Bold Types legal information
Privacy Notice
Updated 9 July 2026 - build 203
Who controls your information
Bold Types is the data controller. Contact: support@boldtypes.co.uk. Business correspondence address: Bold Types, Utility Office, 1 Rowan Place, Preston, PR4 3FT.
Information we collect
We collect customer contact details, one delivery address, card selections, recipient labels, personalised messages, sign-offs, uploaded photos, stickers, generated print images, occasion dates, saved-draft content, order and production status, payment references and customer-service correspondence.
Why we use it
We use this information to provide previews, take payment, fulfil the contract, create print files, manufacture and deliver cards, prevent fraud, provide support, handle refunds and comply with accounting and legal obligations.
Who receives it
We share only the information required with Cloudflare for hosting and order storage, PayPal for payment, the configured email provider, Prodigi or another disclosed white-label production and postal provider for manufacture and delivery, and Trustpilot for post-purchase review invitations. These providers process information under their own obligations and our service arrangements.
Post-purchase review email
For genuine paid orders, Bold Types sends a short review request around six days after purchase. The unique Trustpilot review-invitation address is blind-copied on that email, so Trustpilot receives the buyer’s email address, name, order reference and the contents of the review request for the purpose of processing the review invitation. Complimentary eCards, test orders and sandbox transactions are excluded.
Optional marketing preferences
At checkout you may separately choose whether Bold Types may contact you with marketing by email, text message or telephone. Each channel is optional and unticked by default. Your choices do not affect your order, payment, delivery, confirmations or customer support.
Where you opt in, we record the selected channel, the date and the consent wording version so we can respect and demonstrate your choice. You can withdraw a marketing preference at any time by contacting support@boldtypes.co.uk or using any unsubscribe option included in a marketing message. Withdrawing marketing consent does not affect processing already required for an order or our legal records.
Information about recipients
If you provide another person’s name, address or personal message, you confirm that you are entitled to use it for sending the card. Do not include unnecessary sensitive information.
For eCards, we use the message content to create a private hosted access page for 7 days. Bold Types does not ask for or use the recipient's email address to deliver the eCard. The private link is supplied to the buyer on the website and in the buyer's order receipt so the buyer can choose when and how to share it. The hosted page uses a long private access code and is not listed in public search or navigation.
Retention
Accounting and transaction records are retained as legally required. Unfinished designs saved in your browser are intended to remain for 14 days on that device. Temporary print-ready artwork for customer-personalised cards is stored privately for fulfilment, replacement and support and is normally deleted 20 days after the order is completed or cancelled, unless it is placed on an operational hold. The order, payment and fulfilment records needed for accounting, support and audit are retained separately.
Hosted eCard access pages expire after 7 days. We may still retain order records, payment records, customer support records and the order message for legal, accounting, fraud-prevention and customer-service purposes.
Your rights
Depending on the circumstances, you may have rights to access, correct, erase or restrict use of personal data, object to certain processing and complain to the UK Information Commissioner’s Office. Contact us first so we can respond.
Security
Orders are held in a protected database. Payment credentials are handled by PayPal, and production API credentials are stored as encrypted Cloudflare secrets. eCard pages use private bearer links, so anyone who receives a valid link can view that eCard during its 7-day access period. Buyers should send the link only to the intended recipient. No system can be guaranteed completely secure, but proportionate safeguards are used.
Independent maker enquiries and privacy
When the independent maker Marketplace launches, a customer may choose to send a non-binding enquiry to a named creator. We ask only for the customer's name, email address, selected items, quantities, size and colour preferences, and any optional message. We use this information to deliver the enquiry to the creator the customer has chosen, so the creator can respond about stock, price, delivery, invoicing and direct payment. The form explains the transfer before it is sent. We do not collect card payment details, create a Bold Types purchase order or use enquiry details for marketing without a separate lawful basis.
The named creator receives these details by email and is responsible for handling the subsequent communication and any sale in accordance with their own privacy information and the law. Our configured email provider processes the message for delivery. We do not create a separate database of customers' maker enquiries during the private test. An email provider and the receiving creator may retain a copy of the correspondence according to their obligations. Contact us for privacy questions about sending the enquiry, or the creator for the correspondence or transaction they handle thereafter.
Before public launch, we will document the lawful basis for this data sharing, check arrangements with creators and our email provider, and apply appropriate retention, anti-abuse and security measures. No marketing permission is inferred from an enquiry.