Visuals acts as the data controller in relation to the personal data you provide. This means we determine the purpose and means of processing your data.

Categories of Personal Data Collected

We collect a variety of personal data, including:

• Name and contact details
• Billing and shipping addresses
• Order details and transaction history
• Payment information (processed by secure third-party providers)
• Personalisation instructions for engraved items
• Communication preferences
• IP address, device identifiers, browser data
• Cookies and usage analytics

Legal Basis for Processing Data

We rely on the following lawful bases for processing your data:

• Consent: Where you voluntarily opt in (e.g., to receive marketing)
• Contract: To fulfil your order and provide customer service
• Legal obligation: To meet legal and tax requirements
• Legitimate interests: To improve our services and protect against fraud

How We Use Your Data

Your personal data is used to:

• Process and deliver orders
• Communicate with you regarding orders or enquiries
• Customise products based on your input
• Send marketing communications (where consented)
• Improve website functionality and customer experience
• Maintain records for accounting and legal purposes

Data Sharing

We do not sell your data. We may share it with trusted third parties under strict data protection agreements. These include:

• Payment processors
• Delivery and logistics partners
• Email and marketing platforms
• IT service providers
• Regulatory and legal bodies (where legally required)

International Data Transfers

When personal data is transferred outside the UK or EU, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses (SCCs)
• Data transfer agreements compliant with UK ICO and EU guidelines

Your Data Rights

Under GDPR, you have the following rights:

• Right to access: You may request details of the data we hold about you
• Right to rectification: You can request corrections to inaccurate data
• Right to erasure: You can request deletion of your data (subject to legal requirements)
• Right to restrict processing: You can request limited use of your data
• Right to data portability: You can request a copy of your data in a machine-readable format
• Right to object: You can object to certain processing activities, including direct marketing
• Right to withdraw consent: Where consent is the basis, you may withdraw it at any t ime

Exercising Your Rights

Data Retention

We only retain personal data for as long as necessary to fulfil the purpose it was collected for. This includes:

• Order records: Retained for 6 years for tax and legal obligations
• Customer communications: Retained for up to 2 years
• Marketing preferences: Retained until you unsubscribe or withdraw consent

Data Security

We use industry-standard measures to secure your data:

• Encrypted communications (SSL/TLS)
• Secure password storage
• Regular backups
• Role-based access controls

We also require our partners to uphold similar data security standards.

Automated Decision Making

We do not make decisions based solely on automated processing that have legal or similarly significant effects on individuals.

Cookies and Tracking Technologies

We use cookies and similar technologies to collect usage data and enhance your browsing experience. For detailed information, please see our Cookie Policy.

Consent Management

Children’s Data

We do not knowingly collect or process data for individuals under 16. If such data is discovered, it will be promptly deleted.

Data Breaches

In the unlikely event of a data breach, we will notify affected individuals and the relevant supervisory authority within the required timeframe in accordance with GDPR.

Data Protection Officer (DPO)

While we are not legally required to appoint a DPO, our designated Data Privacy Lead ensures that our data handling practices remain compliant and responsible.

Complaints and Disputes

If you are dissatisfied with how we process your data, you may:

• Contact us directly to resolve the matter
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk

Updates to This Policy

We may revise this GDPR Data Policy as necessary to comply with changes in legislation or our practices. The most current version will always be available on our webs

Contact Information

For any questions, concerns or data-related requests, please contact:

Palette Visuals