Privacy & Cookie Policy

1. Introduction

Papello ("we", "us", or "our") is committed to protecting your privacy. This Privacy and Cookie Policy explains how we collect, use, disclose, and safeguard your personal information when you use our print on demand services, website, dashboard, and related services (collectively, the "Services").

By using our Services, you agree to the collection and use of information in accordance with this policy. We comply with the General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, applicable marketplace data protection policies, and other relevant data protection laws.

2. Information We Collect

2.1 Information You Provide

We collect information that you provide directly to us:

• Account information: name, email address, password, and contact details
• Order information: shipping addresses, billing information, and payment details
• Content: artwork, designs, product listings, and other content you upload
• Communications: messages, support requests, and feedback

2.2 Information We Collect Automatically

When you use our Services, we automatically collect certain information:

• Usage data: pages visited, features used, and time spent on our platform
• Device information: IP address, browser type, operating system, and device identifiers
• Cookies and tracking technologies: as described in our Cookie Policy below

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our Services
• Process and fulfil your orders
• Communicate with you about your account and orders
• Send you marketing communications (with your consent)
• Detect, prevent, and address technical issues
• Comply with legal obligations and protect our rights
• Analyse usage patterns to improve user experience

4. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

• Service Providers: With third-party service providers who perform services on our behalf, such as payment processing, shipping, and data analytics
• Legal Requirements: When required by law, court order, or governmental authority
• Business Transfers: In connection with a merger, acquisition, or sale of assets
• With Your Consent: When you have given explicit consent for us to share your information

5. Data Security

We implement robust technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. All customer and order data at rest is encrypted using AES-256 standard encryption with isolated key management, and all data in transit is protected using TLS 1.3 encryption protocols.

However, no method of transmission over the Internet or electronic storage is 100% secure, and we cannot guarantee absolute security. In the event of a confirmed security incident, data leak, or unauthorised access involving sensitive customer information, we maintain strict incident response procedures to contain the threat, execute mitigation protocols, and notify relevant regulatory authorities and platform partners within 24 hours.

6. Your Rights Under GDPR

If you are located in the European Economic Area (EEA) or United Kingdom, you have certain rights regarding your personal information:

• Right of Access: Request a copy of the personal information we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete information
• Right to Erasure: Request deletion of your personal information in certain circumstances
• Right to Restrict Processing: Request limitation of how we process your information
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing of your personal information for certain purposes
• Right to Withdraw Consent: Withdraw consent where processing is based on consent

To exercise these rights, please contact us at help@papello.com. We will respond to your request within one month.

7. Data Retention

We retain your personal information for as long as necessary to fulfil the purposes outlined in this policy, unless a longer retention period is required or permitted by law. When we no longer need your information, we will securely delete or anonymise it. For specific retention windows governing third-party marketplace data, please see Section 8 below.

8. E-Commerce Marketplace and Third-Party Platform Data

This section applies specifically to information obtained from e-commerce marketplace integrations and third-party selling partner platforms (including Amazon, Etsy, and Shopify):

8.1 Mandatory 30-Day Retention Cap

All Personally Identifiable Information (PII) of platform buyers (including buyer names, delivery addresses, and phone numbers) is retained strictly for order fulfilment and custom manufacturing. All buyer PII is permanently purged and deleted from all active systems, databases, and backups no later than 30 days post-delivery in full compliance with platform data protection policies.

8.2 Commercialisation Ban

Customer information and buyer PII obtained via marketplace APIs is never sold, rented, shared for marketing or commercial purposes, or used to contact buyers directly outside of necessary order fulfilment activities.

8.3 Access Controls and Endpoint Security

Access to marketplace customer information is governed strictly by the Principle of Least Privilege and Role-Based Access Control (RBAC). All employee access requires unique credentials and mandatory Multi-Factor Authentication (MFA). Access is prohibited from personal or unmanaged devices, and removable storage media (for example, USB flash drives) is blocked on all systems handling customer information.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. We ensure that appropriate safeguards are in place to protect your information in accordance with this policy and applicable data protection laws.

10. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to collect and store information about your preferences and activity on our Services.

10.1 Types of Cookies We Use

• Essential Cookies: Required for the Services to function properly
• Analytics Cookies: Help us understand how visitors use our Services
• Functional Cookies: Remember your preferences and settings
• Marketing Cookies: Used to deliver relevant advertisements (with your consent)

10.2 Managing Cookies

You can control and manage cookies through your browser settings. However, disabling certain cookies may affect the functionality of our Services.

11. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy and Cookie Policy from time to time. We will notify you of any material changes by posting the updated policy on our website and updating the "Last updated" date. Your continued use of our Services after such changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy and Cookie Policy or our data practices, please contact us at: