Privacy Policy

1.1. This Privacy Policy explains how OnlinePhotoPrinting ("we", "us") collects and uses personal data through OnlinePhotoPrinting.us (the "Site"). For the purposes of applicable US privacy laws, including the California Consumer Privacy Act (CCPA/CPRA), OnlinePhotoPrinting is the data controller.

1.2. Registered office: TODO_US_ADDRESS, USA. EIN: TODO_US_EIN.

1.3. We follow a data-minimisation approach: we only collect the personal data we need, and we delete the photographs you upload for an order within 30 days of that order being completed.

1.4. Privacy queries: hi@onlinephotoprinting.co.uk. Please mark the subject line "Privacy" so we can route it promptly.

2.1. Account & profile. Name, email, password (hashed), phone, optional date of birth.

2.2. Order & billing. Delivery and billing address, order history, payment confirmation token (we do not store full card details — these are handled by our PCI-DSS-compliant payment provider).

2.3. Uploaded content. Photographs and any text or design choices you submit for printing.

2.4. Communications. Emails, chat transcripts and call records (calls may be recorded for training; you will be told before any recording).

2.5. Technical & usage data. IP address, device and browser information, referral URLs, pages visited, cookies and similar identifiers (see our Cookie Policy).

2.6. We do not knowingly collect "sensitive personal information" (as defined under applicable US state privacy laws), and we do not intentionally collect data from children under 16.

3.1. The table below summarises why we use your data and the basis on which we process it under applicable US state privacy laws.

4.1. We will send marketing emails about our products in two situations: (i) you have consented (e.g. ticked a marketing box at sign-up or in the dashboard); or (ii) you have an existing customer relationship with us — you bought from us, we are emailing about similar products, and you can opt out in every email (consistent with the CAN-SPAM Act).

4.2. You can withdraw consent or opt out at any time using the unsubscribe link in every marketing email, or by emailing hi@onlinephotoprinting.co.uk.

5.1. We use strictly necessary cookies without consent (these are required to make the Site work). For all other cookies (analytics, marketing, preferences) we rely on your prior consent given through our cookie banner. See our Cookie Policy.

6.1. We share data only where necessary and on the basis described:

• Payment processors (e.g. Stripe) — to take payment.
• Delivery and fulfilment partners (USPS, courier services) — to deliver your order.
• Cloud hosting and email providers — to host the Site and send transactional email.
• Analytics and marketing providers — only with your cookie consent.
• Professional advisors (accountants, lawyers) — where reasonably necessary.
• Authorities — where required by law (e.g. the Internal Revenue Service (IRS), police on lawful request).
• A buyer of our business — in the event of a sale, merger or reorganisation, subject to confidentiality and equivalent protection.

6.2. We do not sell personal data.

7.1. Some of our processors operate outside the United States. Where personal data is transferred internationally, we rely on one of:

• appropriate safeguards such as Standard Contractual Clauses;
• other appropriate safeguards permitted under applicable US state privacy laws;
• your explicit consent, where applicable.

7.2. A list of countries and safeguards is available on request at hi@onlinephotoprinting.co.uk.

8.1. Retention can be longer where required to establish, exercise or defend legal claims.

9.1. Under applicable US state privacy laws you have the right to:

• be informed about how we use your data (this policy);
• access a copy of the personal data we hold about you;
• have inaccurate personal data corrected;
• have your personal data erased in certain circumstances;
• restrict how we use your personal data;
• data portability (receive certain data in a machine-readable form);
• object to processing based on legitimate interests, including profiling;
• withdraw consent at any time where we rely on consent;
• not be subject to a decision based solely on automated processing that has legal or similarly significant effects (we do not carry out such processing).

9.2. To exercise any right, email hi@onlinephotoprinting.co.uk. We will respond within one month and may extend by up to two further months for complex requests, telling you why.

9.3. You can complain to the Federal Trade Commission (FTC) at ftc.gov or your state Attorney General's office. We would appreciate the chance to address your concern first.

10.1. We use appropriate technical and organisational measures including encryption in transit (TLS), encrypted backups, role-based access, password hashing, and PCI-DSS-compliant payment processors. No system is 100% secure; please use a strong unique password and contact us immediately at hi@onlinephotoprinting.co.uk if you suspect unauthorised account access.

11.1. The Site is intended for adults aged 18 or over. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so we can delete it.

12.1. We may update this policy from time to time. Material changes will be notified by email or on next sign-in. The "Last updated" date is at the foot of this page.