Bold Types legal information

Privacy Notice

Effective for commerce test version v60 · 20 June 2026

Required before public launch: insert the business correspondence address and final retention schedule.

Who controls your information

Robert Mottershead trading as Bold Types is the data controller. Contact: support@boldtypes.co.uk. Address: [INSERT BUSINESS CORRESPONDENCE ADDRESS BEFORE LAUNCH].

Information we collect

We collect customer contact details, one delivery address, card selections, recipient labels, personalised messages, sign-offs, uploaded photos, stickers, generated inside print images, occasion dates, order and production status, payment references and customer-service correspondence.

Why we use it

We use this information to provide previews, take payment, fulfil the contract, create print files, manufacture and deliver cards, prevent fraud, provide support, handle refunds and comply with accounting and legal obligations.

Who receives it

We share only the information required with Cloudflare for hosting and order storage, PayPal for payment, the configured email provider, and Prodigi or another disclosed white-label production and postal provider for manufacture and delivery. These providers process information under their own obligations and our service arrangements.

Information about recipients

If you provide another person’s name, address or personal message, you confirm that you are entitled to use it for sending the card. Do not include unnecessary sensitive information.

Retention

Accounting and transaction records are retained as legally required. Uploaded material and generated print images are stored privately for fulfilment, replacement and support, and should be removed when no longer reasonably needed. A Cloudflare R2 lifecycle rule should delete customer print assets after 60 days before public launch. The final operational retention periods must be documented before launch.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict use of personal data, object to certain processing and complain to the UK Information Commissioner’s Office. Contact us first so we can respond.

Security

Orders are held in a protected database. Payment credentials are handled by PayPal, and production API credentials are stored as encrypted Cloudflare secrets. No system can be guaranteed completely secure, but proportionate safeguards are used.