Privacy Policy

This website is operated by Engraved Society.

Business name

Engraved Society

Website

engravedsociety.com

Email

support@engravedsociety.com

For the purposes of UK data protection law, Engraved Society is the data controller for the personal information we collect and use.

This means we decide how and why your personal information is used and are responsible for complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), and relevant amendments made by the Data (Use and Access) Act 2025.

We may collect and use the following types of personal information:

Information you provide when placing an order

This may include:

• your name
• billing address
• delivery address
• email address
• phone number
• order details
• product choices
• delivery preferences
• payment confirmation details
• any notes or messages you add to your order

Personalisation and engraving information

Because we sell laser engraved products, we may collect information you provide for personalisation, including:

• names
• dates
• messages
• quotes
• photographs
• logos
• artwork
• designs
• uploaded images
• font choices
• layout choices
• product customisation instructions

You should only provide personalisation information that you are happy for us to use to make your order.

If you upload or provide images, names, dates or other personal information about someone else, you are responsible for making sure you have permission to provide that information to us.

Account information

If you create an account on our website, we may collect:

• your name
• email address
• billing and delivery addresses
• order history
• saved account preferences
• login details
• password information in encrypted form

We do not have access to your plain-text password.

Guest checkout information

If you buy a product as a guest, we collect the information needed to process your order, take payment, produce the item and deliver it to you.

Guest checkout does not create a customer account, but we may still keep order records for legal, tax, accounting, fraud prevention and customer service purposes.

Payment information

Payments are processed securely by third-party payment providers.

We do not store your full payment card details on our website. We may receive limited payment-related information, such as:

• payment status
• transaction reference
• billing details
• last four digits of a payment card, where provided by the payment processor
• fraud prevention checks
• refund status

Contact and communication information

If you contact us by email, contact form, social media, live chat or another method, we may collect:

• your name
• contact details
• message content
• order number
• attachments or images you provide
• records of our communication with you

Newsletter and marketing information

If you sign up to our newsletter or agree to receive marketing emails, we may collect:

• your name
• email address
• marketing preferences
• sign-up date
• unsubscribe status
• email engagement information, where available, such as whether an email was opened or a link was clicked

Technical information

When you use our website, we may collect technical information such as:

• IP address
• browser type
• device type
• operating system
• pages visited
• referring website
• time and date of visit
• approximate location based on IP address
• cookie information
• website usage information

We use your personal information to:

• process and fulfil your orders
• create personalised and laser engraved products
• take payment and issue refunds
• deliver your order
• contact you about your order
• provide customer support
• manage your customer account
• respond to enquiries, complaints or return requests
• keep records of orders and transactions
• prevent fraud and misuse of our website
• improve our website, products and services
• send marketing emails where permitted
• comply with legal, tax, accounting and regulatory obligations
• protect our legal rights

Under Article 6 of the UK GDPR, we must identify and document a lawful basis before using personal information. The lawful basis depends on why and how the information is being used.

Contract

We use personal information where it is necessary to enter into or perform a contract with you. This includes processing an order, creating a personalised item, taking or confirming payment, arranging delivery, handling a return and providing order-related customer service.

Legal obligation

We may use or retain information where this is necessary to comply with a legal duty, including tax, accounting, consumer protection, product safety, fraud prevention, court-order and regulatory requirements.

Legitimate interests

We may use information where this is necessary for our legitimate interests or those of another person, unless your interests, rights or freedoms override those interests. Where required, we consider the purpose, necessity and potential effect on you before relying on this basis.

• responding to enquiries
• preventing fraud and misuse
• maintaining website and account security
• improving products and services
• keeping proportionate business records
• handling disputes and legal claims
• understanding website performance
• protecting customers and our business

Consent

We rely on consent where you have made a freely given, specific, informed and unambiguous choice, including for certain marketing communications and non-essential cookies. You can withdraw consent at any time.

Vital interests and public task

These bases are unlikely to apply to our normal retail activities. We may rely on vital interests where processing is necessary to protect someone’s life, or on public task only where we are carrying out a task in the public interest or exercising official authority recognised by law.

Special category and criminal offence information

If information supplied for personalisation or customer support reveals special category information, we will only use it where an Article 9 UK GDPR condition and, where required, a condition under the Data Protection Act 2018 applies. Criminal offence information will only be processed where authorised by UK law and appropriate safeguards are in place.

When you provide personalisation details or upload content for engraving, we use that information to create and fulfil your order.

This may include storing uploaded images, text, designs or artwork as part of your order record.

You should not upload or provide sensitive personal information unless it is necessary for your order and you are happy for us to use it for that purpose.

Sensitive personal information may include information about health, religion, political opinions, ethnicity, biometric data or other special category data.

If we believe uploaded content is unlawful, offensive, inappropriate, technically unsuitable, or may infringe another person’s rights, we may refuse or cancel the order.

If you create an account, we use your account information to:

• let you log in securely
• display your order history
• save billing and delivery details
• manage your account
• make future checkout easier
• provide customer support

You are responsible for keeping your account login details secure.

If you want your account deleted, you can contact us. We may still need to keep certain order information for legal, tax, accounting, fraud prevention or dispute purposes.

If you check out as a guest, we only create the order record needed to process and fulfil your purchase.

We may still retain guest order details for legal, tax, accounting, fraud prevention, customer service and returns purposes.

Payment information is processed by secure third-party payment providers.

We do not store your full card details.

Your payment provider may collect and process your personal information in accordance with its own privacy policy. You should read the privacy policy of the payment provider used at checkout.

We may use payment information to:

• confirm payment
• process refunds
• prevent fraud
• deal with chargebacks
• keep accounting records
• resolve payment disputes

We use your delivery information to send your order to you.

We may share relevant delivery details with postal providers, couriers, fulfilment partners or delivery service providers.

This may include:

• your name
• delivery address
• phone number
• email address
• order reference
• delivery instructions

Delivery providers may use your information to deliver your parcel, provide tracking updates, manage failed deliveries, and handle delivery-related enquiries.

Our electronic marketing must comply with the UK GDPR and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR).

If you sign up to our newsletter or otherwise give valid consent, we may send information about:

• new products
• offers and discounts
• seasonal promotions
• shop news
• product launches
• abandoned basket reminders, where lawfully enabled
• similar products or services

Where PECR permits the existing-customer “soft opt-in”, we may contact you about our own similar products or services if we obtained your details during a sale or genuine sales negotiation and gave you a clear opportunity to opt out when the details were collected and in every later message.

You can object to direct marketing at any time. You can unsubscribe through the link in an email or contact us directly. We will action your request and may keep a minimal suppression record so that we do not contact you again by mistake.

We will not sell your personal information to third parties for their own marketing.

Our use of cookies, pixels, local storage and similar technologies is governed by PECR and, where personal information is involved, the UK GDPR and Data Protection Act 2018.

We must provide clear and comprehensive information about the purposes of these technologies. Except where a technology is strictly necessary to provide a service you request, we will obtain valid consent before storing information on, or accessing information from, your device.

Strictly necessary cookies

These support services you request or functions essential to operating the website, such as:

• shopping basket
• checkout
• account login
• security
• fraud prevention
• payment processing
• remembering privacy choices

Analytics cookies

Where enabled with the required permission, these help us understand how visitors use the website, which pages are viewed and how customers move around the site.

Marketing cookies

Where you consent, these may be used to measure advertising, create audiences, support remarketing or show more relevant advertisements.

Preference cookies

These may remember optional choices such as currency, region or display preferences. Consent will be requested where PECR requires it.

You can accept, reject or change your non-essential cookie choices through our consent controls. Withdrawing consent will not affect the lawfulness of processing carried out before withdrawal. Browser settings can also block or delete cookies, although this may affect website functions.

Please read our separate Cookie Policy for the current list of cookies, providers, purposes and durations.

We may share your personal information with trusted third parties where necessary to operate our business and fulfil your order.

This may include:

• payment processors
• banks and card providers
• postal services and couriers
• website hosting providers
• ecommerce platform providers
• WordPress, WooCommerce or related website service providers
• email marketing platforms
• analytics providers
• fraud prevention services
• IT and security providers
• professional advisers, such as accountants or legal advisers
• HMRC, regulators, law enforcement or other authorities where legally required

We only share personal information where necessary and appropriate.

We do not sell your personal information.

Some service providers may store or process personal information outside the United Kingdom. A transfer to a separate organisation outside the UK may be a restricted transfer under the UK GDPR.

Where the restricted-transfer rules apply, we will use a lawful transfer mechanism, which may include:

• UK adequacy regulations
• the UK International Data Transfer Agreement (IDTA)
• the UK Addendum to the EU Standard Contractual Clauses
• binding corporate rules, where applicable
• another approved safeguard
• a permitted statutory exception in limited circumstances

Where required, we will assess the circumstances of the transfer and take supplementary technical, contractual or organisational measures so that the protection of the information is not materially lower than in the UK.

We only keep personal information for as long as reasonably necessary.

The amount of time we keep information depends on the type of information and why we collected it.

We may keep:

• order records for tax, accounting and legal purposes
• customer service records for dispute handling and support
• personalisation files for a limited period after order fulfilment
• account information while your account remains active
• marketing information until you unsubscribe or withdraw consent
• website security records for fraud prevention and technical protection

We may retain certain records for up to 6 years where needed for tax, accounting, legal, contractual or dispute purposes.

When information is no longer needed, we will delete it, anonymise it or securely store it until deletion is possible.

We take appropriate technical and organisational measures designed to protect personal information from accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

• secure website connections
• password protection and encryption where appropriate
• role-based access controls
• secure payment processing
• security monitoring and logging
• software updates and backups
• staff and contractor confidentiality controls
• careful selection of service providers

Personal data breaches

We assess suspected personal data breaches and keep an internal record where required. If a breach is likely to result in a risk to people’s rights and freedoms, we will notify the Information Commissioner’s Office without undue delay and, where feasible, within 72 hours after becoming aware of it.

If a breach is likely to result in a high risk to an affected person, we will also tell that person without undue delay unless a legal exception applies.

No website, email system or online service can be guaranteed to be completely secure. You are responsible for keeping your account credentials confidential and contacting us promptly if you suspect unauthorised account use.

Subject to the conditions and exemptions in UK data protection law, you may have the following rights:

• the right to be informed
• the right of access
• the right to rectification
• the right to erasure
• the right to restrict processing
• the right to data portability
• the right to object
• rights relating to significant automated decisions and profiling
• the right to withdraw consent
• the right to complain to us and to the ICO

How to make a rights request

You can make a request verbally or in writing, although using email helps us keep an accurate record. Please explain what right you want to exercise and provide enough information for us to identify you and the relevant records.

We may ask for proportionate proof of identity or clarification where reasonably necessary. For a subject access request, we will carry out a reasonable and proportionate search for the requested personal information.

Response time and fees

We normally respond without undue delay and within one month after receiving a valid request and any information reasonably needed to confirm identity or clarify its scope. Where permitted by law, we may extend the period by up to two further months if the request is complex or you have made several requests. We will tell you within the initial period if an extension is needed.

We do not normally charge a fee. We may charge a reasonable fee or refuse to act where the law allows this, including where a request is manifestly unfounded or excessive.

Rights are not absolute. We may retain or continue using information where a legal exemption or another lawful reason applies, including tax, accounting, fraud prevention, legal-claim and third-party privacy requirements.

To exercise a right, email support@engravedsociety.com or use our Contact Us page.

Where we rely on your consent to use your personal information, you can withdraw that consent at any time.

For marketing emails, you can unsubscribe using the link in the email or contact us directly.

Withdrawing consent will not affect any processing that took place before consent was withdrawn.

Our website and products are not intended for children to purchase without the involvement of a parent or guardian.

If you are under 18, you should only use our website with permission from a parent or guardian.

We do not knowingly collect personal information from children for marketing purposes.

Our website may contain links to third-party websites, services or social media pages.

We are not responsible for the privacy practices, security or content of third-party websites.

You should read the privacy policy of any third-party website you visit.

If you contact us through social media, the platform may also collect and use your personal information in accordance with its own privacy policy.

We may use social media messages to respond to enquiries, provide customer support, discuss orders, or deal with customer service issues.

Please do not send sensitive personal information through social media unless necessary.

If you leave a review, testimonial, comment or other public content on our website or social media pages, that content may be visible to other people.

We may use reviews or testimonials for business and promotional purposes, but we will not publish private order details without your permission.

If you believe we have handled your personal information incorrectly, please raise a data protection complaint with us so that we can investigate.

Email

support@engravedsociety.com

Online

Contact Us page

Suggested subject

Data Protection Complaint

Please include your name, contact details, a description of the issue, relevant dates, order or account information where applicable, and the outcome you are seeking. We may request proportionate identity or authority evidence before disclosing information.

In accordance with current UK data protection law, we will provide a clear method for complaints, acknowledge receipt within 30 days, take appropriate steps to investigate without undue delay, keep you informed where appropriate, and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator. The ICO may expect you to have raised the matter with us first.

ICO guidance

How to make a data protection complaint

We may update this Privacy Policy from time to time.

The latest version will be available on our website.

If we make significant changes, we may notify you by email or by placing a notice on our website.

If you have any questions about this Privacy Policy or how we use your personal information, please contact us:

Engraved Society

Website

engravedsociety.com

Contact page

engravedsociety.com/contact-us/

Email

support@engravedsociety.com

This policy is intended to explain our processing in line with the UK GDPR and the Data Protection Act 2018, as amended by legislation including provisions of the Data (Use and Access) Act 2025 that are in force. Our use of cookies and electronic marketing is also subject to PECR.

The seven UK GDPR principles

When we process personal information, we aim to follow these principles:

• lawfulness, fairness and transparency
• purpose limitation
• data minimisation
• accuracy
• storage limitation
• integrity and confidentiality
• accountability

Accountability, privacy by design and records

We are responsible for being able to demonstrate compliance. This may include maintaining processing and consent records, reviewing retention periods, using appropriate contracts with processors, assessing legitimate interests, managing rights requests, and carrying out a data protection impact assessment where planned processing is likely to create a high risk to people.

Automated decisions

If we use solely automated processing to make a decision that produces a legal or similarly significant effect, we will identify a lawful basis and provide the information and safeguards required by UK law. Depending on the circumstances, safeguards may include the ability to obtain human intervention, express a point of view and challenge the decision.

Official legal and regulatory information

UK GDPR

UK General Data Protection Regulation

DPA 2018

Data Protection Act 2018

DUAA 2025

Data (Use and Access) Act 2025

ICO guidance

UK GDPR guidance and resources