Privacy Policy

What we collect and why

What we need depends on what you ask us to do.

Browsing the website

Our website and hosting services receive basic request, IP address, browser and device information. We use it to deliver pages, keep the website secure, prevent abuse and diagnose faults.

Cookies and similar browser storage may also remember a live Quote, private Order Request page or display choice. Our Cookie Policy explains what is stored on your device and how to change your choices.

Quotes, samples, enquiries and Orders

If you ask us to email a Quote, send a sample, answer an enquiry or deal with an Order Request, we may collect:

• your name, organisation and contact details;
• billing, invoice and delivery information;
• product choices, quantities, prices and delivery or collection choices;
• messages, instructions and contact preferences;
• purchase-order and other administrative information; and
• payment references, status and refund information.

You can build a live website Quote without giving us your contact details. We need enough information to respond when you ask us to email it or take another action.

An Order Request is not an accepted Order. If we accept it, we create the business, accounting and production records needed to make, deliver, invoice and support the Goods.

An individual mailing offer may include the name of a school or organisation as a short welcome. We use it only to present the intended offer and do not send that name to website measurement providers. We normally remove this personalisation after 365 days while retaining the non-personal discount rules and operational history needed to honour or account for the offer.

Artwork, photographs and other files

You may give us artwork, logos, photographs, mailing information or other files for a Quote or Order. We use them only for the relevant work, support and closely related administration.

If a Customer gives us personal information to process on its behalf, such as a mailing list or school-calendar photographs, the Customer will normally decide why that information is used. In that case, the Customer is normally the controller and Think Promote acts on its instructions. Our Trade Terms contain the contractual terms for that processing.

The organisation supplying the information remains responsible for its privacy information, permissions and other lawful basis.

Payments and website emails

Stripe processes card payments and any card refunds we arrange. Card numbers and security codes are entered into Stripe’s payment service and do not pass through our website server or enter our website database. We keep safe references and transaction information needed to prevent duplicates, reconcile payments and deal with payment queries. Our team handles refund requests separately. Read Stripe’s Privacy Policy for its own use of payment information.

We may keep a limited delivery record for email sent by the website, such as the recipient, subject, message type, time and outcome. Ordinary correspondence may be kept in our usual business systems.

Information we receive from other people

We may receive information about you from an employer, school, charity or other organisation, an approved sales agent, a customer arranging personalisation or mailing, a payment provider, a courier or another supplier involved in the work.

We use that information for the purpose for which it was supplied and any closely related legal, security or record-keeping need.

Website measurement

Anonymous statistics (on by default)

We collect anonymous daily statistics to understand how people find and use our website, including pages, product discovery, Quotes and forms. These cover general traffic sources, campaigns, errors, approximate location, screen size, scrolling and active time. We also count initial cookie questions, choices and broad decision-time bands to check whether the question disrupts the website.

We don’t track individual reading times, link traffic sources to later actions or build browsing histories. Small groups are combined or excluded from reports. You can switch these statistics off in the footer.

Vercel Web Analytics, when enabled, counts visits to approved public pages using limited page, referral, location and device information. It excludes URL query strings and private areas. It uses no analytics cookies or permanent cross-site identifiers, and discards its temporary visitor reference after 24 hours. We never use these reports to identify individuals or make decisions about them.

For UK visitors, we rely on the statistical-purpose exception under PECR. Any personal data needed to produce these statistics is processed under our legitimate interest in improving the website, with limited collection and the option to object.

Detailed analytics (with your consent)

PostHog and Google Analytics measure visits and interactions using pseudonymous browser and session identifiers.

PostHog collects general device, browser, operating-system and screen-width information. Google Analytics may collect more detailed device and software information, including screen resolution, and estimate your location down to city level. Location estimates may be inaccurate, especially when using a VPN.

General traffic sources, referral domains and campaign labels may be linked to actions within a measured session. We don’t reconstruct activity before consent or maintain permanent customer attribution records.

PostHog may also collect performance measurements and heatmaps on approved public pages, excluding legal content. These record performance, click positions and scrolling, not form entries or page text.

Sampled session replays may cover approved public pages, My Quote and checkout details and review. Public text, labels, product choices, prices and media remain visible. Personal details, free-text entries, filenames, individual discount codes and Quote references are masked. Replays exclude legal pages, private confirmations, payment fields and the Quote-transfer panel.

Advertising measurement (with your consent)

Google Ads measures sample requests, enquiries, Quote-help requests and Order Requests where an estimated business value is available. This is not an actual purchase price or accepted Order.

We don’t use enhanced conversions, remarketing or personalised advertising.

What we never share through measurement

We don’t send names, contact details, messages, uploaded files, payment information, recipient or organisation identifiers, or private campaign tokens in website measurement events. Anonymous statistics are never used for advertising.

Our Cookie Policy explains the storage, retention periods and controls for each measurement option.

Our legal reasons for using information

We use personal information only where we have a lawful reason. Depending on the circumstances, this can be:

• Contract or steps before a contract: to prepare a Quote, handle an Order Request, take or reconcile payment, fulfil an accepted Order and provide related support.
• Legitimate interests: to answer business enquiries, manage customer and sales-agent relationships, assess sample requests, keep reasonable records, prevent fraud or abuse, improve the website and resolve problems. We consider whether those interests are outweighed by your rights.
• Legal obligations: for tax, accounting, regulatory requirements and legal claims.
• Consent: for optional detailed analytics, advertising measurement, remembered display choices and marketing where consent is required.

A Quote, Order Request confirmation, payment receipt or Order email is not permission to send unrelated marketing.

Who receives information

We do not sell personal information.

We use suppliers where reasonably needed to run the website and carry out work. These include:

• Neon for databases, Amazon Web Services for file storage, and Vercel for hosting and cookieless public-page statistics;
• Resend for website email and Upstash for rate limiting and abuse prevention;
• GitHub for automated database backups;
• Stripe for card payments and refunds;
• PostHog for aggregate statistics and consented analytics;
• Google for consented Google Analytics and advertising measurement;
• approved sales agents, production suppliers, couriers and postal services where relevant;
• accountants, professional advisers and insurers; and
• regulators, courts, law-enforcement bodies or other authorities where disclosure is required or legally appropriate.

We aim to give each recipient only the information reasonably needed for its role. Where a supplier processes personal information on our behalf, we require appropriate data-protection arrangements.

Information processed outside the UK

Some suppliers may process information outside the United Kingdom. Where UK data-protection law restricts a transfer, we use an applicable adequacy decision, contractual safeguard or other lawful mechanism.

Contact us if you need more information about the safeguard used for a particular transfer.

How long we keep information

We keep information according to its purpose, not as one permanent customer record.

• Live Quotes are kept while they remain useful for returning to, following up or dealing with a related enquiry, then expire under our retention settings.
• Order Requests, payments, accepted Orders, invoices and accounting records are kept for the time needed for operational, tax, contractual, dispute and other legal requirements.
• Customer files are kept only while reasonably needed to quote for, prepare, produce or support the relevant work, subject to an overall retention limit.
• Website email records, technical logs and security information are normally kept for shorter periods suited to delivery, troubleshooting and abuse prevention.
• Daily website counters are held locally for a short period while completed summaries are exported. Exported information follows the receiving provider’s retention arrangements.
• Vercel keeps aggregate Web Analytics reports under the reporting and retention arrangements for our selected plan. Its temporary daily visitor identifier is discarded after 24 hours.
• Detailed website analytics follows the retention arrangements selected in PostHog and Google Analytics. Our browser identifiers expire sooner as described in the Cookie Policy.

Legal, accounting, dispute or security needs can require us to keep particular information for longer. When information is no longer needed, we delete, anonymise or securely dispose of it through our normal systems and backup processes.

Restricted disaster recovery copies can retain information until they expire under our backup schedule. We use them for recovery, not ordinary work. After a restore, we reapply relevant deletion requests and retention rules before returning the system to use.

Security

We use technical and organisational safeguards appropriate to the information and system. These can include access controls, private or hashed tokens, restricted inputs, rate limits, malware scanning and payment protections.

No website or information system can be guaranteed completely secure.

Your right to object

You can object to processing based on legitimate interests. You can always object to direct marketing. Email compliance@thinkpromote.co.uk and tell us what you object to.

Anonymous site statistics can be switched on or off directly in the footer. Rejecting optional cookies does not change this separate switch. The Cookie choices panel lets you withdraw detailed analytics or advertising consent at any time. A change stops future collection for that purpose. Information already combined into anonymous totals or reports cannot be traced back to you.

Your other rights

Depending on the information and why we use it, you may also have the right to:

• ask for a copy of your personal information;
• correct inaccurate or incomplete information;
• ask us to delete or restrict information;
• receive certain information in a portable format; and
• withdraw consent where we rely on it.

These rights are not absolute. We may need to keep some information for contractual, accounting or legal reasons, and we may need to confirm your identity before acting on a request.

To exercise a right or ask a question, email compliance@thinkpromote.co.uk.

Complaints

Please contact us if you think we have handled your information incorrectly so that we can investigate. You can also complain to the Information Commissioner’s Office (ICO), the UK data-protection regulator. Contacting us first does not affect that right.

Changes to this policy

We may update this policy when our website, services, suppliers or legal obligations change. We will publish the current version here and update the review date.

If we introduce a materially different use of personal information, we will bring it to your attention before starting where required.