Privacy Policy

Introduction

This Privacy Policy describes how and when we collect, use, and share information when you purchase an item from us, contact us, or otherwise use our services through storigraphic.com or its related sites and services.

This Privacy Policy does not apply to the practices of third parties that we do not own or control, including Royal Mail or any third party services you access via our site.

How we use your information

To fulfil your order, you must provide us with certain information (which you authorise to provide to us), such as your name, email address, postal address, payment information, and the details of the product that you’re ordering. You may also choose to provide us with additional personal information if you contact us directly.

Why we need your information and how we use it

What personal data we collect
We collect the following categories of personal data:

• Identity and contact data — name, email address, postal address, telephone number where provided.
• Transaction data — details of products you have ordered, payment confirmation (we do not store full payment card details — see Payment below).
• Marketing data — your preferences in receiving marketing from us, and the channels through which you have opted in.
• Technical data — IP address (in most cases anonymised), browser type and version, device information, pages visited, referral source, and similar information collected through cookies and analytics services.
• Communications data — the content of emails or other messages you send to us.

Our legal basis for processing
We rely on the following lawful bases under the UK GDPR:

• Performance of a contract (Article 6(1)(b)) — to take and fulfil your order, manage delivery, process refunds, and respond to order-related queries.
• Legal obligation (Article 6(1)(c)) — to comply with our obligations under tax, accounting, consumer protection and other applicable law, including retaining transaction records for the period required by HMRC.
• Consent (Article 6(1)(a)) — to send you marketing communications where you have opted in, and to place non-essential cookies on your device. You have the right to withdraw your consent at any time; withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.
• Legitimate interests (Article 6(1)(f)) — to operate, improve and secure our website; to understand our trade audience through B2B analytics; to prevent fraud; and to enforce our terms. Where we rely on legitimate interests, we balance our interests against your rights and freedoms and will not process your data where your rights override ours. You have the right to object to processing carried out on this basis.

How long we keep your information
We retain your personal data only for as long as necessary to provide our services and to comply with our legal obligations. In practice:

• Transaction and order data: six years from the end of the financial year in which the order was placed, in line with HMRC record-keeping requirements and the limitation period for contract claims.
• Marketing data: until you withdraw your consent or unsubscribe, whichever is sooner.
• Customer service correspondence: typically two years from resolution of the matter.
• Website analytics data: in line with our analytics providers' default retention (14 months for Google Analytics; please see Leadfeeders's privacy notice for their retention periods).

We may retain data for longer where required by law or to establish, exercise or defend legal claims.

International data transfers
Some of our service providers are based outside the UK, including in the United States (for example, Shopify, PayPal, Google) and elsewhere. Where personal data is transferred outside the UK, we ensure that appropriate safeguards are in place — typically reliance on a UK adequacy decision (where one is in force for the destination country) or the use of the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms recognised under UK GDPR. You may request further information about these safeguards by contacting us using the details at the end of this notice.

Consequences of not providing your data
Where we ask you to provide personal data to enter into a contract with us (for example, to place an order), failure to provide that data will mean we cannot process your order. Where we ask for data on the basis of your consent (for example, marketing communications), there is no consequence to declining; you will simply not receive those communications.

Automated decision-making
We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing.

Analytics and B2B visitor identification

We use Google Analytics (GA4) to collect anonymised information about how visitors interact with our site (pages viewed, time on page, referral source, device type). Where you have permitted personalised advertising in your Google Account, we also use Google Signals to enable cross-device measurement and remarketing.

We also use Leadfeeder, a B2B analytics service, to identify the businesses (not individual visitors) that visit our website. Leadfeeder matches visitor IP addresses against its database of company records and provides us with company-level information such as company name, industry. This processing is carried out on the basis of our legitimate interests in understanding our trade audience and identifying potential wholesale customers. We do not use Leadfeeder to identify individual consumers.

You can find more information about Leadfeeder's processing in its own privacy notice.

Cookies used and associated details:

See our Cookies Policy for full details.

Information sharing and disclosing

Information about our customers is important to our business. We share your personal information for very limited reasons and in limited circumstances, as follows:

• Service providers — we engage trusted third parties to perform functions on our behalf, including Shopify (our e-commerce platform), PayPal (payment processing), Google (analytics and email), Leadfeeder (B2B analytics), and Royal Mail and other delivery providers. We share only the personal data necessary for them to perform these services, and we have contractual arrangements in place to require them to protect your data.
• Professional advisers — we may share information with our accountants, lawyers, or other professional advisers where necessary for them to provide advice or services to us.
• Compliance with law — we may collect, use, retain and share your information where we have a good faith belief that it is reasonably necessary to: (a) respond to legal process or government requests; (b) enforce our agreements, terms and policies; (c) prevent, investigate or address fraud, security or technical issues; or (d) protect the rights, property and safety of our customers or others.

Marketing to you

Whether you have ordered from us or not but have registered to become an email subscriber, we will only send you marketing communications if you opted into receiving marketing at the time and so given us your express consent.

You have the option to unsubscribe from our emails through a link at the bottom of each email we send to you. If you personally want to update the details that you have registered with us, you can also do this via the same links.

Google Analytics and Google Signals

We use Google Analytics (GA4) to understand how visitors use our website. Google Analytics collects information including pages viewed, visit duration, traffic sources and device type. IP addresses are anonymised before processing.

We have also activated Google Signals. Where you have enabled personalised advertising in your Google Account, this allows us to use cross-device reporting and remarketing — meaning we may show our products to you across other websites and devices. The data Google collects through this feature is aggregated and anonymised, and you can manage or delete it through your Google Account.

This data expires after 14 months by default. You can opt out of Google Analytics tracking at any time using the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Your rights

Under UK data protection law you have a number of rights in relation to your personal data. These rights apply in most but not all cases, and we will tell you if a particular request cannot be granted and why.

• Right of access — you may ask us for a copy of the personal data we hold about you.
• Right to rectification — you may ask us to correct any inaccurate personal data we hold about you.
• Right to erasure — you may ask us to delete your personal data, subject to exceptions where we are required to retain it (for example, for tax purposes or to defend a legal claim).
• Right to restrict processing — you may ask us to limit how we use your personal data in certain circumstances.
• Right to data portability — where we process your personal data on the basis of consent or contract, and the processing is carried out by automated means, you may ask us to provide that data in a structured, commonly used and machine-readable format, or to transmit it to another controller.
• Right to object — you may object to processing carried out on the basis of our legitimate interests, and to direct marketing at any time.
• Right to withdraw consent — where we rely on your consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.
• Right not to be subject to automated decision-making — we do not make significant decisions about you based solely on automated processing, but you have the right to object if this position changes.

To exercise any of these rights, please contact us using the details at the end of this notice. We will respond to your request without undue delay and in any event within one month, although this period may be extended by a further two months for complex or numerous requests.

Complaints

If you are unhappy with how we have handled your personal data, please contact us first using the details below. We will acknowledge your complaint within 30 days and respond without undue delay.

You also have the right to complain to the UK's data protection authority, the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. When we make material changes — for example, to the categories of data we collect, the legal bases on which we process it, or the third parties with whom we share it — we will update the 'Last updated' date at the bottom of this page and, where appropriate, notify you by email or by a prominent notice on our website.

We encourage you to review this policy periodically to stay informed about how we look after your personal data.

Who we are and how you can contact us

We are Storigraphic Limited (registered in England and Wales, company number 11855419, VAT number GB 318298675). Registered office: 16 High Street, Shepreth, Royston, Cambridgeshire SG8 6PP.

For any questions about this Privacy Policy or about how we handle your personal data, including to exercise any of your rights, please contact us at:

• Email: hello@storigraphic.com
• Post: Data Protection Contact, Storigraphic Limited, 16 High Street, Shepreth, Royston, Cambridgeshire SG8 6PP
  

Last updated 25 May 2026.