Bold Types legal information

Privacy Notice

Updated 9 July 2026 - build 203

Who controls your information

Bold Types is the data controller. Contact: support@boldtypes.co.uk. Business correspondence address: Bold Types, Utility Office, 1 Rowan Place, Preston, PR4 3FT.

Information we collect

We collect customer contact details, one delivery address, card selections, recipient labels, personalised messages, sign-offs, uploaded photos, stickers, generated print images, occasion dates, saved-draft content, order and production status, payment references and customer-service correspondence.

Why we use it

We use this information to provide previews, take payment, fulfil the contract, create print files, manufacture and deliver cards, prevent fraud, provide support, handle refunds and comply with accounting and legal obligations.

Who receives it

We share only the information required with Cloudflare for hosting and order storage, PayPal for payment, the configured email provider, Prodigi or another disclosed white-label production and postal provider for manufacture and delivery, and Trustpilot for post-purchase review invitations. These providers process information under their own obligations and our service arrangements.

Post-purchase review email

For genuine paid orders, Bold Types sends a short review request around six days after purchase. The unique Trustpilot review-invitation address is blind-copied on that email, so Trustpilot receives the buyer’s email address, name, order reference and the contents of the review request for the purpose of processing the review invitation. Complimentary eCards, test orders and sandbox transactions are excluded.

Optional marketing preferences

At checkout you may separately choose whether Bold Types may contact you with marketing by email, text message or telephone. Each channel is optional and unticked by default. Your choices do not affect your order, payment, delivery, confirmations or customer support.

Where you opt in, we record the selected channel, the date and the consent wording version so we can respect and demonstrate your choice. You can withdraw a marketing preference at any time by contacting support@boldtypes.co.uk or using any unsubscribe option included in a marketing message. Withdrawing marketing consent does not affect processing already required for an order or our legal records.

Information about recipients

If you provide another person’s name, address or personal message, you confirm that you are entitled to use it for sending the card. Do not include unnecessary sensitive information.

For eCards, we use the message content to create a private hosted access page for 7 days. Bold Types does not ask for or use the recipient's email address to deliver the eCard. The private link is supplied to the buyer on the website and in the buyer's order receipt so the buyer can choose when and how to share it. The hosted page uses a long private access code and is not listed in public search or navigation.

Retention

Accounting and transaction records are retained as legally required. Unfinished designs saved in your browser are intended to remain for 14 days on that device. Uploaded material and generated print images are stored privately for fulfilment, replacement and support, and should be removed when no longer reasonably needed.

Hosted eCard access pages expire after 7 days. We may still retain order records, payment records, customer support records and the order message for legal, accounting, fraud-prevention and customer-service purposes.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase or restrict use of personal data, object to certain processing and complain to the UK Information Commissioner’s Office. Contact us first so we can respond.

Security

Orders are held in a protected database. Payment credentials are handled by PayPal, and production API credentials are stored as encrypted Cloudflare secrets. eCard pages use private bearer links, so anyone who receives a valid link can view that eCard during its 7-day access period. Buyers should send the link only to the intended recipient. No system can be guaranteed completely secure, but proportionate safeguards are used.