Legal
Privacy and cookies
We collect only the information we need to take your order, deliver it and look after you as a customer. This page explains what that is, how we use it and the choices you have.
Who we are
Chadbrook Cards is a trading name of Chadbrook Publishing Limited, 58 Station Road, Harborne, Birmingham, B17 9LX. We are the data controller for the personal data described here. You can contact us about anything in this policy at hello@chadbrookcards.com.
What we collect and why
| When | What we collect and what it is for |
|---|---|
| You place an order | Your name, email address, phone number, delivery and billing addresses, the items you ordered and the amount paid. We use these to process and deliver the order, send order emails, handle returns and refunds, and keep the accounting records the law requires. |
| You pay | Your card details are entered into a secure form provided by Square and go directly to Square. They never pass through or are stored on our systems. We receive a payment reference, the card type and the last four digits so we can match payments to orders and process refunds. |
| You create an account | Your name, email address and a password, which is stored only in scrambled (hashed) form, plus any delivery details you choose to save. We use these to sign you in, show your order history and pre-fill checkout. |
| You contact us | Whatever you send us, such as your email address, order number and the content of your message, so that we can reply and resolve your query. |
| You use the website | Standard technical information such as your IP address, browser type and the pages requested, recorded in short-lived server logs by our hosting provider. We use this only to keep the site secure and working. |
Our lawful bases
- Performance of a contract: taking, delivering and supporting your order, and running your account.
- Legal obligation: keeping sales records for tax purposes and handling returns and refunds as consumer law requires.
- Legitimate interests: keeping the site secure, preventing fraud, and replying to your messages. We only rely on this where it does not override your own rights and interests.
- Consent: for any marketing email, which we would only send if you had asked for it. You can withdraw consent at any time.
We do not sell personal data, and we do not use it for automated decision-making or profiling.
Who we share it with
We share the minimum necessary with the companies that help us run the shop:
- Square, which processes card payments. Square's own privacy notice applies to the data it handles.
- Royal Mail, which receives your name and delivery address to deliver your order.
- Resend, which sends our order and account emails on our behalf.
- Vercel, which hosts the website, and Neon, which hosts our database in the UK (London).
Some of these providers process data outside the UK, mainly in the United States. Where they do, transfers are protected by the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, and by the provider's own security commitments.
We may also disclose data where the law requires it, for example to HMRC or to a court, or to protect our rights or the safety of others.
How long we keep it
- Order records: six years after the end of the financial year of the order, as required for tax and accounting.
- Account details: for as long as your account is open. Ask us and we will delete the account; order records are kept for the period above but no longer linked to a login.
- Messages to us: up to two years after the query is resolved.
- Server logs: a short period, typically no more than 30 days.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased, where we no longer need it for the purposes above;
- restrict or object to how we use it;
- receive the data you gave us in a portable format;
- withdraw consent to marketing at any time.
To exercise any of these, email hello@chadbrookcards.com. We will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to put things right first.
Security
The site is served over HTTPS, passwords are stored hashed, and access to order data is limited to the people who need it to fulfil orders. No system is perfectly secure, so if you believe your account has been accessed without your permission, please contact us straight away.
Changes to this policy
We will update this page if what we collect or how we use it changes, and the date at the bottom shows when it was last revised. Our terms and conditions cover the rest of your relationship with us.
Last updated 9 September 2026.