Data controller: Paul May trading as Engrave Express, Unit 1 Ballowall Terrace, St Just, Penzance, Cornwall, TR19 7BG. Email: paul@engravespec.co.uk.
Information we collect
We collect information you provide when creating an account, saving a design, placing an order or contacting us. This can include your name, email address, telephone number, delivery and billing address, order reference, plaque artwork, uploaded logos, design notes and customer-support correspondence. Stripe provides payment status and limited transaction information; we do not receive or store complete card details.
Why we use it and our lawful bases
We use information to prepare quotes and designs, take payment, manufacture and deliver orders, provide accounts and password recovery, send essential order updates, prevent fraud, keep accounting records and handle complaints. The usual lawful bases are performance of a contract, steps requested before entering a contract, compliance with legal obligations and our legitimate interests in operating and protecting the business. We do not use order information for unrelated marketing without a separate lawful basis.
Who we share information with
Information is shared only where needed with service providers supporting the website and orders, including Cloudflare for hosting and storage, Stripe for payment processing, Resend for transactional email and the postal or courier service used for delivery. Professional advisers, insurers, regulators or law-enforcement bodies may receive information where legally required or necessary to protect legal rights.
International processing
Some technology providers may process information outside the UK. Where this happens, we rely on the provider's contractual and legal safeguards for international transfers and limit the information shared to what is needed for the service.
How long we keep information
Unpaid or failed checkout records and associated production files are normally removed after 30 days. Expired sessions, reset links and security counters are removed automatically. Paid-order and accounting records are normally retained for up to six years. Saved designs remain until you delete them or ask us to close the account, subject to records that must be retained for legal, accounting or dispute purposes.
Cookies and local storage
The site uses an essential secure session cookie when you sign in. The designer and basket use browser local storage to preserve work in progress and basket contents on your device. These features are necessary for the service and are not used for advertising. You can clear them using your browser controls, although doing so may remove unsaved designs or basket items.
Your rights
Depending on the circumstances, you may ask for access to your information, correction, deletion, restriction, objection or a portable copy. You may also complain to the Information Commissioner's Office. Contact us first at paul@engravespec.co.uk so we can investigate.
Security
Account sessions use secure HTTP-only cookies. Passwords are stored using a salted password-derived hash. Verification and reset links are single-use and time-limited. Service credentials are stored as encrypted Cloudflare secrets. No online service can guarantee absolute security, so do not place unnecessary sensitive information in plaque artwork.
Updates
This notice may be updated when the service, suppliers or legal requirements change. The latest version will be published on this page.