Privacy Policy

Last updated: 15 September 2026

At Croft Decals (www.croftdecals.co.uk), we respect your privacy and are committed to protecting your personal data. This privacy policy explains how we collect, use, store, and share your personal information when you visit our website, submit an enquiry, or purchase goods from us, in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who We Are (Data Controller)

For the purposes of the UK GDPR, the Data Controller responsible for your personal data is:

Business Name: Croft Decals
Website: www.croftdecals.co.uk
Email: info@croftdecals.co.uk
Country: United Kingdom

If you have any questions about this Privacy Policy or wish to exercise your legal data rights, please contact us using the email address above.

2. The Personal Data We Collect

We may collect, use, store, and transfer different kinds of personal information depending on how you interact with us:

Identity & Contact Data: Name, billing address, delivery address, email address, and contact telephone number.
Order & Transaction Data: Details of products you purchased, order dates, transaction reference numbers, custom text/specifications provided for vinyl cutting, and correspondence regarding your order.
Technical & Usage Data: IP address, browser type and version, time zone setting, operating system, and data on how you interact with our website (collected automatically via cookies by our hosting platform, Wix).
Communication Data: Information you provide when submitting a contact form, requesting custom artwork quotes, or messaging us via email or social media.

Note on Financial & Card Data: We never see, collect, or store your credit/debit card numbers or bank details. All transactions are securely processed directly by our third-party payment gateways (e.g. Wix Payments, Stripe, PayPal, Apple Pay) using end-to-end encryption.

3. How We Collect Your Data

Direct Interactions: When you fill in forms, create an account, purchase products at checkout, or get in touch with us by email or contact form.
Automated Technologies: As you browse our website, Wix automatically collects technical data and browsing patterns through cookies and similar tracking tools (see Section 8 below).

4. Lawful Bases for Processing Your Data

Under UK GDPR, we must have a valid lawful basis to process your personal data. We rely on the following bases:

Performance of a Contract: To process, cut, package, and dispatch your order; provide customer service; and keep you updated on delivery status.
Legal Obligation: To maintain proper sales invoices and financial accounts as required by UK law and HM Revenue & Customs (HMRC).
Legitimate Interests: To run, maintain, and protect our website; prevent fraud; and understand how customers navigate our storefront to improve our products and service.
Consent: Where you explicitly opt in to receive marketing communications or accept non-essential cookies. You can withdraw your consent at any time.

5. Who We Share Your Data With

We do not sell, rent, or trade your personal data to third parties. We only share necessary details with trusted third-party service providers who assist us in operating the business:

E-Commerce & Website Hosting: Wix.com Ltd., who host our website, catalog database, and shopping cart infrastructure.
Payment Processors: Wix Payments, Stripe, or PayPal, to securely process your payments and prevent fraudulent transactions.
Postal & Delivery Couriers: Royal Mail (or other appointed parcel carriers), who receive your delivery name, address, and contact details solely to fulfill parcel delivery and tracking.
Email & Communication Providers: Services used to route our customer emails and send automated order confirmations.
Legal & Regulatory Authorities: Law enforcement, tax authorities (HMRC), or legal advisors where required by applicable UK law.

All third-party service providers are required to take appropriate technical and organisational measures to protect your personal data in line with UK GDPR standards.

6. International Data Transfers

Our website is built on Wix. Wix is a global platform that uses secure data centres located in the EU, the United States, and other jurisdictions. Where personal data is transferred outside of the UK, Wix ensures adequate safeguards are in place (such as UK International Data Transfer Agreements or Standard Contractual Clauses approved by the Information Commissioner’s Office).

7. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purposes we collected it for:

Order & Transaction Records: Retained for 6 full tax years following the end of the tax year of the transaction, to comply with statutory UK accounting and HMRC tax record-keeping requirements.
Enquiries & Custom Quote Correspondence: Retained for up to 12 months from your last contact, after which it is securely deleted or anonymised.
Website Analytics Data: Retained according to Wix's standard cookie retention policies (typically between a single session and 12 months).

8. Cookies & Tracking Technologies

Our website uses essential cookies necessary for the basic operation of the shop (such as remembering the contents of your shopping cart, keeping you logged in, and maintaining security during checkout).

Non-essential cookies (such as performance analytics or social media widgets like Instagram) are deployed only in accordance with your cookie banner preferences. You can adjust your browser settings to refuse some or all cookies, but certain shopping cart functions may become unavailable.

9. Your Legal Rights Under UK GDPR

Under UK data protection law, you have specific rights regarding your personal information:

Right of Access: You have the right to request a copy of the personal data we hold about you (Subject Access Request).
Right to Rectification: You have the right to ask us to correct inaccurate or incomplete data.
Right to Erasure ("Right to be Forgotten"): You can ask us to delete your personal data where there is no good reason for us continuing to process it (excluding data we are legally mandated to retain for HMRC tax records).
Right to Restrict or Object to Processing: You can object to the processing of your data in certain circumstances, including direct marketing.
Right to Data Portability: You can request the transfer of your personal data to you or a third party in a structured, machine-readable format.

To exercise any of these rights, please email us at [Insert contact email]. We do not charge a fee for standard requests and will respond within one calendar month.

10. How to Complain

If you have concerns about how we handle your personal data, we ask that you please contact us first so we can resolve the issue directly.

If you remain dissatisfied, you have the legal right to lodge a complaint with the UK supervisory authority for data protection:

Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Helpline: 0303 123 1113