Privacy Policy
Brushworq Trade — brushworq.co.uk · Last updated: June 2026
We keep this short and plain because that’s how it should be. Here’s exactly what we collect, why we collect it, and what you can do about it.
1. Who we are
Brushworq Trade is a wholesale greeting card platform operated by Brushworq, an independent creative brand based in the United Kingdom. We are the data controller for any personal data processed through this website.
Brushworq
Southport, England, United Kingdom
Email: ceri@brushworq.co.uk
2. What we collect and why
This is a B2B platform. The personal data we process belongs to the individuals who represent the businesses trading with us — not anonymous consumers. Here’s what that looks like in practice.
Trade account registration
What: Name, business name, email address, delivery address, phone number (if provided).
Why: To create and manage your trade account and fulfil orders.
Lawful basis: Contract (Article 6(1)(b) UK GDPR) — this data is necessary to fulfil your order and maintain the trading relationship.
Order processing and invoicing
What: Order history, delivery addresses, payment records (payment card data is handled directly by our payment processor — we do not store card details).
Why: To process and despatch orders, issue invoices, and handle returns or queries.
Lawful basis: Contract (Article 6(1)(b)) and Legal obligation (Article 6(1)(c)) for financial record-keeping.
Email enquiries
What: Your name, email address, and any information you choose to include in your message.
Why: To respond to your enquiry and manage the trading relationship.
Lawful basis: Legitimate interests (Article 6(1)(f)) — responding to a business enquiry you initiated is a reasonable and proportionate use of your contact details.
Website analytics
What: Aggregated, anonymised data about how the site is used — page visits, navigation paths, browser type. No individual-level tracking.
Why: To understand how the platform is used and improve it.
Lawful basis: Legitimate interests (Article 6(1)(f)). Where analytics tools use cookies, we comply with PECR and the Data (Use and Access) Act 2025.
3. What we don’t do
- We do not sell your data to third parties. Ever.
- We do not use your data for unsolicited marketing without your permission.
- We do not make automated decisions about you that have legal or significant effects.
- We do not process special category data (health, ethnicity, beliefs, etc.).
- We do not knowingly collect data from individuals under 18.
4. Who we share data with
We only share your data where it’s necessary to run the platform. Our current processors and recipients are:
WooCommerce / WordPress — the platform your account and orders are managed through. Hosted on UK/EU infrastructure.
Payment processor — your card details go directly to our payment provider SumUp® under their own privacy terms. We do not receive or store card numbers.
Delivery carriers — name and delivery address are shared with the carrier fulfilling your order (e.g. Royal Mail, DPD).
We may also disclose data where required by law or to protect our legal rights — but that’s not something we anticipate needing to do.
5. How long we keep your data
Active trade accounts: held for as long as the trading relationship is active, plus a reasonable period after last activity.
Financial and order records: 7 years, as required by UK tax law (HMRC).
When data is no longer needed, it’s deleted or anonymised. We don’t hang on to things longer than necessary.
6. Your rights
Under UK GDPR and the Data (Use and Access) Act 2025, you have the following rights in relation to your personal data. You don’t need a reason to exercise them — just ask.
Access — You can request a copy of the personal data we hold about you (a Subject Access Request).
Rectification — If something we hold about you is wrong, we’ll correct it.
Erasure — You can ask us to delete your data. Where we’re not legally required to retain it, we will.
Restriction — You can ask us to pause processing of your data in certain circumstances.
Portability — Where processing is based on your consent or a contract and carried out automatically, you can ask for your data in a portable format.
Objection — Where we rely on legitimate interests as our lawful basis, you have the right to object to that processing. We will stop unless we have compelling legitimate grounds to continue.
To exercise any of these rights, email ceri@brushworq.co.uk. We will respond within one calendar month, as required by law.
7. How to raise a data protection complaint
If you believe we have not handled your personal data correctly, you have the right to complain directly to us. Email ceri@brushworq.co.uk with “Data Protection Complaint” in the subject line. We will acknowledge your complaint promptly and respond within one month.
You also have the right to complain directly to the UK’s data protection regulator, the Information Commission (formerly the ICO), at any time — you don’t need to come to us first. You can reach them at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
8. Cookies
This site uses cookies to make it function. These include:
Strictly necessary cookies — required to keep you logged in, maintain your basket, and process orders. These cannot be disabled without breaking the site. No consent is required under PECR for strictly necessary cookies.
Analytics cookies, if used, are aggregated and anonymised. Under the Data (Use and Access) Act 2025, low-risk analytics cookies may not require consent — but you can opt out at any time by adjusting your browser settings or contacting us.
9. International transfers
We aim to keep your data within the UK and EEA. Some of our third-party processors (such as WooCommerce/Automattic) may process data outside the UK. Where this occurs, we ensure that adequate safeguards are in place under UK GDPR — either through an adequacy decision or appropriate transfer mechanisms. The UK holds an EU adequacy decision (renewed December 2025), meaning data can flow freely between the UK and EEA.
10. Changes to this policy
We’ll update this page if anything changes — the date at the top tells you when it was last revised. We won’t quietly rewrite it in a way that reduces your rights. If a significant change affects how we use your data, we’ll let you know directly.
This policy is governed by the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (as amended). Brushworq operates as a sole trader based in England.
Questions about this policy? Email ceri@brushworq.co.uk.