Privacy Policy

Last updated: 13 September 2026

1. Who I am

Micro Print Lab is a trading name of iam39, a sole trader business registered for VAT in the United Kingdom. I am the data controller for the personal data described in this policy.

• Business name: Micro Print Lab, a trading name of iam39
• Business address: The Old Stable, Elkington Lodge, Elkington Road, Northampton, NN6 6HE
• Email: [email protected]
• VAT registration number: GB 253 8945 69

This policy explains what personal data I collect, why I use it, how long I keep it, and what rights you have. It sits alongside my Terms and Conditions.

2. The data I collect

When you order, contact me or use the site, I may collect:

• Your name
• Your email address
• Your phone number, if you give me one
• Your delivery and billing addresses
• Your account login details, if you create an account
• Your order history
• The artwork files, text and personalisation choices you submit for printing
• Messages you send me through the contact form or by email
• Confirmation that a payment succeeded, from Stripe or PayPal
• Technical data such as IP address, browser type, device type and pages viewed

I never see or store your full card details. Card payments are handled entirely by Stripe or PayPal.

3. Why I use your data, and my lawful basis

Under UK GDPR I must have a lawful basis for every use of your data. Mine are:

• Processing and fulfilling your order, and dealing with any problem or refund. Lawful basis: performance of a contract with you.
• Taking payment and preventing fraudulent transactions. Lawful basis: performance of a contract, and my legitimate interest in preventing fraud.
• Sending order confirmations, dispatch notices and tracking information. Lawful basis: performance of a contract.
• Keeping order, VAT and accounting records. Lawful basis: compliance with a legal obligation, principally HMRC record keeping requirements.
• Answering your enquiries and quote requests. Lawful basis: my legitimate interest in responding to people who contact me.
• Sending marketing emails and newsletters. Lawful basis: your consent, which you can withdraw at any time.
• Website analytics. Lawful basis: your consent, given through the cookie banner.
• Keeping the site secure and available, and backing it up. Lawful basis: my legitimate interest in protecting my business and your data.
• Establishing, exercising or defending legal claims. Lawful basis: my legitimate interest in protecting my legal position.

4. Your artwork files

Artwork, photographs and personalisation text you upload are used only to produce your order.

I keep them for 12 months after dispatch so that reprints and repeat orders can be handled, and I then delete them. You can ask me to delete your artwork sooner at any time by emailing me.

I will not use your artwork for marketing, display or any other purpose without your written consent, as set out in section 7 of my Terms and Conditions.

5. How long I keep your data

• Artwork and personalisation files: 12 months after dispatch
• Order, VAT and accounting records: 6 years, as HMRC requires
• Customer account: for as long as the account is active. Accounts inactive for 2 years may be deleted
• Newsletter subscription: until you unsubscribe
• Enquiries that do not lead to an order: 12 months
• Analytics data: for the retention period set in the analytics tool, currently 14 months

6. Cookies and tracking

Essential cookies are needed for the site to work. They remember your basket, keep you logged in, secure the checkout and record your cookie choices. These do not require your consent, and the site will not function properly without them.

Non essential cookies are only set after you accept them in the cookie banner. These are:

• Google Analytics, to understand how the site is used

You can change or withdraw your cookie consent at any time using the cookie settings link on this site, or by clearing cookies in your browser. Withdrawing consent does not affect anything done before you withdrew it.

7. Who I share your data with

I do not sell your data, and I do not share it for anyone else's marketing.

I share only what is necessary with:

• Stripe and PayPal, to take payment securely
• Royal Mail and Royal Mail Click and Drop, to address, dispatch and track your parcel
• My website host, which stores the site and its database on secure servers
• FluentCRM, which sends my email newsletters
• Google, for website analytics, but only where you have consented to those cookies
• My accountant and HMRC, for tax and accounting purposes
• Professional advisers or authorities, where I am legally required to disclose information

8. Storage and transfers outside the UK

My website and database are hosted on servers in the United Kingdom or the European Economic Area.

Some of the providers listed above, including Stripe, PayPal and Google, are based in or transfer data to the United States. Where that happens, the transfer is protected by UK adequacy regulations, by the UK extension to the EU-US Data Privacy Framework, or by standard contractual clauses with the UK International Data Transfer Addendum, depending on the provider.

9. Marketing

I will only send you marketing emails if you have asked to receive them, or if you have bought from me and I am telling you about similar products, which is permitted under PECR.

Every marketing email includes an unsubscribe link, and you can also email me to be removed. Unsubscribing from marketing does not stop transactional emails about an order you have placed.

10. Security

The site runs over SSL encryption on secure, maintained hosting with a web application firewall, and access to the admin area is restricted and protected. Card details are never stored by me.

No system can be guaranteed completely secure, but if a breach occurs that is likely to affect your rights I will notify you and the ICO as UK GDPR requires.

11. Your rights

Under UK GDPR you have the right to:

• Be told how your data is used, which is what this policy does
• Access a copy of the data I hold about you
• Have inaccurate data corrected
• Have your data deleted, where there is no legal reason for me to keep it
• Restrict how I use your data while a query is resolved
• Object to processing based on legitimate interests
• Receive your data in a portable, machine readable format
• Withdraw consent at any time, where consent is my lawful basis

To exercise any of these, email me at [email protected]. There is no charge, and I will respond within one month.

Some rights have limits. For example, I cannot delete order and VAT records that HMRC requires me to keep for 6 years.

12. Complaints

If you are unhappy with how I have handled your data, please email me first at [email protected] and I will try to put it right.

You also have the right to complain to the Information Commissioner's Office at any time.

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Children

This site is not directed at children. You must be at least 18 to place an order or create an account, or have the permission of a parent or guardian. I do not knowingly collect personal data from children. If you believe a child has given me their data, email me and I will delete it.

14. Automated decision making

I do not use automated decision making or profiling that produces legal effects for you, or that significantly affects you in a similar way.

15. Changes to this policy

I may update this policy from time to time. The current version always appears on this page, with the date it was last updated shown at the top.

16. Contact

Micro Print Lab, a trading name of iam39
The Old Stable
Elkington Lodge
Elkington Road
Northampton
NN6 6HE
Email: [email protected]
VAT registration number: GB 253 8945 69