Privacy Policy

16vibe operates this store and is the controller of the personal data described here. We make printed goods to order: nothing in our catalogue exists until someone buys it, which shapes most of what follows — in particular that your design files and personalisation text have to reach a production partner before you can receive anything.

If you want to reach us about anything in this policy, the details are in section 15.

We collect only what an order or an account actually needs. Nothing on this list is optional decoration; if we ask for it, something breaks without it.

We do not ask for, and have no use for, your date of birth, government identity numbers, health data, or anything else in the special categories under data-protection law. If you type such information into a personalisation field, you are choosing to send it to us and to the production partner who prints it.

This is the section most privacy policies do not have, and the one that matters most in print-on-demand.

• You keep the rights to what you upload. Uploading a design does not transfer it to us. You grant us a licence to reproduce it for the sole purpose of manufacturing, packing and delivering your order, and to show it back to you in your account.
• Your files reach a production partner. To print an item we must send the artwork, the personalisation text, and enough of the order to identify it. That is not optional and is the reason you cannot order anonymously.
• We do not sell, licence or resell your designs, put them in our catalogue, or use them in marketing — unless you have separately and explicitly asked us to.
• Drafts are saved so you can come back to them. An unfinished design in the customiser stays on your account until you delete it or ask us to.

• Fulfilling your order — taking payment, sending artwork to production, quality-checking the print, generating the carrier label, and telling you where the parcel is.
• Customer support — answering your questions, handling replacement claims, and investigating a delivery that went wrong.
• Running your account — signing you in, showing your order history, and keeping your saved addresses and designs.
• Fraud and abuse prevention — spotting stolen cards, and reviewing uploads reported as infringing or unlawful.
• Improving the store — aggregated statistics about which pages and products people use. This does not require identifying you and we do not try to.
• Marketing, only if you asked for it — newsletters go to people who opted in, and every one carries a one-click unsubscribe. Opting out never affects your order.

If you are in the UK, EEA or another region with equivalent law, these are the grounds we rely on:

Where we rely on consent you can withdraw it at any time, and where we rely on legitimate interests you can object — see section 11.

We never see your full card number. Card details are entered into a form served by the payment provider and travel directly to them; they do not pass through, and are not stored on, our servers. What comes back to us is a confirmation, the last four digits and the card brand — enough to show you which card paid for which order and to issue a refund.

Our payment providers are independently certified to the PCI-DSS standard and act as controllers of the card data they hold, under their own privacy policies. Where an order is paid on delivery or by bank transfer, no card data exists at all — we hold only the payment reference and its status.

Cookies are small files stored by your browser. We group them as:

This store currently runs no third-party analytics or advertising tags. Only strictly necessary and preference cookies are set.

Analytics and marketing cookies are held back until you accept them. You can change your mind at any time through the cookie banner, and your browser settings let you refuse or delete cookies entirely — though blocking the strictly necessary ones will break the cart.

We do not sell your personal data, and we do not rent or trade mailing lists. We share only what a specific job needs, with:

If the business is ever sold or merged, personal data may transfer to the buyer as part of it. We would tell you before that happened and the protections in this policy would carry over.

Print-on-demand is a distributed business: the partner who prints your order is usually the one nearest to your delivery address, so your data may be processed in a country other than your own — including outside the UK or EEA.

Where that happens we rely on an adequacy decision covering the destination, or on Standard Contractual Clauses with the recipient, and we pass on only the fields needed to produce and deliver the order.

When a retention period ends the data is deleted or irreversibly anonymised. Records we are legally required to keep — an invoice, for example — survive an account deletion request, because the law requiring them outranks the request.

Depending on where you live, you can ask us to:

• Give you a copy of the personal data we hold about you, in a portable format.
• Correct anything that is wrong or out of date.
• Delete your data, subject to records we must keep by law.
• Restrict or object to a particular use, including profiling for marketing.
• Withdraw consent at any time, without affecting what was lawful before.
• Not be sold or “shared” for cross-context advertising — which we do not do to anyone, in any region.

Email us and we will answer within 30 days. There is no fee. We may ask you to confirm your identity first — usually by writing from the address on the order — because handing an account over to whoever asks would be the larger privacy failure. If you are unhappy with our answer you can complain to your local data-protection authority.

• Every page and form on this store is served over HTTPS, so data is encrypted in transit.
• Passwords are stored as one-way hashes. Nobody here can read yours, which is why a reset link is the only way back in.
• Card data never reaches our servers; see section 6.
• Access to order and customer records is limited to staff who need it to do their job.
• Backups are encrypted at rest.

No system is perfectly secure. If a breach ever affects your data and poses a real risk to you, we will tell you and the relevant regulator without undue delay.

This store is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, write to us and we will delete it.

We update this page when what we do with data changes. The date under the title always reflects the current version. If a change materially affects your rights we will tell you by email or a notice on the store before it takes effect, rather than relying on you to re-read the page.

Questions about this policy, or a request about your data, go to: