Privacy & Cookies Policy
Last updated: 5 November 2026
1. Introduction
1.1 DS Creative Limited (“DS Creative”, “we”, “us” or “our”) is committed to protecting personal information and respecting the privacy of customers, website visitors, suppliers and other individuals who interact with our business.
1.2 This Privacy & Cookies Policy explains how we collect, use, store, share and protect personal information in connection with our products, services, websites and business operations.
1.3 This policy applies to graphic design, printing, signage, promotional merchandise, online ordering, website design, website hosting, website maintenance and digital marketing services.
1.4 It also applies when you visit our website, create an account, make an enquiry, request a quotation, place an order, contact us or subscribe to marketing communications.
1.5 We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.
1.6 We may update this policy to reflect changes in our services, technology, business practices or legal obligations. The latest version will be published on our website.
2. Who We Are
2.1 DS Creative Limited is a company registered in England and Wales.
2.2 Our contact details are: DS Creative Limited, Unit 23, President Buildings Office Park, Savile Street East, Sheffield, S4 7UQ. Telephone: 0114 266 9000. Email: info@dscreative.co.uk. Website: https://dscreative.co.uk/. Company Registration Number: 06473189.
2.3 DS Creative Limited is normally the Data Controller for personal information collected and used in connection with its own business activities.
2.4 Where we process personal information on behalf of customers through website hosting, website maintenance or related services, we may instead act as a Data Processor. This is explained further in Section 10.
2.5 Privacy enquiries and requests concerning personal information may be sent to info@dscreative.co.uk.
3. Personal Information We Collect
3.1 We may collect personal information directly from you, automatically through your use of our website, or from other legitimate sources connected with the provision of our services.
3.2 The categories of information we may collect include: (a) identity information, including names, job titles and business names; (b) contact information, including email addresses, telephone numbers, billing addresses and delivery addresses; (c) account information, including usernames, account preferences and order histories; (d) transaction information, including quotations, invoices, payments and correspondence; (e) artwork and production information, including files, photographs, images and personalisation details; (f) communications, including enquiries and complaints; (g) technical information, including IP addresses, browser types, device information and website access logs; (h) website usage information, where collected through permitted technologies; (i) marketing preferences, consent records and unsubscribe requests; and (j) information supplied in connection with recruitment and supplier relationships.
3.3 We may receive business contact information from colleagues, employers, publicly available business directories or other sources where its collection and use are lawful.
3.4 We do not routinely request special category personal information as part of an ordinary print or design order.
3.5 Customers may sometimes supply documents, photographs or artwork containing sensitive personal information. We handle such information in accordance with applicable law and the relevant contractual arrangements.
3.6 Customers should avoid submitting unnecessary sensitive information and inform us in advance where particularly sensitive or confidential material requires special handling.
4. How We Use Personal Information
4.1 We use personal information only where we have an appropriate lawful basis and a legitimate purpose.
4.2 Our main activities and lawful bases include: responding to enquiries and preparing quotations (pre-contract steps or legitimate interests); processing orders and providing design, printing or related services (contract or legitimate interests, depending on the relationship); managing accounts and customer support (contract or legitimate interests); processing payments and recovering debts (contract, legitimate interests or legal obligations); accounting and statutory record-keeping (legal obligation); operating and securing our website (legitimate interests, contract or legal obligation); improving services (legitimate interests, subject to applicable cookie rules); sending marketing (consent or legitimate interests where PECR permits); and establishing or defending legal claims (legitimate interests or legal obligation, as appropriate).
4.3 Where we rely on legitimate interests, these include operating and improving our business, providing services to business customers, maintaining appropriate security, preventing fraud, recovering lawful debts and communicating with business contacts.
4.4 We consider individuals’ rights and interests before relying on legitimate interests and do not use that basis where those rights override our interests.
4.5 Where consent is required, we will request it through an appropriate mechanism and explain how it can be withdrawn.
4.6 We do not rely on consent for ordinary order processing where another more appropriate lawful basis applies.
4.7 Where information is required to fulfil a contract or meet a legal obligation, failure to provide it may prevent us from supplying the requested service or meeting the requirement.
5. Online Ordering and Customer Accounts
5.1 When you place an order through our website, we collect the information necessary to process that order.
5.2 This may include your name, contact details, billing and delivery addresses, order specifications, artwork, payment-related information and purchase history.
5.3 We use this information to confirm and process orders; arrange printing, production and delivery; provide support and updates; process payments and invoices; manage refunds and complaints; and meet accounting, tax and other legal obligations.
5.4 Where customer accounts are available, we may retain account details, previous orders and preferences to support future purchases and account administration.
5.5 Customers should keep their account access details confidential and notify us if they believe their account has been compromised.
5.6 Payments may be processed through authorised third-party payment service providers. Those providers may independently process payment information under their own privacy notices.
5.7 We do not require customers to send full payment card information to us by ordinary email.
5.8 Payment and transaction records are retained in accordance with applicable legal and business requirements.
6. Graphic Design, Printing and Customer Artwork
6.1 Customers may supply artwork, documents, photographs, text, logos and other materials for design and printing projects.
6.2 These materials may contain personal information, including names, photographs, addresses and contact details.
6.3 We use these materials for preparing, producing, completing and administering the requested work.
6.4 Where necessary, files may be shared with authorised printers, finishers, production partners or other subcontractors involved in fulfilling the order.
6.5 We take reasonable steps to limit access to individuals who require it for legitimate business purposes.
6.6 Customers supplying information about others should ensure they have a lawful basis to provide it.
6.7 Where we process information solely on a customer’s instructions and behalf, our roles depend on the nature of the processing and applicable law.
6.8 We may retain artwork and production files for an appropriate period to support fulfilment, queries, repeat orders and legitimate business requirements.
6.9 Retention is subject to our documented practices, legal obligations and relevant contracts.
6.10 Customers may contact us to request deletion of artwork or files containing their personal information. We consider requests under applicable law and continuing legitimate retention requirements.
7. Website Enquiries and Communications
7.1 When you contact us through a form, email, telephone or another channel, we may collect your name, contact details, message and relevant correspondence.
7.2 We use this information to respond, prepare quotations, provide support, manage customer relationships and maintain business records.
7.3 We may retain correspondence where reasonably necessary to administer services, resolve disputes or comply with legal obligations.
7.4 Authorised communications, email and customer management service providers may help us handle correspondence.
7.5 An enquiry does not automatically give us permission to send unrelated electronic marketing where consent or another lawful exception is required.
8. Marketing Communications
8.1 We may contact customers and business contacts about products, services, offers and company updates where permitted by data protection and electronic marketing legislation.
8.2 Where consent is required, we obtain appropriate permission before sending electronic marketing.
8.3 Where legally permitted, we may contact existing customers about similar products or services under the applicable soft opt-in rules, provided the conditions are met.
8.4 We may communicate with corporate business subscribers where permitted by PECR and the UK GDPR.
8.5 We use marketing platforms, which may include Mailchimp, to manage mailing lists, subscriptions and communications.
8.6 Such platforms may process contact details, subscription preferences and interactions with marketing communications where applicable.
8.7 Marketing emails provide an appropriate unsubscribe or opt-out method.
8.8 You may request removal from marketing lists by emailing info@dscreative.co.uk.
8.9 We maintain suppression records where necessary to respect opt-out requests.
8.10 Opting out of marketing does not prevent necessary order, account, service or legal communications.
9. Website Security and Technical Information
9.1 Our systems and authorised technology providers may process technical information when you visit our website.
9.2 This may include IP addresses, browser information, device characteristics, access logs, security events and diagnostic information.
9.3 We use such information to operate and secure the website, investigate faults, identify malicious activity and maintain reliable services.
9.4 Depending on the systems involved, security measures may include access controls, authentication, software maintenance, monitoring and backups.
9.5 No website, electronic transmission or storage system can be guaranteed entirely free from security risks.
9.6 We consider whether security measures remain appropriate to the data processed and the associated risks.
10. Website Hosting and Data Processing on Behalf of Customers
10.1 DS Creative provides website design, hosting, maintenance and related services to business customers.
10.2 For our own hosting account administration, billing and support, we normally act as a Data Controller.
10.3 Where we process information on a customer’s website solely on that customer’s behalf, we normally act as a Data Processor.
10.4 The customer generally acts as Data Controller for information collected from visitors and users of its website.
10.5 We use 20i for hosting infrastructure. Where 20i processes relevant personal information on our behalf, it may act as a Sub-Processor.
10.6 Our obligations as a Data Processor are governed by applicable data protection law and the relevant Data Processing Agreement.
10.7 Customers are responsible for appropriate privacy notices, lawful bases and other Data Controller obligations for their websites.
10.8 Individuals seeking to exercise rights concerning information controlled by a hosting customer should normally direct their request to that customer.
10.9 Where we receive such a request, we may refer it to the customer and provide appropriate assistance in accordance with law and contract.
10.10 Retention, return and deletion of customer website information are governed by the relevant hosting agreement and Data Processing Agreement, subject to legal requirements.
10.11 Our separate Data Processing Agreement provides further detail on processor obligations, subprocessors, security and customer-controlled data.
11. Sharing Personal Information
11.1 We may share information with trusted third parties where reasonably necessary for purposes described in this policy.
11.2 These may include printers and finishers; couriers; website hosting providers including 20i; payment processors; accounting and invoicing providers; email and communications providers; marketing platforms including Mailchimp where used; analytics and technical services; IT support and security specialists; professional advisers; and regulators or public authorities where lawful or required.
11.3 We share only information reasonably necessary for the purpose.
11.4 Where third parties process personal information on our behalf, we use appropriate contractual arrangements where required.
11.5 Some third parties act as independent Data Controllers for particular services, including certain payment providers and professional advisers.
11.6 We do not sell customer personal information to third parties for their independent marketing.
11.7 We may disclose information where necessary to comply with law, respond to lawful requests, establish legal rights or protect against fraud or other unlawful activity.
12. International Data Transfers
12.1 Some authorised service providers may process or access information outside the United Kingdom.
12.2 This may occur through cloud services, website infrastructure, email, marketing platforms and technical support.
12.3 Where a transfer is restricted under UK data protection law, we use a lawful transfer mechanism.
12.4 This may include applicable UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or other lawful safeguards.
12.5 Where required, we conduct relevant assessments and apply appropriate additional safeguards.
12.6 You may request further information about relevant international transfers using the contact details below.
13. How Long We Keep Personal Information
13.1 We retain personal information only for as long as reasonably necessary for the purpose collected, subject to legal, contractual and regulatory requirements.
13.2 Relevant considerations include the type of information, the purpose, customer relationship, legal obligations, possible disputes and security needs.
13.3 Our general retention approach is: financial records and relevant transaction records are normally retained for six years from the end of the relevant financial year, or longer where required; customer account and order information for the relationship and an appropriate later period; design and print artwork for production, repeat orders, queries and legitimate purposes; enquiries and correspondence while reasonably necessary; marketing subscriptions until opt-out or another trigger, with limited suppression records where necessary; website security logs for a proportionate operational and security period; hosting data under the relevant hosting agreement and Data Processing Agreement; and recruitment information for an appropriate recruitment and legal period.
13.4 Where exact periods are not stated, we determine retention using documented business requirements and legal obligations.
13.5 When information is no longer required, we arrange deletion, anonymisation or other appropriate disposal, subject to technical and legal constraints.
13.6 Information in backups may remain temporarily until its backup reaches the end of the retention cycle.
13.7 We consider deletion requests under applicable data protection rights and exemptions.
14. How We Protect Personal Information
14.1 We take reasonable and proportionate technical and organisational measures against unauthorised access, unlawful processing, accidental loss, destruction and damage.
14.2 Depending on the systems and services, these may include access restrictions, authentication, security maintenance, backups, supplier controls, confidentiality requirements and monitoring.
14.3 We seek to restrict access to employees, contractors and providers with a legitimate need.
14.4 When using third-party providers, we consider their security responsibilities and put contracts in place where required.
14.5 We review security incidents and take appropriate action in accordance with legal obligations.
14.6 We cannot guarantee that electronic systems are risk-free; this does not remove our legal responsibilities.
15. Cookies and Similar Technologies
15.1 Our website uses cookies and may use other storage or access technologies for functionality, preferences, security and website measurement.
15.2 A cookie is a small piece of information stored on a device by a website or related service.
15.3 Technologies may include: strictly necessary technologies for essential website functions, shopping baskets, accounts and security; preference technologies for remembering settings; analytics technologies for understanding usage and performance; and marketing technologies, where used and appropriately permitted.
15.4 We seek consent where required by PECR before using technologies that are not covered by a lawful exception.
15.5 Some technologies may be used without consent where a statutory exception applies. Any applicable information or objection requirements will be observed.
15.6 Visitors may manage available cookie preferences using the website consent controls.
15.7 Where applicable, visitors can withdraw consent or change preferences using these controls.
15.8 Browser settings may also block or delete cookies, although this can affect functionality.
15.9 Third-party analytics, advertising or embedded content providers, where used, may set or access cookies in accordance with applicable consent choices and their privacy notices.
15.10 Details of the technologies actually deployed, including relevant providers, purposes and durations, should be available through our cookie preference system or associated cookie information.
16. Your Data Protection Rights
16.1 Depending on the circumstances and law, you may have rights of access, rectification, erasure, restriction, data portability, objection, rights relating to qualifying solely automated decisions, and withdrawal of consent where processing is based on consent.
16.2 You have the right to object at any time to processing your personal information for direct marketing.
16.3 Where a valid objection to direct marketing is received, we stop processing the relevant information for that purpose.
16.4 Not all rights apply in every circumstance and some requests may be subject to legal exemptions.
16.5 Submit requests to info@dscreative.co.uk.
16.6 We may request appropriate information to verify identity where necessary.
16.7 We respond within applicable statutory time limits and explain any relevant exemption or restriction.
16.8 We do not normally charge for exercising rights, although limited lawful charges may apply in appropriate circumstances.
17. Automated Decision-Making and Profiling
17.1 Our ordinary printing, graphic design and customer order services do not generally involve solely automated decisions about individuals with legal or similarly significant effects.
17.2 We may use routine automated processes for orders, communications, website security, fraud prevention and analytics.
17.3 If qualifying automated decisions or profiling are introduced, we will provide further information and comply with applicable law.
18. Third-Party Websites and Services
18.1 Our website may link to third-party websites, platforms or services.
18.2 Those services may operate independently with their own privacy policies and terms.
18.3 We encourage visitors to review third-party privacy notices before submitting personal information.
18.4 We are responsible for our own processing and legal obligations but do not control unrelated third parties’ independent processing.
19. Complaints and the Information Commissioner’s Office
19.1 If you have a concern about how we handle personal information, please contact us.
19.2 We consider privacy complaints and seek to respond appropriately.
19.3 You have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.
19.4 The ICO website is https://ico.org.uk/ and its telephone number is 0303 123 1113.
19.5 You do not have to contact DS Creative before exercising a statutory right to complain to the ICO.
20. Changes to This Policy
20.1 We may review and update this policy for changes in legislation, regulatory guidance, technology, services or business operations.
20.2 The current version will be published on our website with a revision date.
20.3 Where a change materially affects processing, we will provide further notice if required by law.
21. Contact Us
21.1 For privacy enquiries or data protection rights requests, contact DS Creative Limited, Unit 23, President Buildings Office Park, Savile Street East, Sheffield, S4 7UQ. Telephone: 0114 266 9000. Email: info@dscreative.co.uk. Website: https://dscreative.co.uk/.
End of Privacy & Cookies Policy