Whitham Print Services

Privacy policy.

Whitham Print Services Ltd
Last updated: 9 November 2026

1. Who we are and how to contact us

Whitham Print Services Ltd ("we", "us" or "our") provides independent print management and digital signage services to organisations in England, Scotland and Wales.

  • Registered office: 50 Ash Drive, Southampton, SO30 3FA
  • Company number: 12714334
  • ICO registration: ZB332993
  • Email: sales@whithamprintservices.co.uk
  • Telephone: 023 8098 4404

This policy explains how we handle personal information and describes individuals' rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable electronic communications rules.

2. Our responsibilities: controller and processor

When we act as a controller, we decide why and how personal information is used for our own business purposes. This includes responding to enquiries, managing customer and supplier relationships, arranging orders and deliveries, keeping accounts and operating our website.

When we act as a processor, we handle personal information supplied by customers on their behalf and in accordance with their documented instructions and applicable data processing agreements. Examples include names and photographs in artwork, mailing addresses and information used for variable-data printing. The customer normally remains the controller of that information.

The role depends on the particular processing activity, not simply the type of file. We do not use personal information entrusted to us as a processor for our own unrelated purposes. If an individual contacts us about information we process for a customer, we may refer the request to that customer and assist them in responding.

3. Personal information we handle and where it comes from

We receive information directly from people who contact us, our customers and their authorised representatives, and suppliers involved in an order.

Information may include:

  • Enquiries and quotations: whatever you choose to send us by email or telephone, such as your name, company, contact details, print requirements, quantity, delivery date and any artwork or file-transfer links.
  • Customers, business contacts and suppliers: contact names, job titles, business contact details, delivery addresses, correspondence and information needed to manage orders or accounts.
  • Orders and accounting: order history, quotations, invoices and related financial records.
  • Artwork and production files: designs, documents, images and relevant previous versions. These may contain personal information such as names, contact details or photographs.
  • Mailing and variable-data jobs: recipient names, addresses and other information customers supply for the specific job.
  • Website operation: technical connection information, including IP addresses, used to deliver and protect the website. The current website services are described in section 9.

Please supply only the information necessary for your enquiry or job. If proposed work involves sensitive personal information, contact us first so that the appropriate instructions and arrangements can be agreed.

4. Why we use personal information and our lawful bases

Where we act as a controller, our purposes and applicable lawful bases include:

Purpose Applicable lawful basis
Responding to enquiries and preparing quotations Taking steps at an individual's request before entering a contract with them; or legitimate interests in responding to business enquiries where the contract is with an organisation
Managing orders, production, delivery and ordinary customer communications Performance of a contract with the individual concerned; or legitimate interests in fulfilling an organisation's order and managing its business contacts
Maintaining customer and supplier relationships and account administration Contract where applicable; otherwise legitimate interests in running our business
Keeping necessary artwork and production files for reprints and reference Legitimate interests in providing an ongoing print management service, subject to the necessity reviews described below
Keeping records required by accounting, tax or other applicable laws Legal obligation
Protecting the website and preventing misuse Legitimate interests in protecting the service and people who use it

Where we rely on legitimate interests, we consider whether the processing is necessary and balance those interests against individuals' rights and expectations. You may object as explained in section 11.

Processing carried out solely on a customer's behalf follows that customer's documented instructions and applicable processing agreement; the customer is responsible for identifying the appropriate lawful basis for that processing.

5. Ordinary communications and possible future marketing

We currently do not send marketing emails or newsletters. Communications about quotations, orders, deliveries and account administration are ordinary service communications, not an existing marketing programme.

We may introduce communications about relevant company news, services and offers in future, including to existing customers and prospective business contacts. Before doing so, we will establish an appropriate UK GDPR lawful basis and comply with the Privacy and Electronic Communications Regulations (PECR).

The rules differ according to the recipient:

  • Corporate subscribers, such as limited companies and LLPs, are treated differently under PECR from individual subscribers. Using a named person's business contact details still requires compliance with UK GDPR, including a lawful basis and respect for objections to direct marketing.
  • Individual subscribers, including individuals, sole traders and some partnerships, normally require consent for marketing emails unless a specific applicable exception, such as a valid soft opt-in, has been established and all its conditions are met.

Legitimate interests alone do not permit every business-to-business marketing email. We will not treat a quote request as blanket permission for marketing.

Recipients will be able to opt out of marketing at any time through an appropriate unsubscribe option or by contacting us. Opting out of marketing will not prevent necessary communications about a quotation, order or account. If marketing is introduced, a minimal suppression record may be needed to respect an opt-out.

Before introducing email marketing, we will confirm the platform, contact-list sources, relevant permissions, unsubscribe arrangements and any tracking technologies, and review this policy and any required consent arrangements.

6. Who receives personal information

We share information only where necessary for the relevant service or obligation. Recipients may include:

  • Trade printers, finishers, mailing houses, signage suppliers and couriers, where information is necessary for production, fulfilment or delivery.
  • Microsoft 365, which we use for business email and related communications.
  • FreeAgent, which we use for accounting and financial administration.
  • Lovable, which hosts this website. The website does not collect enquiries, forms or uploads; the host processes only technical connection information needed to deliver and protect the site (see section 9).
  • Professional advisers and relevant authorities, where necessary for advice or compliance with legal obligations.

Our regular suppliers have written data processing terms. Where a supplier processes personal information on our behalf, the relevant contractual processing obligations apply. Some recipients, including certain couriers or professional advisers, may act as controllers for their own activities rather than as our processors. Where we are a customer's processor and involve another processor, the customer's agreement and applicable subprocessor requirements govern that arrangement.

7. International processing and transfers

Some service-provider arrangements may involve processing or access outside the UK. The place where data is stored is not necessarily the only place where it is processed or accessed.

Microsoft 365 and FreeAgent are used under their standard business service arrangements. Their published processing terms provide for international processing subject to relevant safeguards, including adequacy arrangements or contractual clauses with the UK provisions where applicable. This is not a statement that all data is stored or accessed only in the UK.

Lovable hosts the website using infrastructure in the UK, EU and other locations, including global edge services. It processes only technical connection information for the website, under its published terms and privacy policy.

You may contact us for information about the relevant processing and transfer arrangements. Provider information is also available at:

8. How long information is kept

We distinguish enquiry files, reusable artwork and job-specific mailing data. A file containing personal information is not retained indefinitely merely because it is described as artwork.

Enquiries

Enquiries are received by email or telephone and held in our Microsoft 365 email. Enquiries that do not lead to an order, and any artwork supplied only for them, are reviewed for deletion after two years from the last meaningful contact. Information needed for an order is kept as described below.

Customer artwork and production files

Retaining artwork supports our ongoing print management service, particularly future reprints and reference. We retain customer artwork and production files while there is a legitimate business reason to keep them. Appropriate previous versions may be retained because customers sometimes need to reproduce an earlier design or refer to historical versions.

Customers can request deletion of their artwork, subject to applicable legal or contractual obligations. We assess whether personal information remains necessary and review artwork for inactive customers periodically. There is no automatic deletion after seven years. Where there is no continuing justification to retain personal information, it is deleted or otherwise removed from the retained material as appropriate.

Where we act as a processor, retention, return and deletion follow the customer's instructions and the applicable data processing agreement.

Mailing lists, addressing and variable-data printing

Personal information supplied for mailing, addressing or variable-data printing is treated separately from reusable artwork. It is used only for the relevant job.

Both Whitham Print Services Ltd and the relevant third-party mailing and fulfilment suppliers delete their copies of the mailing data once the job is completed, including necessary fulfilment checks or resolution of delivery queries. We do not prescribe an arbitrary number of days after dispatch because these checks form part of job completion.

Mailing databases are not retained for future marketing or unrelated purposes. Where we act as a processor, the customer's instructions and applicable data processing agreements govern retention and deletion. Job records that must be kept for accounting or contractual reasons are distinct from the mailing database and should contain only necessary information.

Accounting and other business records

We keep accounting and tax records for the periods required by applicable UK law. For company accounting records, this is normally six years from the end of the last company financial year to which they relate. Certain records must be kept longer, for example where they concern transactions spanning accounting periods, long-lived assets, a late Company Tax Return or an HMRC compliance check. VAT and other records are retained under the rules that apply to those records. We may also retain necessary records for a specific legal or contractual obligation or to establish, exercise or defend legal claims. These requirements do not mean that every enquiry, mailing list or artwork file is kept for the same period.

Deleted information may remain in restricted recovery copies until the applicable recovery or backup period expires. Recovery copies are not used for ordinary business purposes; retention and disposal decisions must be reapplied if information is restored.

9. Website cookies and other services

Optional visitor analytics and click tracking are disabled. We do not use Google Analytics, Meta Pixel or similar tools to measure or track visits.

The website uses hosting cookies and browser session storage that are needed to deliver and protect it:

Technology Description Observed duration
__cf_bm Cloudflare bot-management cookie used to protect the website against automated misuse Approximately 30 minutes
__dpl Technical hosting cookie associated with website delivery and deployment consistency Approximately 24 hours
Browser session storage for scroll restoration Remembers page scroll positions during navigation Browser tab session

We treat these as strictly necessary for providing the website you have asked to view, so they do not require consent under PECR. They are not used for analytics or advertising.

Hosting services also process technical connection information, such as IP addresses, to deliver and protect the website. Turning off optional analytics does not mean the hosting provider processes no technical information.

The typefaces are served through our website's own asset service. Your browser does not need to connect to Google Fonts to display them.

Links to Facebook, LinkedIn and Google take you to those services, which have their own privacy information. They are links rather than embedded social-media tracking widgets in the pages inspected.

Before introducing additional analytics, marketing tracking or similar technologies, we will review this policy and any required consent or objection arrangements.

10. Keeping personal information secure

We use multi-factor authentication and password-protected devices as part of our business security arrangements.

The website uses HTTPS connections and does not collect or store enquiries or uploaded files. We limit sharing to the information necessary for the relevant work and use the supplier processing arrangements described above.

These measures reduce risks but do not eliminate every risk. No additional certification, malware-scanning or security guarantee is claimed in this policy.

11. Your rights

Depending on the circumstances and the legal basis for processing, you may have the right to:

  • access your personal information and obtain a copy;
  • have inaccurate information corrected and incomplete information completed;
  • request deletion where the right to erasure applies;
  • request restriction of processing;
  • object to processing based on legitimate interests and object to direct marketing at any time;
  • receive or transfer information where the right to data portability applies; and
  • withdraw consent at any time where processing relies on consent, without affecting the lawfulness of processing before withdrawal.

These rights are subject to applicable conditions and exemptions. For example, some information may need to be retained to meet a legal obligation or establish, exercise or defend legal claims. An objection to direct marketing must be respected.

Contact sales@whithamprintservices.co.uk or write to our registered office. We may need proportionate information to verify your identity. We normally respond within one month; where a lawful extension is necessary because of complexity or the number of requests, we will explain it within the initial period. Requests are normally free of charge, subject to the limited circumstances where the law permits a charge or refusal.

If the information was supplied by a customer and we act as their processor, we may refer your request to them as the controller and assist them under the applicable agreement.

12. Complaints

Please contact us if you have a concern about how your personal information is handled. You also have the right to complain to the Information Commissioner's Office (ICO), and you do not have to contact us first:

13. Changes to this policy

We will review this policy when our services, processing practices or relevant requirements change. The current version and its last-updated date are available on this page.