Privacy Policy

What we collect and why

What we need depends on what you ask us to do.

Browsing the website

Our website and hosting services receive basic request, IP address, browser and device information. We use it to deliver pages, keep the website secure, prevent abuse and diagnose faults.

Cookies and similar browser storage may also remember a live Quote, private Order Request page or display choice. Our Cookie Policy explains what is stored on your device and how to change your choices.

Quotes, samples, enquiries and Orders

If you ask us to email a Quote, send a sample, answer an enquiry or deal with an Order Request, we may collect:

• your name, organisation and contact details;
• billing, invoice and delivery information;
• product choices, quantities, prices and delivery or collection choices;
• messages, instructions and contact preferences;
• purchase-order and other administrative information; and
• payment references, status and refund information.

You can build a live website Quote without giving us your contact details. We need enough information to respond when you ask us to email it or take another action.

An Order Request is not an accepted Order. If we accept it, we create the business, accounting and production records needed to make, deliver, invoice and support the Goods.

An individual mailing offer may include the name of a school or organisation as a short welcome. We use it only to present the intended offer and do not send that name to website measurement providers. We normally remove this personalisation after 365 days while retaining the non-personal discount rules and operational history needed to honour or account for the offer.

Artwork, photographs and other files

You may give us artwork, logos, photographs, mailing information or other files for a Quote or Order. We use them only for the relevant work, support and closely related administration.

If a Customer gives us personal information to process on its behalf, such as a mailing list or school-calendar photographs, the Customer will normally decide why that information is used. In that case, the Customer is normally the controller and Think Promote acts on its instructions. Our Trade Terms contain the contractual terms for that processing.

The organisation supplying the information remains responsible for its privacy information, permissions and other lawful basis.

Payments and website emails

Stripe processes card payments and any card refunds we arrange. Card numbers and security codes are entered into Stripe’s payment service and do not pass through our website server or enter our website database. We keep safe references and transaction information needed to prevent duplicates, reconcile payments and deal with payment queries. Our team handles refund requests separately. Read Stripe’s Privacy Policy for its own use of payment information.

We may keep a limited delivery record for email sent by the website, such as the recipient, subject, message type, time and outcome. Ordinary correspondence may be kept in our usual business systems.

Information we receive from other people

We may receive information about you from an employer, school, charity or other organisation, an approved sales agent, a customer arranging personalisation or mailing, a payment provider, a courier or another supplier involved in the work.

We use that information for the purpose for which it was supplied and any closely related legal, security or record-keeping need.

Website measurement

Anonymous site statistics are enabled by default for public traffic everywhere. We use daily totals to see how people reach the website and whether pages, product discovery, Quotes and forms work. These include broad landing sources, registered campaigns, technical failures, estimated country and grouped page width, scrolling and active time. We do not keep individual reading times, link a landing source to later actions or create a personal browsing history. Small groups are combined or withheld before export. You can switch these statistics off in the footer.

When enabled, Vercel Web Analytics also counts visits to approved public pages. It can receive the page path without its query string, previous website, coarse location and device or browser information. Private and sensitive areas are excluded. It uses no analytics cookie or permanent cross-site identifier; its temporary daily visitor reference is discarded after 24 hours. We do not use these aggregate reports to identify or make decisions about anyone.

For UK traffic, we use the statistical-purpose exception in PECR for these anonymous statistics. Any personal-data processing needed to produce them relies on our legitimate interest in improving the website, with limited collection and an easy way to object.

With your separate consent, PostHog and Google Analytics measure visits and actions in more detail. They use pseudonymous browser and session references. Broad channel, reduced referral domain and short, shared campaign labels can follow actions within that measured session, but we do not keep a permanent customer attribution record.

PostHog may also measure performance on approved public pages and heatmaps on those pages except legal content. These measurements contain numeric performance, click-position and scrolling information, without form entries or page text.

A sample of masked session replays may cover approved public pages, My Quote and checkout details. Public page text and form labels remain visible. Form entries, customer-specific details, filenames and Quote references are hidden. Replay excludes legal pages, checkout review, payment areas, private pages and the Quote-transfer panel.

With separate advertising consent, Google Ads can measure submitted sample requests, enquiries, Quote-help requests and Order Requests where an estimated business value is available. That value is not the price charged or an accepted Order. We do not use enhanced conversions, remarketing or personalised advertising.

We do not send names, contact details, messages, uploaded files, card details, payment references, recipient or organisation identifiers or private campaign tokens in website measurement events. Anonymous statistics are not used for advertising. Our Cookie Policy explains the browser storage, durations and controls for each choice.

Our legal reasons for using information

We use personal information only where we have a lawful reason. Depending on the circumstances, this can be:

• Contract or steps before a contract: to prepare a Quote, handle an Order Request, take or reconcile payment, fulfil an accepted Order and provide related support.
• Legitimate interests: to answer business enquiries, manage customer and sales-agent relationships, assess sample requests, keep reasonable records, prevent fraud or abuse, improve the website and resolve problems. We consider whether those interests are outweighed by your rights.
• Legal obligations: for tax, accounting, regulatory requirements and legal claims.
• Consent: for optional detailed analytics, advertising measurement, remembered display choices and marketing where consent is required.

A Quote, Order Request confirmation, payment receipt or Order email is not permission to send unrelated marketing.

Who receives information

We do not sell personal information.

We use suppliers where reasonably needed to run the website and carry out work. These include:

• Neon for databases, Amazon Web Services for file storage, and Vercel for hosting and cookieless public-page statistics;
• Resend for website email and Upstash for rate limiting and abuse prevention;
• GitHub for automated database backups;
• Stripe for card payments and refunds;
• PostHog for aggregate statistics and consented analytics;
• Google for consented Google Analytics and advertising measurement;
• approved sales agents, production suppliers, couriers and postal services where relevant;
• accountants, professional advisers and insurers; and
• regulators, courts, law-enforcement bodies or other authorities where disclosure is required or legally appropriate.

We aim to give each recipient only the information reasonably needed for its role. Where a supplier processes personal information on our behalf, we require appropriate data-protection arrangements.

Information processed outside the UK

Some suppliers may process information outside the United Kingdom. Where UK data-protection law restricts a transfer, we use an applicable adequacy decision, contractual safeguard or other lawful mechanism.

Contact us if you need more information about the safeguard used for a particular transfer.

How long we keep information

We keep information according to its purpose, not as one permanent customer record.

• Live Quotes are kept while they remain useful for returning to, following up or dealing with a related enquiry, then expire under our retention settings.
• Order Requests, payments, accepted Orders, invoices and accounting records are kept for the time needed for operational, tax, contractual, dispute and other legal requirements.
• Customer files are kept only while reasonably needed to quote for, prepare, produce or support the relevant work, subject to an overall retention limit.
• Website email records, technical logs and security information are normally kept for shorter periods suited to delivery, troubleshooting and abuse prevention.
• Daily website counters are held locally for a short period while completed summaries are exported. Exported information follows the receiving provider’s retention arrangements.
• Vercel keeps aggregate Web Analytics reports under the reporting and retention arrangements for our selected plan. Its temporary daily visitor identifier is discarded after 24 hours.
• Detailed website analytics follows the retention arrangements selected in PostHog and Google Analytics. Our browser identifiers expire sooner as described in the Cookie Policy.

Legal, accounting, dispute or security needs can require us to keep particular information for longer. When information is no longer needed, we delete, anonymise or securely dispose of it through our normal systems and backup processes.

Restricted disaster recovery copies can retain information until they expire under our backup schedule. We use them for recovery, not ordinary work. After a restore, we reapply relevant deletion requests and retention rules before returning the system to use.

Security

We use technical and organisational safeguards appropriate to the information and system. These can include access controls, private or hashed tokens, restricted inputs, rate limits, malware scanning and payment protections.

No website or information system can be guaranteed completely secure.

Your right to object

You can object to processing based on legitimate interests. You can always object to direct marketing. Email compliance@thinkpromote.co.uk and tell us what you object to.

Anonymous site statistics can be switched on or off directly in the footer. Rejecting optional cookies does not change this separate switch. The Cookie choices panel lets you withdraw detailed analytics or advertising consent at any time. A change stops future collection for that purpose. Information already combined into anonymous totals or reports cannot be traced back to you.

Your other rights

Depending on the information and why we use it, you may also have the right to:

• ask for a copy of your personal information;
• correct inaccurate or incomplete information;
• ask us to delete or restrict information;
• receive certain information in a portable format; and
• withdraw consent where we rely on it.

These rights are not absolute. We may need to keep some information for contractual, accounting or legal reasons, and we may need to confirm your identity before acting on a request.

To exercise a right or ask a question, email compliance@thinkpromote.co.uk.

Complaints

Please contact us if you think we have handled your information incorrectly so that we can investigate. You can also complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. Contacting us first does not affect that right.

Changes to this policy

We may update this policy when our website, services, suppliers or legal obligations change. We will publish the current version here and update the review date.

If we introduce a materially different use of personal information, we will bring it to your attention before starting where required.