Privacy & Cookie Policy – United Kingdom
In short: ThePicksHouse processes personal data only for defined purposes such as managing orders, payments, deliveries, customer support, account services, legal obligations and, where required, with your consent for analytics, advertising and marketing. Cookies and similar technologies that require consent under UK law are not intended to be activated before the required consent is obtained.
1. Data Controller
The website thepickshouse.com and its UK and other country/language versions are operated under the ThePicksHouse brand by:
Tipografia FB s.n.c.
VAT ID: IT06825140012
Via Val della Torre 273
10091 Alpignano (TO), Italy
Email: info@thepickshouse.com
Tipografia FB s.n.c. acts as the Data Controller for the personal data described in this Privacy & Cookie Policy.
2. UK Representative
Important before publication: where Article 27 of the UK GDPR requires ThePicksHouse to appoint a representative in the United Kingdom, the representative’s details must be inserted below once appointed.
UK Representative: [INSERT LEGAL NAME][INSERT UK POSTAL ADDRESS]Email: [INSERT EMAIL ADDRESS]
The UK representative may be contacted by individuals in the United Kingdom and by the Information Commissioner’s Office (ICO) regarding matters relating to processing covered by the UK GDPR. Appointment of a representative does not affect the responsibility or liability of Tipografia FB s.n.c. as Data Controller.
3. Scope of this Policy
This Policy explains how we collect and process personal data when you browse our websites, create an account, place an order, use our online product editor, contact us, subscribe to marketing communications or otherwise interact with ThePicksHouse.
For individuals in the United Kingdom, this Policy is intended to explain processing carried out in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), in each case as amended, and other applicable UK data-protection and privacy legislation.
As Tipografia FB s.n.c. is established in Italy, certain processing may also be subject to Regulation (EU) 2016/679 (EU GDPR) and applicable Italian or European Union law.
4. Personal Data We Collect
Depending on how you use our services, we may process the following categories of personal data:
- Identification data: first name, last name, username or customer/account identifier.
- Contact data: email address, telephone number, billing and delivery address.
- Order and transaction data: products purchased, order history, amounts, discounts, currency, transaction status, shipping information and related customer-service records.
- Payment-related data: payment method and transaction references. Full payment-card details are normally processed directly by the relevant payment provider and are not stored by us unless technically required and lawfully permitted.
- Content supplied by you: logos, images, artwork, text and other files uploaded for the production of customised products.
- Account data: account preferences, saved addresses and other information associated with your customer account.
- Communications: messages sent through contact forms, email, chat or other customer-support channels.
- Technical and usage data: IP address, browser and device information, operating system, approximate location derived from IP, pages viewed, timestamps, referral information, logs and security data.
- Cookie and tracking data: identifiers and information generated through cookies or similar technologies, subject to the rules described below.
- Marketing preferences: newsletter subscription status, consent records, objections and communication preferences.
Please do not upload special category personal data or other sensitive personal information through artwork files, forms or customer-service communications unless it is strictly necessary and expressly requested by us.
5. Purposes and Legal Bases
We process personal data only where there is an appropriate lawful basis under the UK GDPR or other applicable law.
| Purpose | Typical data | Legal basis |
|---|---|---|
| Managing your order, producing customised products and providing requested services | Identity, contact, order, artwork and transaction data | Performance of a contract or steps taken at your request before entering into a contract (Art. 6(1)(b) UK GDPR) |
| Processing payments and refunds | Identity, order, payment and transaction data | Performance of a contract (Art. 6(1)(b) UK GDPR); legal obligations where applicable (Art. 6(1)(c)) |
| Shipping, delivery, tracking, customs administration and delivery problem resolution | Name, delivery address, email, phone, order and shipment data | Performance of a contract (Art. 6(1)(b) UK GDPR); legal obligations where applicable (Art. 6(1)(c)) |
| Customer support and handling requests, complaints or warranty issues | Contact, order and communication data | Performance of a contract (Art. 6(1)(b)); legitimate interests in providing support and protecting our rights (Art. 6(1)(f)) |
| Creating and managing customer accounts | Identification, contact, account and order data | Performance of a contract or pre-contractual measures (Art. 6(1)(b)) |
| Accounting, invoicing, tax, customs, fraud-prevention and compliance obligations | Identity, billing, order and transaction data | Compliance with legal obligations (Art. 6(1)(c)); legitimate interests in preventing abuse and protecting the business (Art. 6(1)(f)) |
| Website security, troubleshooting, abuse prevention and service reliability | Technical data, logs, IP address and security events | Legitimate interests in securing and operating our services (Art. 6(1)(f)) |
| Audience measurement and analytics using technologies for which consent is required | Cookie identifiers, device, browsing and usage data | Consent where required (Art. 6(1)(a) UK GDPR and PECR) |
| Personalised advertising, conversion measurement and remarketing | Cookie identifiers, device, browsing, interaction and advertising data | Consent where required (Art. 6(1)(a) UK GDPR and PECR) |
| Email newsletters and promotional communications | Name, email address, marketing preferences and engagement data | Consent where required (Art. 6(1)(a) UK GDPR); where the PECR customer soft opt-in applies, marketing of our own similar products or services may be sent to eligible existing customers provided the applicable conditions are satisfied and a clear opportunity to opt out is provided |
| Establishing, exercising or defending legal claims | Relevant account, order, payment and communication data | Legitimate interests in protecting our legal rights (Art. 6(1)(f)) |
6. Information Required to Complete an Order
Some personal data are necessary to enter into and perform a contract with you, including information needed to process your order, create the customised product, receive payment, comply with applicable customs or tax requirements and arrange delivery. If you do not provide required information, we may be unable to accept or complete your order.
Data requested only for optional purposes, such as certain marketing or advertising activities, is not required to purchase from us.
7. Custom Artwork and Uploaded Files
When you upload artwork, logos, photographs, text or other files to customise a product, we process that content for order fulfilment, production, customer support, quality control and, where necessary, the handling of reprints, complaints or legal claims.
You are responsible for ensuring that you are entitled to provide and use the uploaded content. If an uploaded file contains personal data relating to another person, you should ensure that you have a lawful basis to provide it to us.
8. Payments
Payments may be processed by third-party payment service providers, including providers displayed at checkout such as PayPal and Stripe. Those providers may process personal data as independent controllers or processors according to their own roles, terms and privacy information.
We generally receive only the information necessary to confirm and manage the transaction, such as payment status, transaction reference, amount and limited payment-method information.
9. Shipping and Delivery
To deliver your order, we may share the information necessary for fulfilment with couriers, postal operators, shipping-management providers, fulfilment partners and, where applicable, customs, tax or other public authorities. This may include your name, delivery address, email address, telephone number, shipment contents where legally required, customs information and tracking information.
10. Service Providers and Recipients
Personal data may be disclosed, to the extent necessary for their respective functions, to categories of recipients such as:
- website hosting, cloud, IT maintenance and cybersecurity providers;
- e-commerce, order-management and customer-support service providers;
- payment processors and financial-service providers;
- couriers, postal operators, logistics and shipment-management providers;
- email delivery and newsletter service providers;
- analytics and measurement providers, where enabled in accordance with your consent choices and applicable law;
- advertising and social-media platforms, where enabled in accordance with your consent choices and applicable law;
- professional advisers such as accountants, tax consultants, legal advisers and insurers;
- public authorities, customs authorities, courts, law-enforcement bodies or other parties where disclosure is required by law or necessary to protect legal rights.
Where a supplier processes personal data on our behalf, we require an appropriate data-processing arrangement under Article 28 UK GDPR where the UK GDPR applies and, where relevant, under corresponding EU GDPR requirements.
11. Cookies and Similar Technologies
ThePicksHouse uses cookies and similar technologies to ensure the proper functioning of the website, improve the user experience, analyse website traffic and, where legally permitted and the required consent has been provided, support advertising and marketing activities.
We use a third-party Consent Management Platform (CMP) to manage cookie choices and user preferences. Through the cookie consent panel, visitors can accept, reject or customise technologies that require consent and can change or withdraw their choices at any time.
Strictly necessary cookies and similar technologies may be used without prior consent where an applicable PECR exception permits this, including where they are necessary for services requested by the user, such as the operation and security of the website, shopping cart, checkout, account access or session management.
Analytics, advertising, profiling and other cookies or similar technologies for which UK law requires consent are activated only after the required consent has been obtained.
For detailed and up-to-date information about the cookies and tracking technologies used on this website, including their provider, purpose, category and duration, please refer to the Cookie Policy and the cookie preference panel made available through our consent-management system.
You can review or change your cookie choices at any time using the cookie settings control made available on the website by our Consent Management Platform.
The cookie list and consent preferences are managed dynamically by our third-party consent-management provider and may be updated when the technologies used on the website change.
12. Marketing Communications
If you subscribe to our newsletter or otherwise consent to receive promotional communications, we may use your contact details to send information about products, launches, special offers and company news.
Where permitted by PECR, we may use the customer “soft opt-in” to send electronic marketing about our own products or services that are similar to those you previously purchased or enquired about. We will rely on this only where the applicable conditions are satisfied, including that we obtained your contact details in the context of a sale or negotiations for a sale, gave you a clear and simple opportunity to opt out when the details were collected, and provide an opt-out in every subsequent marketing message.
You may withdraw consent or object to direct marketing at any time by using the unsubscribe link included in marketing emails or by contacting us at info@thepickshouse.com. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Service messages relating to an order, payment, shipment, security issue or customer-support request are not marketing communications and may still be sent where necessary to provide the service.
13. Data Retention
We keep personal data only for as long as necessary for the purpose for which it was collected, taking into account legal, accounting, tax, customs, contractual and dispute-resolution requirements that apply to us.
| Category | Indicative retention rule |
|---|---|
| Orders, invoices, payments and accounting records | For the period required by applicable accounting, tax, customs and civil-law obligations and, where necessary, for the establishment, exercise or defence of legal claims. |
| Production artwork and order files | For the time reasonably necessary to produce and support the order, manage reprints or complaints and protect legal rights; files may be deleted or anonymised earlier where no longer required. |
| Customer accounts | For as long as the account remains active and thereafter for the period necessary to meet legal obligations or handle claims. You may request account deletion, subject to data we must retain by law. |
| Customer-service communications | For the time necessary to resolve the request and for a reasonable subsequent period where needed to document the interaction or manage possible claims. |
| Website security logs | For a limited period proportionate to security, troubleshooting and fraud-prevention needs, unless longer retention is necessary for an incident or legal obligation. |
| Newsletter and direct-marketing data | Until consent is withdrawn, an objection is made, or the data are no longer necessary for the marketing purpose, subject to retaining limited suppression-list information where necessary to respect an opt-out. |
| Cookie and advertising identifiers | According to the lifespan stated in the cookie-preference panel and the relevant provider settings; consent choices can be changed or withdrawn at any time. |
14. International Data Transfers
Tipografia FB s.n.c. is established in Italy, and personal data relating to UK customers may therefore be processed in Italy and elsewhere in the European Economic Area (EEA). The United Kingdom currently recognises the EEA countries as providing adequate protection for the purposes of UK international-transfer rules.
Some service providers may process personal data in other countries. Where a transfer is a restricted transfer under the UK GDPR, we use a lawful transfer mechanism where required, which may include:
- UK adequacy regulations covering the relevant country, territory, sector or recipient;
- the UK Extension to the EU-U.S. Data Privacy Framework, where applicable to an eligible US recipient with an active certification covering the relevant data;
- appropriate safeguards such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another mechanism recognised under Article 46 UK GDPR, together with any required transfer-risk assessment and supplementary measures; or
- an applicable exception under UK data-protection law where permitted.
Where EU GDPR transfer rules also apply to the same processing, we also use a transfer mechanism permitted under EU law where required.
You may contact us if you would like further information about the safeguards applicable to a particular transfer.
15. Data Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are reviewed in light of the nature of the data, available technologies, processing risks and operational requirements.
No online system can be guaranteed to be completely secure. If we become aware of a personal-data breach, we will assess and manage it in accordance with the UK GDPR, the EU GDPR where applicable, and other applicable law.
16. Your Rights under the UK GDPR
Subject to the conditions, exemptions and limitations provided by law, you may exercise the following rights:
- Access: obtain confirmation as to whether we process your personal data and receive a copy of relevant data.
- Rectification: ask us to correct inaccurate or incomplete personal data.
- Erasure: ask us to delete personal data where the legal requirements are met.
- Restriction: ask us to restrict processing in circumstances provided by law.
- Data portability: receive certain personal data in a structured, commonly used and machine-readable format and, where applicable and technically feasible, have them transmitted to another controller.
- Objection: object to processing based on legitimate interests in circumstances provided by law, and object at any time to processing for direct marketing.
- Withdraw consent: withdraw consent at any time where processing is based on consent, without affecting processing already lawfully carried out.
- Complaint: lodge a complaint with the Information Commissioner’s Office or another competent supervisory authority where applicable.
To exercise your rights, contact info@thepickshouse.com or, once appointed where required, the UK Representative identified above. We may request information reasonably necessary to verify your identity before acting on a request.
17. Right to Lodge a Complaint
If you are in the United Kingdom and believe that the processing of your personal data infringes applicable data-protection law, you have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner’s Office (ICO)
Website: ico.org.uk
You may also have rights to contact another competent supervisory authority where another data-protection regime applies to the relevant processing.
18. Automated Decision-Making
We do not currently use personal data to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 UK GDPR.
Advertising technologies may involve profiling for marketing purposes where the legally required consent has been provided, but this is not intended to produce legal or similarly significant effects.
19. Links and Third-Party Websites
Our websites may contain links to websites or services operated by third parties. Their processing of personal data is governed by their own privacy policies. We encourage you to review those policies before providing personal data to third parties.
20. Changes to this Policy
We may update this Privacy & Cookie Policy when our services, technologies, providers or legal obligations change. The latest version will be published on this page and the “Last updated” date will be revised accordingly.
Where a change materially affects processing based on consent, we will request a new consent where required by law.
21. Contact Us
If you have questions about this Policy, the processing of your personal data or the exercise of your rights, please contact:
Tipografia FB s.n.c. / ThePicksHouse
Via Val della Torre 273
10091 Alpignano (TO), Italy
Email: info@thepickshouse.com
If a UK Representative is required and has been appointed, its contact details must also be provided in section 2 above.