Privacy Policy

PromoLab Merchandise Solutions Ltd

Company number: 10488636

Email: [email protected]
Telephone: +44 (0)20 7112 9084

For most of the activities described in this policy, PromoLab is the controller of your personal information. This means that we decide why and how your information is used.

Where a client provides personal information to us solely so that we can operate a managed merchandise store, fulfil orders or distribute merchandise on its instructions, we may act as a processor on behalf of that client. In those circumstances, the client remains primarily responsible for explaining how the information is used.

We collect only the information reasonably required to operate our business and provide our services.

Business and contact information

This may include:

• your name;
• job title;
• employer or company;
• business email address;
• telephone number;
• billing or delivery address; and
• the content of correspondence with us.

Merchandise briefs and enquiries

When you use our “Bring us your brief” form or otherwise ask us about a project, we may collect:

• your name, company and contact details;
• what you are planning;
• the intended audience;
• approximate quantities;
• budget information;
• required delivery date;
• delivery location or locations;
• project details, requirements and comments; and
• documents, artwork, images or other files that you choose to upload.

Telephone numbers are optional unless otherwise stated.

Please do not include special-category information, payment-card details or other sensitive personal information unless it is genuinely necessary and we have specifically asked you to provide it.

Where you provide information about another person, you should ensure that you are authorised to do so and that they understand how their information may be used.

Order and fulfilment information

This may include:

• recipient names and delivery addresses;
• order details and order history;
• product choices and sizes;
• delivery instructions;
• shipment and tracking information;
• returns information; and
• event, office or destination details.

A client may provide some of this information to us on behalf of its employees, customers, event attendees or other recipients.

Financial and transaction information

This may include:

• quotations and purchase orders;
• invoices and credit notes;
• payment status and transaction references;
• refunds; and
• accounting and tax records.

Payment-card information is processed by specialist payment providers. PromoLab does not intentionally store complete payment-card numbers.

Website and security information

When you use our website, limited technical information may be processed, including:

• browser and device information;
• user-agent information;
• the page from which an enquiry was submitted;
• submission date and time;
• security and error information;
• an identifier used to prevent duplicate submissions; and
• IP-address information required for security and abuse prevention.

When the “Bring us your brief” form is submitted, an IP address may be processed temporarily so that submission limits can be applied and a cryptographic hash can be created.

We do not intentionally retain the raw IP address within the enquiry record. The resulting hash is used to help detect excessive or abusive submissions and is not intended to identify or track people across other websites.

Marketing information

We may record:

• whether you have asked to receive information from us;
• your communication preferences;
• whether you have interacted with a business email, where the relevant system provides that information; and
• whether you have unsubscribed or objected to marketing.

We may obtain personal information:

• directly from you;
• from your employer, colleague or another business contact;
• from a client asking us to fulfil or distribute merchandise;
• through a PromoLab-managed merchandise store;
• from payment, shipping and fulfilment providers;
• through our website and its security systems; or
• from legitimate public business sources, such as company websites and professional networking platforms.

Responding to enquiries and preparing proposals

We use contact information, brief details and uploaded materials to:

• understand what you require;
• communicate with you;
• research and recommend suitable products;
• prepare quotations, visuals, samples or proposals; and
• take steps towards entering into a contract.

Our lawful basis is normally our legitimate interests in responding to business enquiries and developing business relationships. Where applicable, we may also process information to take steps at your request before entering into a contract.

Supplying merchandise and services

We use information to:

• source, manufacture and supply merchandise;
• process and manage orders;
• create artwork and product specifications;
• operate merchandise stores;
• arrange storage, packing and dispatch;
• deliver merchandise to offices, events or individuals;
• manage returns, complaints and quality issues; and
• provide customer support.

Our lawful basis is normally contractual necessity and our legitimate interests in delivering and administering our services.

Where we act solely on a client’s instructions, we process recipient information in accordance with our agreement with that client.

Business administration and finance

We use information to:

• manage quotations and purchase orders;
• issue and reconcile invoices;
• maintain accounting and tax records;
• manage customer and supplier relationships;
• establish, exercise or defend legal claims; and
• comply with legal and regulatory requirements.

Our lawful bases are contractual necessity, compliance with legal obligations and our legitimate interests in managing the business.

Website security and reliability

We use limited technical information to:

• operate and secure the website;
• prevent spam, fraud and misuse;
• enforce submission limits;
• prevent accidental duplicate enquiries;
• diagnose technical faults; and
• maintain the reliability of our systems.

Our lawful basis is our legitimate interest in protecting our website, business and users.

Improving our services

We may use feedback and aggregated or appropriately anonymised information to understand how our services perform and identify possible improvements.

We will not use non-essential analytics or tracking technologies without providing appropriate information and obtaining consent where required.

Business-to-business marketing

We may send relevant information about PromoLab products and services to existing customers and other business contacts where permitted by law.

Our lawful basis may be our legitimate interests in developing business relationships or consent where consent is required.

Electronic marketing communications will include a clear way to unsubscribe. You may also object at any time by contacting us.

Legal and regulatory purposes

We may use or disclose information where necessary to:

• comply with the law;
• respond to lawful requests from regulators, courts or public authorities;
• protect our legal rights; or
• investigate suspected fraud, misuse or criminal activity.

Our lawful basis is compliance with legal obligations and, where relevant, our legitimate interests.

Information submitted through the “Bring us your brief” form is stored securely with restricted access.

Uploaded files are stored privately and are not intended to be publicly accessible. Members of the PromoLab team may receive secure, time-limited links allowing them to review an attachment.

The expiry of an attachment link does not necessarily delete the underlying file. The information and files remain subject to the retention periods described in this policy.

Uploaded files should relate directly to your enquiry. You should not upload unnecessary personal information, payment-card details, health information or other sensitive information.

We share personal information only where reasonably necessary to operate our business or provide the requested services.

Recipients may include:

• merchandise manufacturers and suppliers;
• artwork, print and production partners;
• warehousing, storage and fulfilment partners;
• couriers, freight agents and delivery companies;
• payment providers;
• accounting, customer-management and business-software providers;
• website hosting, database, file-storage and cybersecurity providers;
• business-email and transactional-email providers;
• professional advisers, including accountants, insurers and legal advisers;
• regulators, courts and public authorities where required; and
• a purchaser or professional adviser in connection with a genuine business sale, investment or restructuring.

Where service providers process personal information on our behalf, we require them to use it only for the relevant services and to apply appropriate security and confidentiality measures.

We do not sell personal information to third parties.

PromoLab works with suppliers, warehouses, service providers and delivery partners in the United Kingdom and internationally. Personal information may therefore be transferred to or accessed from countries outside the United Kingdom.

This may happen, for example, where:

• merchandise is being manufactured or delivered internationally;
• an overseas supplier requires limited project or delivery information;
• a technology provider operates infrastructure or support services outside the United Kingdom; or
• an international courier or fulfilment partner is involved.

Where required, we use safeguards recognised under UK data-protection law. These may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved Standard Contractual Clauses; or
• other lawful transfer safeguards.

We aim to share only the information reasonably required for the relevant purpose.

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including legal, accounting, operational and dispute-resolution requirements.

Our intended retention periods are:

• Enquiries that do not become projects: up to 24 months after the last meaningful contact.
• Files uploaded with those enquiries: up to 24 months after the last meaningful contact, unless deleted sooner.
• Brief-form security and anti-abuse records: up to 90 days, unless required for the investigation of misuse or a security incident.
• Client, quotation, order and contract records: up to seven years following the end of the relevant relationship or transaction.
• Accounting and tax records: normally up to seven years.
• Recipient and fulfilment information: for as long as required to fulfil the relevant order and resolve delivery, return, contractual or legal matters.
• Marketing information: until you unsubscribe, object or the information is no longer reasonably useful for that purpose.
• Suppression records: we may retain the minimum information required to ensure that an opt-out continues to be respected.

Information contained in secure backups may remain for a limited additional period before being overwritten.

When information is no longer required, we will delete it, anonymise it or otherwise place it beyond normal operational use.

Our website currently uses only cookies or similar technologies that are reasonably necessary to operate, secure and deliver the website and its forms.

We do not currently use non-essential advertising, behavioural-tracking or analytics cookies.

If we introduce analytics or other non-essential technologies in the future, we will:

• update this Privacy Policy and any separate cookie information;
• explain which technologies are used and why;
• provide appropriate controls; and
• obtain consent before using them where required.

You may control cookies through your browser settings. Blocking technologies that are strictly necessary could affect the operation of parts of the website.

We use proportionate technical and organisational measures intended to protect personal information from accidental loss, alteration, misuse, unauthorised access or disclosure.

These measures may include:

• encrypted transmission;
• restricted staff and administrative access;
• private attachment storage;
• time-limited attachment links;
• access controls;
• server-side input and file validation;
• submission-rate limits and anti-spam measures;
• duplicate-submission protection; and
• security logging and review.

No internet-connected system can be guaranteed to be completely secure. However, we take reasonable measures appropriate to the nature of the information and the risks involved.

Depending on the circumstances, you may have the right to:

• ask for access to your personal information;
• ask us to correct inaccurate or incomplete information;
• ask us to erase information;
• ask us to restrict how information is used;
• object to processing based on legitimate interests;
• object to direct marketing at any time;
• receive certain information in a portable format;
• withdraw consent where processing relies on consent; and
• complain to the Information Commissioner’s Office.

These rights are subject to legal conditions and exemptions. For example, we may need to retain information where required by law or for the establishment, exercise or defence of legal claims.

To exercise a right, contact [email protected]. We may need to verify your identity before responding.

Please contact us first if you have a concern about how we have handled personal information. We will try to investigate and resolve it.

You also have the right to complain to the UK Information Commissioner’s Office.

Our website and services are intended for businesses and business contacts. They are not directed towards children, and we do not knowingly use the website to collect personal information from children.

We do not currently use information submitted through our website to make solely automated decisions that produce legal or similarly significant effects.

We may update this Privacy Policy to reflect changes to our services, technology, suppliers, legal obligations or business operations.

The date shown at the top of the policy will be updated when material changes are made.

Questions about this policy or our use of personal information should be sent to:

Email: [email protected]
Telephone: +44 (0)20 7112 9084