Privacy Policy

Who we are

Orbit Packaging Ltd (company number 00000000, registered office registered office address) is the controller of the personal data
described in this policy. That means we decide how and why your data is used.

What we collect

We collect only what we need to quote for, produce and deliver packaging, and to run our
business properly.

When you request a quote or place an order

• Name, company name, email address, phone number.
• Delivery and billing address.
• Order details: box specification, dimensions, quantity, deadlines and any notes you give us.
• Artwork files you upload, which may contain your logos, brand assets and product
  information.
• Correspondence with us, including emails and call notes.

When you pay

Card payments are processed by our payment provider. We receive confirmation of payment and a
partial card reference; we do not receive or store your full card number.

When you use the website

• Technical data such as IP address, browser type, device and pages viewed, collected through
  cookies and similar technologies.
• Items you add to your basket, which are stored in your browser.

Marketing

If you subscribe, we keep your email address and a record of your consent or of the purchase
that allowed us to contact you.

We do not seek to collect special category data (such as health or biometric data). Please do
not send it to us.

Why we use it, and our lawful basis

Under UK GDPR we must have a lawful basis for each use of your data. Ours are:

• To perform our contract with you — preparing quotes, producing dielines and
  proofs, manufacturing, delivering, invoicing and handling returns.
• Our legitimate interests — running and improving the website, keeping records
  of enquiries, preventing fraud, securing our systems, and contacting existing customers about
  similar products. We balance these against your rights, and you can object at any time.
• Your consent — marketing emails where consent is required, and non-essential
  cookies. You can withdraw consent at any time.
• Legal obligation — keeping accounting and tax records, and responding to lawful
  requests.

Who we share it with

We do not sell your personal data. We share it only with organisations that help us deliver
your order or run our business, and only as far as they need it:

• Couriers and freight partners, to deliver your goods.
• Print and manufacturing partners, where part of an order is produced with a specialist.
• Payment providers, to take payment securely.
• IT, hosting, email and analytics providers who support the website and our systems.
• Accountants, auditors and professional advisers.
• Authorities or regulators, where the law requires it.

Where these organisations process data on our behalf, a written contract requires them to keep
it secure and use it only on our instructions.

Storage and international transfers

We aim to keep personal data within the UK or the European Economic Area. Where a supplier
processes data outside those areas, we rely on UK adequacy regulations or on the UK International
Data Transfer Agreement (or the EU Standard Contractual Clauses with the UK Addendum), together
with any additional safeguards needed.

You can ask us for details of the transfers that apply to your data.

How long we keep it

• Quotes that do not become orders — up to 24 months, so we can pick up the
  conversation if you come back.
• Order and customer records — 6 years after the end of the financial year in
  which the order was placed, to meet HMRC record-keeping requirements.
• Artwork, dielines and production files — retained while your account is active
  so reorders avoid repeat setup, and for up to 3 years after your last order unless you ask us
  to delete them sooner.
• Marketing data — until you unsubscribe, and a suppression record afterwards so
  we do not contact you again.
• Website analytics — as set out in our cookie settings.

Your rights

You have the right to:

• ask for a copy of the personal data we hold about you;
• have inaccurate data corrected;
• ask us to delete data where there is no good reason for us to keep it;
• object to processing based on legitimate interests, and to direct marketing at any time;
• ask us to restrict processing while a concern is resolved;
• receive certain data in a portable format, or have it sent to another provider;
• withdraw consent where we rely on it.

To exercise any of these, email us using the contact details above. We will respond within one
month. There is no fee, though we may charge a reasonable fee or refuse a request that is
manifestly unfounded or excessive, as the law allows.

If you are unhappy with how we handle your data you can complain to the Information
Commissioner’s Office at ico.org.uk, by
calling 0303 123 1113. We would appreciate the chance to put things right first.

Marketing emails

We send marketing emails only where you have asked for them, or where you have bought from us
and we are offering similar packaging products, as allowed by the Privacy and Electronic
Communications Regulations.

Every email has an unsubscribe link, and you can also reply or email us to opt out. Unsubscribing
from marketing does not stop service messages about an order you have placed.

Cookies

Cookies are small files placed on your device. We use:

• Essential cookies and local storage — to remember your basket and keep the site
  secure. These do not need consent.
• Analytics cookies — to understand which pages are useful, set only with your
  consent.
• Marketing cookies — where used, set only with your consent.

You can change your choice at any time through the cookie settings on this site, and you can
block or delete cookies in your browser. Blocking essential cookies may stop parts of the site
working.

Keeping your data safe

We use appropriate technical and organisational measures to protect personal data, including
encrypted connections to this website, access controls, and limiting access to staff who need it.
Artwork files are stored on access-controlled systems.

No transmission over the internet is completely secure. If a breach occurs that is likely to
risk your rights and freedoms, we will report it to the ICO within 72 hours and tell you where the
law requires.

Children

Our website and products are aimed at businesses and adults. We do not knowingly collect data
from children under 13. If you believe a child has given us personal data, contact us and we will
delete it.

Changes to this policy

We review this policy regularly and will post any changes on this page with a new date at the
top. Where changes are significant we will tell customers by email.