Legal Privacy

Privacy Policy

Last updated: 1 October 2026
Effective: 1 October 2026

About this policy

We're Glasgow GFX, a small design, print and web studio in Glasgow. This policy explains what personal information we collect when you use glasgowgfx.com or work with us, why, who we share it with, how long we keep it, and your rights.

We follow the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and the Data (Use and Access) Act 2025. Our Cookie Policy lists every cookie and storage key the site uses.

Who we are

GLASGOWGFX LTD, trading as Glasgow GFX, is the controller of your personal data.

Company: GLASGOWGFX LTD, company no. SC842539 (Scotland)
Address: Unit 204b The Pentagon Business Centre, 36 Washington Street, Glasgow, G3 8AZ, United Kingdom
Email: support@glasgowgfx.com
Phone: 0141 345 5841
ICO reg.: [OWNER TO CONFIRM: ICO registration number]

What we collect

3.1 What you give us

Account: name, email, phone and password (stored only as a secure hash). If you sign in with Google we receive your name, email and profile picture.
Orders: billing and delivery addresses, phone, what you ordered, and payment confirmation. Card details go straight to Stripe; we never see them.
Artwork: the files you upload and their details.
Enquiries and quotes: your name, contact details and what you tell us about the job, such as budget and timescale.
Business customers: company name, VAT number and business address.

3.2 What the site records

Every visit, without cookies: the pages you view, the site or app that sent you, campaign tags and any ad click identifier in the link, approximate location (town or region, from your IP address), and browser and device type. These are tied to a code our server works out each day from your IP address and browser details. The code changes daily, is never stored on your device, and we never keep your IP address with it.
With analytics consent: a random visitor number and visit number in our own cookies, plus Google Analytics and PostHog identifiers, clicks, and how you move around a page.
With marketing consent: the ad click identifier from the advert you clicked, kept in a cookie for 90 days, and the ad platforms' own cookies.

3.3 What others give us

Stripe: payment confirmation and fraud checks.
Couriers: delivery tracking updates.

Why we use it and our lawful basis

The law needs a reason, called a lawful basis, for each use. Where we rely on legitimate interests, we have weighed them against your interests and kept the data to what is needed. You can ask us for that assessment.

Purposes, data and lawful bases
What for	Data	Lawful basis
Taking and delivering your order, and looking after you afterwards	Name, contact details, addresses, order details, artwork, payment confirmation	Contract
Answering an enquiry or quote request	What you tell us in the form, plus your contact details	Steps you asked for before a contract; legitimate interests for business enquiries
Running your account	Name, email, phone, sign-in details, saved designs, order history	Contract
Counting visits without cookies (aggregate statistics)	A daily code worked out from your IP address and browser details, pages viewed, referring site, campaign tags, ad click identifiers in the link, approximate location, browser and device type	Legitimate interests (knowing how the site is used, which pages and channels work)
Analytics with cookies: Google Analytics, PostHog (including session replay), our own visitor measurement, Ahrefs	Visitor and visit identifiers, pages, clicks, how you move around a page, approximate location, browser and device	Consent (the analytics category)
Measuring and improving our adverts, including sending conversions from our server	Hashed contact details, ad click identifiers, IP address, browser details, the event and its value	Consent (the marketing category)
Linking an enquiry or order to how you found us, and tracking what happened to it	The channel, landing page, referring site and campaign tags of your visit, and the outcome of the enquiry	Contract, and legitimate interests (understanding where our work comes from)
Reporting an enquiry’s outcome back to the ad platform that brought it	Outcome (qualified, won or lost), its value, hashed contact details and the ad click identifier	Consent (the marketing category, given on the visit that led to the enquiry)
Keeping the site secure: rate limits, blocking abuse and bots, fixing errors	IP address or a hashed daily code, browser details, error reports	Legitimate interests (security, preventing fraud and abuse, keeping the site working)
Keeping proof of your cookie choices	Your choice, the date, a hashed visitor code, browser type and the page you were on (never your IP address)	Legal obligation (UK GDPR accountability)
Tax, accounting and legal claims	Order and invoice records	Legal obligation
Marketing emails	Name and email address	Consent, or for existing customers our legitimate interests (you can unsubscribe at any time)

Measuring visits without cookies

We want to know roughly how many people visit, which pages they land on, and which channels bring enquiries: search engines, adverts, other websites, and AI assistants such as ChatGPT, Perplexity, Gemini, Copilot and Claude. To do that without cookies, our server works out a code from your IP address, browser details and our web address, scrambled with a secret key. It changes every day, isn't stored on your device, and isn't sent to your browser or to any advertiser or analytics company. We don't keep your IP address.

We use this only for aggregate statistics that help us improve the site and our service, and to link an enquiry you send that same day to the visit that led to it. It is not shared with anyone except the companies that host and run the site for us. We rely on our legitimate interests in understanding how the site is used. You can object to our cookieless measurement at any time by emailing support@glasgowgfx.com. Because the code changes daily and is not linked to your name, tell us roughly when you visited and from which device and network, and we will remove what we can find and stop using it for you.

Analytics and session replay

Only if you accept analytics cookies, we use Google Analytics 4, PostHog (hosted in the EU), Ahrefs Web Analytics and our own visitor cookies to understand how the site is used. Google's tag and PostHog are served from our own domain, which keeps your sign-in cookies away from them; it is still their processing, under the same consent.

PostHog session replay records how a visit moves around a page: scrolling, clicks and page changes. Everything you type is hidden, hidden fields and file uploads are blocked, and replay never runs on account, sign-in, checkout, order or proposal pages. Web addresses are trimmed so links with private tokens are not recorded. If you sign in or send an enquiry, we tell PostHog your account number or enquiry reference (never your email or phone) so we can see the journey that led to it.

Sharing conversions with ad platforms

We advertise on Google, Microsoft (Bing), Meta, LinkedIn and Pinterest. If, and only if, you accept marketing cookies (and your browser isn't sending Global Privacy Control), our server tells the platform that ran an advert when it led to something: an enquiry, an order, a sign-up, or later a qualified lead or a job we won. This lets them measure which adverts work and show our adverts to people more likely to need us.

What we send can include:

hashed email, phone, first and last name, town and postcode (scrambled with SHA-256 so the platform can only match them against details it already holds);
the ad click identifier from the advert you clicked;
your IP address and browser details;
the event and its value. For ads we send an estimate of our profit, not what you paid.

What each ad platform receives
Platform	What it receives	Its role
Google Ads (through Google’s Data Manager)	Leads, qualified leads, won jobs and orders, with hashed email and phone, the Google ad click identifier and a profit-based value.	Our processor for the hashed contact details (enhanced conversions); an independent controller for Google Ads measurement, under Google’s Ads data protection terms.
Google Analytics 4	Orders, enquiries, sign-ups and sign-ins recorded by our server, with your Google Analytics visitor number, your account number if you are signed in, and your approximate location. No email, phone or IP address. This needs analytics consent, and each event is marked as not for advertising use unless you also gave marketing consent.	Our processor, under Google’s data processing terms.
Microsoft Advertising	Leads, qualified leads, won jobs, orders, sign-ups and some page events, with hashed email and phone, the Microsoft ad click identifier, your IP address and browser details, and a hashed customer number.	An independent controller, under the Microsoft Advertising terms.
Meta (Facebook, Instagram)	Leads, qualified leads, won jobs, orders, sign-ups and some page events, with hashed email, phone, first and last name, town, postcode and country, the Meta browser and click identifiers, your IP address and browser details, and a hashed customer number.	Our processor for matching and measurement; a joint controller with us for using the data to optimise adverts, under the Meta Business Tools Terms.
LinkedIn	Leads, qualified leads, won jobs, orders and sign-ups, with hashed email, the LinkedIn click identifier and a hashed IP address.	Our processor, under LinkedIn’s data processing agreement.
Pinterest	Leads, won jobs, orders, sign-ups and some page events, with hashed email, phone, first and last name, town and country, the Pinterest click identifier, your IP address and browser details, and a hashed customer number.	A joint controller with us for collecting and sending the data; an independent controller for what it does with it afterwards, under Pinterest’s advertising terms.

Where a platform is a controller, it uses the data under its own privacy policy, linked from our Cookie Policy. Without marketing consent none of this is sent, and no advertising tag loads. You can withdraw at any time with ; we then stop sending anything new.

Where we are joint controllers with Meta or Pinterest, the arrangement is this: we are responsible for asking for your consent, telling you about the sharing (this policy) and sending only what is described here; the platform is responsible for its own processing once it has the data. You can use your rights with us or with the platform, and we will pass on any request that is theirs to answer.

Linking enquiries to how you found us

When you send an enquiry or quote request, we record how that visit reached us: the channel (for example search, an advert, another website, or an AI assistant such as ChatGPT), the landing page, the referring site and campaign tags. We keep this with your enquiry in our own customer system, so we know which work comes from where. The ad click identifier is only included with marketing consent, and our visitor number only with analytics consent.

As the job moves on, our system records the outcome: qualified, won or lost, and its value. If you gave marketing consent on the visit that led to the enquiry, that outcome is reported to the ad platform that brought you, as described above. If you didn't, it stays with us.

Other companies we use

We don't sell your personal data. These companies process it for us, under contract and on our instructions:

Vercel: hosts the website. Our server code runs in Dublin, and Vercel also processes data in the US. Vercel Web Analytics and Speed Insights count page views and measure loading speed without cookies.
Supabase: our database, file storage and sign-in. This is where orders, enquiries and our own measurement data are kept, on Supabase's servers in Ireland (AWS eu-west-1), inside the EU.
PostHog: product analytics, A/B tests and session replay, hosted in the EU, only with analytics consent. Typing is always hidden and replay stops on account, sign-in, checkout, order and proposal pages.
Inngest: runs our background jobs, such as order emails and sending conversions to ad platforms, on servers in the US. While a job runs it briefly holds the job's data. For a conversion that can include your IP address, browser details and hashed contact details, but only with marketing consent, and we encrypt them before they reach Inngest so Inngest cannot read them. [OWNER TO CONFIRM: how long Inngest keeps job data on our plan, and that a signed Inngest DPA is in place]
Sentry: error monitoring, with data stored in the EU (Frankfurt). Error reports from your browser reach Sentry through our own web address, without your cookies. If you are signed in, a report includes your account number only, never your email. With analytics consent it can also record a replay of a small sample of visits, and of visits that hit an error, with all text, typing and images hidden. Replay never runs on account, sign-in, checkout, order or proposal pages.
Upstash: rate limiting. To stop abuse we count requests per IP address (on our measurement endpoints, per hashed daily code instead) for a few minutes. The counts delete themselves within two hours. [OWNER TO CONFIRM: Upstash database region]
Stripe: takes card payments and checks them for fraud.
Resend: sends our emails.
Cloudflare: stores artwork images for the gallery (Cloudflare R2).
Print partners such as Tradeprint: print and post some orders for us, so they receive the delivery details.
Royal Mail, DPD and Evri: deliver orders and give us tracking updates.
Google Analytics: website analytics, only with analytics consent.
Ahrefs: website analytics without cookies, only with analytics consent. Ahrefs counts visits with a code made from your IP address and browser details that changes daily, and does not keep the IP address.

We may also share information to comply with the law or protect our rights, or with a buyer if the business is ever sold. We would tell you if that happened.

Data outside the UK

Some of these companies are based in the United States or may access data from there. When personal data leaves the UK we rely on a safeguard UK law allows. As of the date of this policy:

UK Extension to the EU-US Data Privacy Framework: Google, Microsoft, LinkedIn, Pinterest, Vercel, Stripe, Sentry, PostHog, Upstash and Resend are certified under it. Several also offer the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in their data protection terms.
Meta: the UK Data Transfer Addendum in the Meta Business Tools Terms.
Supabase: the UK Addendum to the EU Standard Contractual Clauses in its data processing agreement.
Inngest and Ahrefs: [OWNER TO CONFIRM: the transfer safeguard in each one's data processing terms]
EU hosting: PostHog and Sentry keep our data in Frankfurt, covered by the UK's adequacy regulations for the EU.

Ask us if you would like to know which safeguard applies to a particular company.

How long we keep it

Visit and measurement data (our own records of page views, enquiries, orders and what was sent to each platform): 25 months, then deleted automatically.
Records of your cookie choices: 3 years, to prove what you agreed to.
Order and invoice records: 7 years, for tax.
Account data: until you delete your account, plus 30 days for recovery.
Uploaded files: files not used in an order are deleted after 90 days; files used in an order are kept with it.
Guest baskets: 7 days after you last used them.
Our security audit logs: 180 days.
Rate-limit counts: two hours at most.
Marketing email consent: until you unsubscribe.
With other companies: Google Analytics keeps data for 14 months. Ad platforms, PostHog and Sentry keep data for the periods in their own terms.

Your rights

You have the right to:

Access a copy of your personal data, free of charge.
Correct anything that is wrong or incomplete.
Erase your data, unless we must keep it, for example for tax.
Restrict how we use it.
Take it with you in a machine-readable format.
Object to anything we do on the basis of legitimate interests, including our cookieless measurement, and to direct marketing at any time.
Withdraw consent at any time, for cookies with , or for emails with the unsubscribe link. This doesn't affect what happened before.

We don't make decisions about you that have legal or similarly significant effects using automated processing alone. The ad platforms use automated systems to decide who sees adverts; that is their processing, and you can turn it off for our site by refusing marketing cookies.

To use any of these rights, email support@glasgowgfx.com or write to us. We will reply within one month.

Complaints

If you are unhappy with how we have handled your data, you can complain to us by email at support@glasgowgfx.com. We will acknowledge it within 30 days, look into it without delay, and tell you the outcome. We would like the chance to put things right, but you can also complain to the Information Commissioner's Office at any time at ico.org.uk/make-a-complaint.

Keeping it safe

Encrypted connections (HTTPS) everywhere.
Passwords stored only as secure hashes.
Uploaded files checked for viruses.
Staff access limited by role, and two-factor sign-in available.
Card payments handled by Stripe, which is PCI DSS certified.
Our measurement records hold no raw IP address, email, phone or name; contact details are only ever stored there as hashes.

No system is completely secure, so please use a strong password and turn on two-factor sign-in.

Children

Our services are not aimed at anyone under 16, and we don't knowingly collect their data. If you think we have, please contact us and we will delete it.

Changes to this policy

When we change this policy we update the date at the top. For significant changes we will also email registered customers or show a notice on the site.

Contact us

Email: support@glasgowgfx.com
Phone: 0141 345 5841
Post: Data Protection, GLASGOWGFX LTD, Unit 204b The Pentagon Business Centre, 36 Washington Street, Glasgow, G3 8AZ, United Kingdom

Return to homepage